# RubyGems or any HTTP on XP NOT working

**URL:** <https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155>\
**Category:** ruby-talk\
**Created:** [14 August 2005 23:11 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155 "2005-08-14T23:11:13Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mycallidus](https://avatars.discourse-cdn.com/v4/letter/m/90db22/32.png) [@Mycallidus](https://rubytalk.org/u/Mycallidus)\
**Post date:** [14 August 2005 23:11 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/1 "2005-08-14T23:11:13Z")

</div>

I tried to start learning Ruby by installing Ruby & Rails on XP, and it  
has been very frustrating so far. Any remote gem installs failed at  
the following step,

Updating Gem source index for: [http://gems.rubyforge.org](http://gems.rubyforge.org)

It seems to me a very common problem on XP since the same problem  
occurs on 3 different XP machines, XP Home SP1, XP Pro SP1, and XP Pro  
SP2. However, I couldn't find any answers to this problem after  
googling many hours on the net. Someone mentioned that it is related  
to ZoneAlarm, but I do not have that on any of the XP machines. Two XP  
boxes use my home network, and the other one is my office machine.  
None of them uses a proxy for Internet access. The following simple  
test program also hangs on these machines,

require 'net/http'  
puts 'connecting...'  
Net::HTTP.start('[www.google.com](http://www.google.com)') do |http|  
&nbsp;&nbsp;&nbsp;response = http.get('/index.html')  
&nbsp;&nbsp;&nbsp;puts response.code  
end

The internal HTTP server comes with Rails also hangs and does not  
respond to any browser requests. I could not Ctrl-C to kill the  
process either. The problem was finally resolved by using my old NT  
machine on the same home network which the other two XP share. "gem  
update --system" and "gem install rails" all worked smoothly w/o any  
problems. The test program also ran and displayed the response code  
right away. Rails HTTP server works perfectly as well. I don't use  
my NT machine nowadays, so it would be very cumbersome to try out rails  
on that machine every time. It will be really appreciated if someone  
can help me out here.

Thanks,  
Barry

---

<div class="post-metadata">

**Author:** ![Christopher\_Aldridge](https://avatars.discourse-cdn.com/v4/letter/c/34f0e0/32.png) [@Christopher\_Aldridge](https://rubytalk.org/u/Christopher_Aldridge)\
**Post date:** [14 August 2005 23:42 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/2 "2005-08-14T23:42:31Z")

</div>

Use Ctrl + Break instead of Ctrl + C

I'll let someone else respond regarding the other stuff as I'm not 100% sure.

> **···**
>
> On 8/14/05, mycallidus@yahoo.com \<mycallidus@yahoo.com\> wrote:
> 
> > I tried to start learning Ruby by installing Ruby & Rails on XP, and it  
> > has been very frustrating so far. Any remote gem installs failed at  
> > the following step,
> > 
> > Updating Gem source index for: [http://gems.rubyforge.org](http://gems.rubyforge.org)
> > 
> > It seems to me a very common problem on XP since the same problem  
> > occurs on 3 different XP machines, XP Home SP1, XP Pro SP1, and XP Pro  
> > SP2. However, I couldn't find any answers to this problem after  
> > googling many hours on the net. Someone mentioned that it is related  
> > to ZoneAlarm, but I do not have that on any of the XP machines. Two XP  
> > boxes use my home network, and the other one is my office machine.  
> > None of them uses a proxy for Internet access. The following simple  
> > test program also hangs on these machines,
> > 
> > require 'net/http'  
> > puts 'connecting...'  
> > Net::HTTP.start('www.google.com') do |http|  
> > &nbsp;&nbsp;&nbsp;response = http.get('/index.html')  
> > &nbsp;&nbsp;&nbsp;puts response.code  
> > end
> > 
> > The internal HTTP server comes with Rails also hangs and does not  
> > respond to any browser requests. I could not Ctrl-C to kill the  
> > process either. The problem was finally resolved by using my old NT  
> > machine on the same home network which the other two XP share. "gem  
> > update --system" and "gem install rails" all worked smoothly w/o any  
> > problems. The test program also ran and displayed the response code  
> > right away. Rails HTTP server works perfectly as well. I don't use  
> > my NT machine nowadays, so it would be very cumbersome to try out rails  
> > on that machine every time. It will be really appreciated if someone  
> > can help me out here.
> > 
> > Thanks,  
> > Barry

