>> The only (known) BLODA I have from that list is the McAfee >> A/V-firewall, which I can't remove, but I believe was completely >> disabled by the above described method. > > Unfortunately, McAfee is one of the worst offenders in my experience [1]. I > seriously doubt you can disable it completely from user space, given its > habits of interposing on device drivers and burrowing into other kernel bits > [2]. > > [1] IMO it's a cure that's worse than the disease, but that's a rant for a > different thread. > > [2] McAfee actually sued MS for "anticompetitive" behavior a while back, > after the latter closed a bunch of security loopholes in the kernel that > virus-writers love but McAfee also depended on (including the interrupt > dispatch table IIRC). > ... So fixing security failures is 'anticompetitive' in McAfee's book?? Wow... That is the kind of business that if i had the funds I would buy just to dismantle... I knew they were bad but didn't know they were *that* bad. >>> there (or install a fresh VM image somewhere without those) and try >>> again. If it's still a problem, somebody more familiar with X than me >>> will have to take over... >>> >> If I can get the authorization for a VM test without A/V, I will and >> the results will be posted here either way. Thank you for your time >> in looking at this. > > Good luck! > > > Ryan > Installed a fresh VM with a Windows XP 64 bit ISO, sp2 already applied. VM has 512 MB ram, and the only package I installed after the OS was cygwin. Issue presents in this environment as soon as Firefox connects/starts. Page Faults Delta over 5,000 minimum anytime I'm doing anything in Firefox, including typing this message, usually over 10,000. Then I went to the services applet and started disabling anything not needed to run the X server and get the connection to/from the remote host. Once nearly everything was disabled, i rebooted the VM. Currently there are only four Windows services running. They are: "CYGWIN sshd," "DHCP Client," "Plug and Play," and "Remote Procedure Call (RPC)." Issue still presents. I've attached the XWin log and the cygcheck output from the VM. --- Erik