Member Avatar for saliva

whenever logging off or shutting down the computer, i get an "end program - layered hidden window" with an option to either cancel or end immediately. well, it's not the most irritating factor to using the box, but i came upon the real culprit behind it and have no clue what it is (nor did i find anything useful under google, except this on the matters of LSP
) The culprit is "Callisto LSP Client" and i have no clue. Has anyone heard of who da hell Callisto is & what app belongs to them? :evil:

  • 7 Contributors
  • 11 Replies
  • 621 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by mikehueb

Dani AI

Generated

Thread summary and short diagnosis: the “Layered Hidden Window” dialog in this topic is almost always caused by a Winsock Layered Service Provider (LSP) that leaves a hidden window/class active during shutdown. ’s discovery of the Callisto class combined with ’s Spy++ observation (thread name MANTISPM) and / reporting ZoneAlarm/MailFrontier points strongly toward the MailFrontier / mantispm component (bundled with some ZoneAlarm builds) installing an LSP rather than a random malware. LSPs are exactly the kind of component that injects into socket calls for mail/filtering or firewall tasks. (learn.microsoft.com)

Practical diagnostic checklist (non-destructive first steps):

  • Record the Winsock catalog to a file and inspect it:
    netsh winsock show catalog > c:\winsock-catalog.txt
netsh winsock dump > c:\winsock-backup.txt
  • Use Autoruns (Sysinternals) and check the Winsock/Network providers view to see the provider name and file path for any entry that looks like “Callisto” or points into a MailFrontier/ZoneAlarm folder.
  • Use Process Explorer (Sysinternals) to scan loaded DLLs in processes or search for the LSP DLL name found by Autoruns; that will show which running process owns the module. These steps identify the owner without removing anything. (learn.microsoft.com)

If the LSP belongs to MailFrontier / mantispm:

  • Prefer disabling the MailFrontier/junk‑mail component inside ZoneAlarm or uninstalling the MailFrontier component via Add/Remove Programs rather than manual registry edits.
  • After uninstall (or if an LSP is corrupted), restore or repair Winsock. Back up first (see netsh dump above), then reset if needed:
    netsh winsock reset

    Reboot after resetting. Warning: resetting removes custom LSPs (firewall/antispam drivers may need reinstall), so have installation media or installers ready. (learn.microsoft.com)

Notes and cautions: killing random processes or deleting DLLs can break networking. Prefer identification → controlled disable/uninstall → winsock backup/reset. If the Callisto class appears after a clean OS install (as reported by ), check for OEM or bundled security components (preinstalled mail/filter agents). The authoritative tools for this workflow are Autoruns and Process Explorer; capture the winsock dump and an Autoruns Winsock screenshot before making changes. (learn.microsoft.com)

Recommended Answers

All 11 Replies

Member Avatar for DuncanIdaho

Do you have software called Callisto Newsreader/Bulletin Board Browser installed? That's the only program I can find with the name Callisto. Lots of LSP's are spyware/adware etcetera, but this may not be the case for you.

If you haven't taken any steps to prevent spyware/adware/malware and worm/virii infections in your machine, you may want to read up in here:

http://www.daniweb.com/techtalkforums/thread5690.html

It is possible you've been infected, since many infections occur with no intervention on your part. You hit a web page, bang, infected. You connect to the internet at all, and you can be infected by worms, and virii. So again, if you haven't been proactive in preventing infections, read the above carefully.

If you are already PC Security conscious, forgive the above, I'm just being thorough, as your problem sounds kinda 'malware-like' to me. :)

Member Avatar for saliva

Thx for the reply. Might I add that I'm not so much concerned about "what" it is but rather "where" it is. As long as I know where it resides, I would know how to deal with it. It so happens that, upon closer scrutiny, "Callisto" is a class name of the LSP handle. :o

Member Avatar for DuncanIdaho

Heheh, so you're all set now?

Member Avatar for mandigo

I just installed a brandnew clean version of windows on a clean formatted hd and I had a job rundll32.exe quoting window special text "Callisto LSP client" with non English sense like hint "Assistant for search for new hardware. This somehow convinced me that it belongs to some hardware installation. If you, however have this window when shutting down, it might be that your hardware has a little installation problem. Check out your hardware manager if there are any yellow question marks or red excl. m. Greets mandigo

Member Avatar for mikehueb

I installed Buyertools Reminder, an eBay sniping program, a few days ago. Noticed a lot of disk activity and taskman said reminder.exe was doing a lot of disk writes. Shut it down, started Spy++ and when I restarted Buyertools, it looks like it launched several instances of Callisto LSP client, and one manager. Doesn't APPEAR to be doing anything nefarious, but I still don't know what Callisto is or does.

If anybody knows, I'm curious.

Member Avatar for gemini4

A friend of mine had the exact same error due to Zone Labs Internet Security. DO you have that application installed. If not what security applications do you have installed?


Go in safe mode and perform a clean boot:

Member Avatar for mikehueb

Yep - I run ZA Internet Security Suite. Hmmm.

Member Avatar for gemini4

Then the Callisto LSP is from them. However I'm interested if Saliva runs ZA Security as well

Member Avatar for Member #61290

I have the same problem at shut down "end program - layered hidden window" and yes I run ZA Security Suite. Any suggestions

Member Avatar for anglico

I used Spy++ and when I clicked on the Callisto process properties and then clicked process, and then clicked on thread ID, it said MANTISPM, so Im figuring its the microsoft anti spam program. I dont know if this is for every instance of the callisto thread, but if you follow the above instructions for each one, you may find out what each one means. I hope this helps.
PS: Some of the others I get are PGPTray, VSMON, and Zonelabs.

Member Avatar for mikehueb

Yeah, I've got ZA Internet Security Suite, including Mail Frontier anti-spam, which is the Mantispam process.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.