---

<div class="post-metadata">

**Author:** ![Kevin\_Olbrich](https://avatars.discourse-cdn.com/v4/letter/k/59ef9b/32.png) [@Kevin\_Olbrich](https://rubytalk.org/u/Kevin_Olbrich)\
**Post date:** [14 August 2005 23:43 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/3 "2005-08-14T23:43:08Z")

</div>

I've been working smoothly on an XP machine with none of the problems you  
report.  
XP added an internal firewall sometime back, perhaps it is turned on.

Another possibility is that your home networking router is blocking things.  
Some cable/dsl modems also have built-in firewalls that can sometimes act  
up.

Are there any unusual programs common to all 3 machines?

Can you ping [gems.rubyforge.org](http://gems.rubyforge.org)? If not, try doing a tracert to see where  
it is failing.

\_Kevin

> **···**
>
> -----Original Message-----  
> From: [mycallidus@yahoo.com](mailto:mycallidus@yahoo.com) [[mailto:mycallidus@yahoo.com](mailto:mycallidus@yahoo.com)]  
> Sent: Sunday, August 14, 2005 07:11 PM  
> To: ruby-talk ML  
> Subject: RubyGems or any HTTP on XP NOT working
> 
> I tried to start learning Ruby by installing Ruby & Rails on XP, and it has  
> been very frustrating so far. Any remote gem installs failed at the  
> following step,
> 
> Updating Gem source index for: [http://gems.rubyforge.org](http://gems.rubyforge.org)
> 
> It seems to me a very common problem on XP since the same problem occurs on  
> 3 different XP machines, XP Home SP1, XP Pro SP1, and XP Pro SP2. However,  
> I couldn't find any answers to this problem after googling many hours on the  
> net. Someone mentioned that it is related to ZoneAlarm, but I do not have  
> that on any of the XP machines. Two XP boxes use my home network, and the  
> other one is my office machine. None of them uses a proxy for Internet  
> access. The following simple test program also hangs on these machines,
> 
> require 'net/http'  
> puts 'connecting...'  
> Net::HTTP.start('[www.google.com](http://www.google.com)') do |http|  
> &nbsp;&nbsp;&nbsp;response = http.get('/index.html')  
> &nbsp;&nbsp;&nbsp;puts response.code  
> end
> 
> The internal HTTP server comes with Rails also hangs and does not respond to  
> any browser requests. I could not Ctrl-C to kill the process either. The  
> problem was finally resolved by using my old NT machine on the same home  
> network which the other two XP share. "gem update --system" and "gem  
> install rails" all worked smoothly w/o any problems. The test program also  
> ran and displayed the response code right away. Rails HTTP server works  
> perfectly as well. I don't use my NT machine nowadays, so it would be very  
> cumbersome to try out rails on that machine every time. It will be really  
> appreciated if someone can help me out here.
> 
> Thanks,  
> Barry

---

<div class="post-metadata">

**Author:** ![Glenn\_Lewis](https://avatars.discourse-cdn.com/v4/letter/g/dc4da7/32.png) [@Glenn\_Lewis](https://rubytalk.org/u/Glenn_Lewis)\
**Post date:** [15 August 2005 17:06 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/4 "2005-08-15T17:06:14Z")

</div>

I've recently updated to Windows XP SP2 and I also have ZoneAlarm Suite  
installed on my machine... There was a bunch of SpyWare that ZA went  
ahead and quarantined for me, and suddenly DNS stopped working and my  
Ruby scripts that accessed the web also stopped working!

I spent about 8 hours searching for a solution. Finally, I came across  
a Microsoft article that said to try this:

netsh winsock reset

This apparently completely re-installs the winsock service, as this is  
a major target for spyware, viruses, etc.

