Since I installed the XP SP1, during my dial-up connection the system is continuously uploading data to unknown destinations. After using Zonealarm I noticed that some application which seem Windows specific (like winmon32 and 2 or 3 others) are trying to connect to some IP addresses. I don't know for sure if they are responsible for the upload but is very annoying as it flows at a speed greater than my downloading speed and at the end of the connection I have more data uploaded than downloaded, even if virtually I did'nt uploaded anything (except data exchanged by my modem to maintain connection)! I did'nt scan the computer (yet) but could this be a Windows bug rather than a virus, worm etc? Can anybody help me, please? Thanx a lot!

Maybe check for SpyWare. Here you will find links for detection and removal software. Here is another that is at most computer stores, including Office Depot, Office Max: Spyware X-terminator Also, be sure to update any software online after installation, and every 1-2 weeks.

Google shows it as probably a virus/worm thingy. Someone stated that Norton identified these two files: C:\Windows\System32\winmon32.exe C:\Windows\System32\sysentry.exe as part of the W32.Spybot.Worm ▫ w32.spybot.worm (Norton) and also mentioned this file: C:\Windows\System32\svchosting.exe which is part of this trojan: ▫ W32.ircbot (Norton) I don't know whether you have the ircbot thingy, but that winmon32 is not something you need, obviously. As a start, TcpView will let you track in real-time, which connections your computer is making, so you can pinpoint which program is doing it and which IPs are involved. You can rightclick the connections you know aren't any good, and close them, so you regain your bandwidth [for a while]. Closing the programs will probably make them restart through a helper-file. ▫ TcpView (SysInternals) It's free and very small to download :) (other utilities at SysInternals are handy to have too). An Anti-Virus program will be the easiest way of dealing with this, though. Pick a free one, update it, and scan: [I use AVG] ▫ [on-line] BitDefender Anti-Virus ▫ [on-line] RAV Anti-Virus (AV Security) ▫ [on-line] ActiveScan Anti-Virus (Panda) ▫ [on-line] HouseCall Anti-Virus (Trend Micro) ▫ nod32 Anti-Virus (eset) ▫ Avast! Anti-Virus (Avast) ▫ F-Prot Anti-Virus (F-Secure) ▫ AVG Anti-Virus (Grisoft) You could also ask the folks on the Security&Virus forum of Computing.net, to guide you through a manual removal of the baddies, but in the long run, you'll need an Anti-Virus program anyway if you want to avoid this kind of trouble. And if your download speeds permit it, get these three free anti-spyware programs too: ▫ Spybot Search & Destroy (Safer Networking) ▫ Ad-aware (Lavasoft) ▫ [blocker] SpywareBlaster (Javacoolsoftware) (SpyBot Search&Destroy is not related to that winmon32 thingy). You could start with SpywareBlaster which will keep a lot of stuff off your computer. Remember that anti-baddie programs always need to be updated before doing a scan. ___________________________________________ ☺ [Belgium, GMT+1]_________________________svg