Resident TeaTimer & Zone Alarm Conflict

I have sent the following to Zone Labs support.

"C:\Windows\Internet Logs\vsmon_on_demand (date) full dump file
Every boot of windows creates this file plus a Zip file of the previous vsmon_on_demand. This slows bootup to a crawl. It also creates huge Internet Logs folder (1000's of MBs) depending on numbers of times you start windows.
This only occurs with Spybot Search & destroy resident "TeaTimer" running at startup. I assume there is some sort of a conflict between ZASS and TEATIMER.
This problem does not occur when running versions of ZASS 6.1.737.000 and earlier. Only the later versions 744.000 and 744.001.
Would you please look into this and see if there is a solution other than having to go back to ZASS 737.000.
All my installs of ZASS have been good and as a long time user I am very pleased.
Thankyou for your time."

As I rely on TeaTimer with ZASS I hope someone can resolve this issue.

Unless you are cwhenske at the zonelabs forum, you are not alone. See:

• vsmon on demand DMP File after 744 upgrade
  http://forum.zonelabs.org/zonelabs/b...ssage.id=46386

The only thing that I can suggest from a TeaTimer standpoint is that after the installation of ZoneAlarm Security Suite 6.1.744.001 that you refresh TeaTimer's snapshot files as follows:

• Right click Spybot's TeaTimer System Tray Icon > click Exit Spybot-S&D Resident.
  • TeaTimer closes.
  • TeaTimer's snapshot files are refreshed at this time.
• Restart TeaTimer:
  • Using Windows Explorer, navigate to C:\Program Files\Spybot - Search & Destroy.
  • Double click TeaTimer.exe to start it.

This will insure that TeaTimer recognizes any new startup entries that were installed with ZoneAlarm Security Suite 6.1.744.001 and not issue a registry change dialog at system startup to verify the installation of those startup entries again.

The only other thing that I can suggest while you are waiting for a response from Zone Lab's support is that you follow and/or add to the information in the zonelabs forum thread that I referenced above.

Thankyou very much for your help. I have placed the following reply on zonelabs forum.

"I also have the problem with a vsmon_on_demand full dmp file and zipped files on every startup. I contacted Zone Labs support and received a fast and compehensive reply (thanks Bill). Bottom line was he installed the resident TeaTimer and didn't have any problems. I also put a message on the Spybot forum and had a reply from MD_Spybot (also very good) that referred to this thread. I have a couple of questions for you.

1- Have you had to modify the TeaTimer.exe file to show accept and deny buttons correctly? I did modify mine using suggestions from a sticky on the Spybot forums. However, when returning TeaTimer to its original state I no longer get the vsmon_on_demand files. Difficult to see buttons but no problem running ZASS and resident TeaTimer.

2-Assuming you might have modified as I did, would you please put your original TeaTimer.exe back and see if it eliminates the dump files? Sure beats having to delete dmp files on every startup.

Good luck and thanks for posting here. I thought I was alone with this."

I wish that I had put your full name there (sorry). Will not forget again: md usa spybot fan

For your info I tried all the various modifications in the sticky and all exihibited the same strange behavior with ZASS. For now I am staying with the original TeaTimer.exe. This works very well for me. Happy now.

Olerob:

You seem to indicate that the original Sypot 1.4 TeaTimer does not cause a problem yet a modified version of TeaTimer does. There were three (3) fixes published in the following thread:

• Solution to fix the pop-ups in TeaTimer
  http://forums.spybot.info/showthread.php?t=122

As a matter of curiosity, since I can not test the various fixes for this problem, which modification did you have that may have cause the conflict:

1. The ResHacker fix published by ElPiedra here:
   
   • http://forums.spybot.info/showpost.p...23&postcount=1
2. The murdo patch published here:
   
   • http://forums.spybot.info/showpost.p...75&postcount=9
3. Or the patch originally by SyreneD that I published here:
   
   • http://forums.spybot.info/showpost.p...0&postcount=38

Yes the original 1.4 TeaTimer does not cause the problem. Tried a. and c. which have the problem with ZASS. Did not try the Murdo patch but will to see if same problem occurs. Initial thought was a recompile error but I must admit that I am baffled.

Have now tried b. Murdo patch. Results: 1 vsmon dmp file 60.1 Mb and 2 vsmon dmp zip files each at 21.6 Mb in internet logs (extremely long boot time). Back to original TeaTimer and all is fine. With a. and c. only 1 vsmon dmp file at 60.1 with each startup causing a dmp zip and new vsmon dmp. Still puzzled but happy that original TeaTimer and ZASS work together.

Thanks for your time and effort.

md usa spybot fan Thought you migt be interested in cwhenske reply in Zone Alarm forum:

"Olerob, .

Sure 'nuff. I had modified 1.4 Teatimer to correctly display the Allow and the Disallow buttons on the UI pop-up. I reversed the fix and rebooted and see no vsmon_on_demand dmp.

I was about to download Pro 6.1.744.1 and to a "/clean" uninstall of Pro 6.1.744.0. Guess instead of the "/clean" uninstall I'll do an upgrade to 744.1.

I really liked being able to read the Teatimer buttons. Bah! But as you point out: read the buttons clearly and rummage around to delete DMP files. The Allow button is always the one on the left.

Thanx for the insights."

I sure would like to know why?

The MD5 hash of TeaTimer.exe has changed due to the patching.

Probably the Zone Alarms Anti-Spyware monitoring program is comparing this against a known 'good' MD5 value for the original TeaTimer.exe and complaining because they don't match. Since TeaTimer keeps trying to start, the VSMon program keeps blocking and/or logging the events. TeaTimer is tenacious at keeping itself running to protect against malware attacks. Apparently the VSMon component is just as tenacious at trying to stop it.

You've got a classic conflict between real-time antispyware products here, which is why everyone is beginning to recommend using only one such product at a time. In theory they can coexist, but issues like this are only going to grow with the number and complexities of both these programs and the malware they protect against.

What I don't understand is why Zone Labs support can't instantly tell you this using information from the vsmon_on_demand log file? What are they logging for if they can't read it?

I will say, however, that the gross delay in releasing a 'fixed' version of TeaTimer has also helped create this issue. This is not a 'minor bug' as has been stated, it's a major problem for regular users that is now becoming an even bigger one.

Mayba a newer version of Teatimer?
Thanks !