Suddenly, everything started working again. Then, the next day, the  
same thing happened, and I needed to reset it \*again\*. Now all my  
Ruby scripts are working again.

Good luck! I hope this saves you time, as I wasted a lot of it trying  
to figure this one out.

-- Glenn

mycallidus@yahoo.com wrote:

> **···**
>
> > I tried to start learning Ruby by installing Ruby & Rails on XP, and it  
> > has been very frustrating so far. Any remote gem installs failed at  
> > the following step,
> > 
> > Updating Gem source index for: [http://gems.rubyforge.org](http://gems.rubyforge.org)
> > 
> > It seems to me a very common problem on XP since the same problem  
> > occurs on 3 different XP machines, XP Home SP1, XP Pro SP1, and XP Pro  
> > SP2. However, I couldn't find any answers to this problem after  
> > googling many hours on the net. Someone mentioned that it is related  
> > to ZoneAlarm, but I do not have that on any of the XP machines. Two XP  
> > boxes use my home network, and the other one is my office machine.  
> > None of them uses a proxy for Internet access. The following simple  
> > test program also hangs on these machines,
> > 
> > require 'net/http'  
> > puts 'connecting...'  
> > Net::HTTP.start('www.google.com') do |http|  
> > &nbsp;&nbsp;&nbsp;response = http.get('/index.html')  
> > &nbsp;&nbsp;&nbsp;puts response.code  
> > end
> > 
> > The internal HTTP server comes with Rails also hangs and does not  
> > respond to any browser requests. I could not Ctrl-C to kill the  
> > process either. The problem was finally resolved by using my old NT  
> > machine on the same home network which the other two XP share. "gem  
> > update --system" and "gem install rails" all worked smoothly w/o any  
> > problems. The test program also ran and displayed the response code  
> > right away. Rails HTTP server works perfectly as well. I don't use  
> > my NT machine nowadays, so it would be very cumbersome to try out rails  
> > on that machine every time. It will be really appreciated if someone  
> > can help me out here.
> > 
> > Thanks,  
> > Barry

---

<div class="post-metadata">

**Author:** ![Mycallidus](https://avatars.discourse-cdn.com/v4/letter/m/90db22/32.png) [@Mycallidus](https://rubytalk.org/u/Mycallidus)\
**Post date:** [15 August 2005 04:01 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/5 "2005-08-15T04:01:12Z")

</div>

Everything works fine on the old NT which is in the same network as the  
other two XP box. I even tried an XP in my office which is in a  
totally different network and got the same result. Same behavior with  
both the latest 1.8.2-15 and 1.8.2-14 Final on all XP boxes after  
several install/uninstalling.

---

<div class="post-metadata">

**Author:** ![Mycallidus](https://avatars.discourse-cdn.com/v4/letter/m/90db22/32.png) [@Mycallidus](https://rubytalk.org/u/Mycallidus)\
**Post date:** [15 August 2005 04:06 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/6 "2005-08-15T04:06:13Z")

</div>

Both Ctrl-C and Ctrl-Break work if no browser requests to the server  
yet. I use the following command to start the Rails HTTP server,

ruby script/server

I can terminate it with either Ctrl-C or Ctrl-Break before using the  
brower to access the server at [http://localhost:3000](http://localhost:3000). Once the request  
is in, the server seems to be hanging and has no response to Ctrl-C nor  
Ctrl-Break. This is the same behavior when RubyGems is trying to  
connect to a remote server. The only way to stop the HTTP server or  
RubyGems is by closing the DOS window.

Barry

---

<div class="post-metadata">

**Author:** ![Barry1](https://avatars.discourse-cdn.com/v4/letter/b/7bcc69/32.png) [@Barry1](https://rubytalk.org/u/Barry1)\
**Post date:** [15 August 2005 20:26 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/7 "2005-08-15T20:26:14Z")

</div>

Hi Glenn,

Thanks for the pointer. I was able to resolve the issue for my office  
machine by removing the 3rd-party winsock component. I will have to  
try the same thing on my home machine tonight and report back the  
results.

