Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Could malware cause DPC problems?

Gearhead By Mark Gibbs , Network World , 12/12/2007
Gibbs

Last week I discussed RingCube's MojoPac products and threatened this week to look at an OEM implementation of MojoDrive for the paranoid.

That's not going to happen because just as I started to slice and dice the product I got a note saying there is a newer version and my copy would arrive this week. So, until that turns up and I can reschedule, we'll divert ourselves with other IT delights

How about dealing with problems with deferred procedure calls? Again!

Yep, that annoying processor-cycle-consuming problem I have been chasing down over the last several weeks finally reappeared. I'd left the Microsoft RATTV3 utility running (I discussed this tool a few weeks ago) and it showed me the biggest generator of DPCs (56%) was NDIS.SYS, which was also responsible for most of the interrupt service requests (96.21%).

According to Microsoft, NDIS.SYS implements the Network Driver Interface Specification (NDIS) and “has two basic functions: Managing a network adapter, including sending and receiving data through the adapter [and] Interfacing with higher-level drivers, such as intermediate drivers and transport protocol drivers.”

So, what can we conclude from this information? Not much as I have no idea what process is calling the NDIS driver with such enthusiasm. . . . I'm starting to wonder if I might have some kind of malware onboard.

Now, curiously, I was testing a program called Network Magic from Pure Networks that is designed to manage your network connections and resources. The utility's daily performance report showed the machine was generating 50MB of network traffic per hour, which wasn't too surprising as I have all sorts of applications that run continuously. What was odd was the permanent nature of the traffic. This could be a spurious measurement by Network Magic, or my background applications are busier than I know, but it might be the result of malware.

In my first attempt to see if there really was anything dubious in my system I tried Symantec's Norton 360. This package includes antivirus, antispyware, antiphishing, identity protection for Web transactions, and a PC tuneup as well as, I believe, a kitchen sink along with licensing for up to three household PCs for $79.99.

I installed Norton 360 on the desktop as well as on my wife's PC. But Norton got flaky on both machines and decided it had some kind of serious problem that required the software to be uninstalled and then reinstalled. To say that I was surprised is an understatement.

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comments (7)
Login
Forgot your account info?

network problems (NDIS)By Anonymous on March 19, 2008, 3:28 amYou probably found the issues affecting your computer by now. I just fixed a similar problem n my PC. It came packaged with a host of virusses (W32.blackbird.exe...

Reply | Read entire comment

InterestingBy Mark Gibbs on December 14, 2007, 4:47 pmA couple of people have suggested the same thing but when I killed off the update processes the DPC rate didn't drop. Unless there's something else involved in updating...

Reply | Read entire comment

Stopping the problemBy Kevin Bonds on December 14, 2007, 3:30 pmI know I'm late to the topic - but my laptop had the same symptoms as yours until I turned off automatic updates. Now I just manually check once a week - and my...

Reply | Read entire comment

RE: Could malware...By Miles Baska on December 13, 2007, 10:36 amI dumped Zone Alarm a long time ago because it was eating up machine cycles on my w2k box -- and I'm NAT'd, so it wasn't Internet traffic that was nailing me, but...

Reply | Read entire comment

I used Process Explorer fromBy Mark Gibbs on December 13, 2007, 10:02 amI used Process Explorer from www.sysinternals.com.

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Magic Quadrant for Application Delivery Controllers

Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise

This paper examines and quantifies the costs and benefits of backup with deduplication storage as...

Webcasts

Transforming the Enterprise WAN Edge: Video from Cisco

Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.