It turned out to be a winsock installed by my company's VPN,  
NetScreen/Neoteris, that was causing the problem for Ruby. The  
solution I did was using "install/remove LSP" provided by NetScreen to  
remove it. The NetScrere LSP remove program says you can use it if  
Internet connection is not working, so I assume the VPN will work  
without it. I will have to try it on my XP machine at home, and  
hopefully it will resolve the Ruby issue and my VPN will continue  
working.

There's a MS KB at [http://support.microsoft.com/?kbid=811259](http://support.microsoft.com/?kbid=811259) that shows  
you how to verify your winsock with "msinfo32" if anyone is interested.

Thanks the help from everyone,

Barry

---

<div class="post-metadata">

**Author:** ![Ezra\_Zygmuntowicz3](https://avatars.discourse-cdn.com/v4/letter/e/c57346/32.png) [@Ezra\_Zygmuntowicz3](https://rubytalk.org/u/Ezra_Zygmuntowicz3)\
**Post date:** [15 August 2005 05:23 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/8 "2005-08-15T05:23:55Z")

</div>

I think you have run into the XP firewall problem. The same thing has happened to a few people before and it has usually been a Zone Alarm compatability issue. You need to uninstall Zone Alarm or any other software firewall you have installed. Turning it off will not be enough you need to completely uninstall it. Zone ALarm and a few other firewalls on XP interfere with ruby's socket access and causes the problem you are seeing. Try to uninstall your firewall and try it again. I know it sucks because xp really needs a firewall but thats the current state of the issue. Search this list and you will find other threads about this same subject. Some of them have suggestions for other firewalls that work with ruby and XP.

HTH-  
-Ezra Zygmuntowicz  
WebMaster  
Yakima Herald-Republic Newspaper  
ezra@yakima-herald.com  
509-577-7732

> **···**
>
> On Aug 14, 2005, at 9:06 PM, mycallidus@yahoo.com wrote:
> 
> > Both Ctrl-C and Ctrl-Break work if no browser requests to the server  
> > yet. I use the following command to start the Rails HTTP server,
> > 
> > ruby script/server
> > 
> > I can terminate it with either Ctrl-C or Ctrl-Break before using the  
> > brower to access the server at [http://localhost:3000](http://localhost:3000). Once the request  
> > is in, the server seems to be hanging and has no response to Ctrl-C nor  
> > Ctrl-Break. This is the same behavior when RubyGems is trying to  
> > connect to a remote server. The only way to stop the HTTP server or  
> > RubyGems is by closing the DOS window.
> > 
> > Barry

---

<div class="post-metadata">

**Author:** ![dolom](https://avatars.discourse-cdn.com/v4/letter/d/c89c15/32.png) [@dolom](https://rubytalk.org/u/dolom)\
**Post date:** [19 August 2005 09:06 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/9 "2005-08-19T09:06:17Z")

</div>

Hi everybody,

just to add that I had the same problem on my XP machine: following  
your suggestions I noticed that further to the default ones my  
protocols listed Google Desktop and PGP so I got rid of the latter and  
my ruby sockets started working perfectly.

Thank you everybody for your helpful postings!

-- Marco --

Barry wrote:

> **···**
>
> > Hi Glenn,
> > 
> > Thanks for the pointer. I was able to resolve the issue for my office  
> > machine by removing the 3rd-party winsock component. I will have to  
> > try the same thing on my home machine tonight and report back the  
> > results.
> > 
> > It turned out to be a winsock installed by my company's VPN,  
> > NetScreen/Neoteris, that was causing the problem for Ruby. The  
> > solution I did was using "install/remove LSP" provided by NetScreen to  
> > remove it. The NetScrere LSP remove program says you can use it if  
> > Internet connection is not working, so I assume the VPN will work  
> > without it. I will have to try it on my XP machine at home, and  
> > hopefully it will resolve the Ruby issue and my VPN will continue  
> > working.
> > 
> > There's a MS KB at [Microsoft Support](http://support.microsoft.com/?kbid=811259) that shows  
> > you how to verify your winsock with "msinfo32" if anyone is interested.
> > 
> > Thanks the help from everyone,
> > 
> > Barry

---

<div class="post-metadata">

**Author:** ![Barry1](https://avatars.discourse-cdn.com/v4/letter/b/7bcc69/32.png) [@Barry1](https://rubytalk.org/u/Barry1)\
**Post date:** [15 August 2005 06:46 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/10 "2005-08-15T06:46:13Z")

</div>

Ezra, Thanks for you response. That's also the closest answer I could  
find in the first place. However, I don't have Zone Alarm installed on  
any of the XP. The one I use at home primarily is XP Home with SP1,  
and it doesn't have Microsoft's Firewall either. My office machine is  
XP Pro with SP2, and it does have Microsoft's Firewall that probably  
comes with SP2. When I clicked on the "Firewall" icon in control  
panel, XP asked me if I want to enable it. I doubt it's running at  
all.

Anyway, I thought it should be a common problem Windows XP people would  
run into since it occurred on three different XP for me. Someone  
should have already come up with a solution or workaround if it's such  
a common problem for XP. I can try to uninstall any programs that  
could prevent socket from working for Ruby if someone can shed some  
lights on what program it would be.

---

<div class="post-metadata">

**Author:** ![daz](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@daz](https://rubytalk.org/u/daz)\
**Post date:** [15 August 2005 09:01 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/11 "2005-08-15T09:01:15Z")

</div>

Barry wrote:

> I can try to uninstall any programs that could prevent  
> socket from working for Ruby if someone can shed some  
> lights on what program it would be.

Hi Barry,

Any chance you could grab this ?:

[http://www.sysinternals.com/Utilities/ProcessExplorer.html](http://www.sysinternals.com/Utilities/ProcessExplorer.html) ZIP - 554KB

There's no installation to do - just unzip to a new folder.

(It displays running processes and handles in use  
- including sockets, mutexes, etc.)

Close any applications not in use, then:

1) Start procexp.exe [PX below]  
2) Start your simple Ruby test prog and leave it hanging ...  
3) [PX] Click on the Ruby.exe process line in the top pane  
4) [PX] Ctrl + H (View menu -\> Lower Pane View -\> Handles)  
5) [PX] Ctrl + A (File menu -\> Save As ...) pxrb.txt  
&nbsp;&nbsp;&nbsp;- done -

Check pxrb.txt for personal info  
(sometimes appears on title bar of email client)

I was going to suggest you post it here but the output is tabbed.  
If you mail it to me, I can format and upload it somewhere visible  
for folks here. [daz (at) d10.karoo.co.uk]

I don't have XP, so that's probably all I can help with.

daz

---

<div class="post-metadata">

**Author:** ![Brock\_Weaver](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@Brock\_Weaver](https://rubytalk.org/u/Brock_Weaver)\
**Post date:** [15 August 2005 13:47 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/12 "2005-08-15T13:47:41Z")

</div>

Have you tried telnetting into your WEBrick server instead of using the  
browser? Maybe IE isn't performing the request correctly...

telnet  
set localecho  
open 127.0.0.1 \<[http://127.0.0.1](http://127.0.0.1)\> 3000

GET /index.html HTTP/1.1

(note the screen doesn't clear after you do the "open" command, but the  
cursor will move to the top)

Also note you need to hit \<enter\> twice after the GET command (standard http  
rules)

If it works, you should get a mess of HTML on your screen, and your server  
will show something like:

127.0.0.1 \<[http://127.0.0.1](http://127.0.0.1)\> - - [15/Aug/2005:08:43:05 Central Daylight  
Time] "GET /index.html HTTP/1.1" 200 3234  
- -\> /index.html

Also, have you tried hitting other local web servers (like apache or IIS)?  
If those won't work either, it's probably a system problem -- aka bad proxy  
settings, your HOSTS file has a non-127.0.0.1 mapping for localhost, etc.  
Since you said you don't have any firewalls running, that's about all the  
situations I can think of...

> **···**
>
> On 8/15/05, daz \<dooby@d10.karoo.co.uk\> wrote:
> 
> > Barry wrote:
> > 
> > \> I can try to uninstall any programs that could prevent  
> > \> socket from working for Ruby if someone can shed some  
> > \> lights on what program it would be.
> > 
> > Hi Barry,
> > 
> > Any chance you could grab this ?:
> > 
> > [http://www.sysinternals.com/Utilities/ProcessExplorer.html](http://www.sysinternals.com/Utilities/ProcessExplorer.html) ZIP - 554KB
> > 
> > There's no installation to do - just unzip to a new folder.
> > 
> > (It displays running processes and handles in use  
> > - including sockets, mutexes, etc.)
> > 
> > Close any applications not in use, then:
> > 
> > 1) Start procexp.exe [PX below]  
> > 2) Start your simple Ruby test prog and leave it hanging ...  
> > 3) [PX] Click on the Ruby.exe process line in the top pane  
> > 4) [PX] Ctrl + H (View menu -\> Lower Pane View -\> Handles)  
> > 5) [PX] Ctrl + A (File menu -\> Save As ...) pxrb.txt  
> > - done -
> > 
> > Check pxrb.txt for personal info  
> > (sometimes appears on title bar of email client)
> > 
> > I was going to suggest you post it here but the output is tabbed.  
> > If you mail it to me, I can format and upload it somewhere visible  
> > for folks here. [daz (at) d10.karoo.co.uk \<[http://d10.karoo.co.uk](http://d10.karoo.co.uk)\> ]
> > 
> > I don't have XP, so that's probably all I can help with.
> > 
> > daz
> 
> --  
> Brock Weaver  
> [http://www.circaware.com](http://www.circaware.com)

---

<div class="post-metadata">

**Author:** ![Barry1](https://avatars.discourse-cdn.com/v4/letter/b/7bcc69/32.png) [@Barry1](https://rubytalk.org/u/Barry1)\
**Post date:** [15 August 2005 17:51 UTC](https://rubytalk.org/t/rubygems-or-any-http-on-xp-not-working/20155/13 "2005-08-15T17:51:14Z")

</div>

Here's result:

Process PID CPU Description Company Name  
System Idle Process 0 98.48  
explorer.exe 1444 0.76 Windows Explorer Microsoft Corporation  
ccApp.exe 2692 Common Client User Session Symantec Corporation  
ctfmon.exe 2952 CTF Loader Microsoft Corporation  
cmd.exe 5496 Windows Command Processor Microsoft Corporation  
&nbsp;&nbsp;ruby.exe 4480 Ruby interpreter  
procexp.exe 2044 0.76 Sysinternals Process Explorer Sysinternals

Process: ruby.exe Pid: 4480

Type Name  
Desktop \Default  
Directory \BaseNamedObjects  
Directory \Windows  
Directory \KnownDlls  
File \Device\Tcp  
File \Device\Tcp  
File \Device\WS2IFSL\NifsSct  
File \Device\WS2IFSL\NifsPvd  
File \Device\Afd\Endpoint  
File \Device\KsecDD  
File C:\Documents and Settings\bku  
Key HKCU  
Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces  
Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace\_Catalog5  
Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol\_Catalog9  
Key HKLM  
KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent  
Mutant \BaseNamedObjects\Neoteris:AppProxy:Statistics:Mutex  
Section \BaseNamedObjects\Neoteris:AppProxy:Statistics  
Thread ruby.exe(4480): 4056  
Thread ruby.exe(4480): 4056  
Thread ruby.exe(4480): 4420  
Thread ruby.exe(4480): 4000  
Thread ruby.exe(4480): 4896  
Thread ruby.exe(4480): 4896  
Thread ruby.exe(4480): 4896  
WindowStation \Windows\WindowStations\WinSta0  
WindowStation \Windows\WindowStations\WinSta0
