Find Out Which Program Is Using Internet Connection

[Jay Chan]

I find that something is accessing the dialup internet connection in
my PC when the connection is supposed to be idle. Does any one know
how to tell which program is accessing the connection?

I have tried closing all the applications to see if this helps. But
something is still accessing the internet connection. I could have
closing some background processes to see if this helps. But I don't
want to randomly closing background "processes" without knowing what I
am closing.

This happens every minute or less. But this is kind of random.

I want the dialup connection to auto-disconnect after 5 minutes in
idle. But this "thing" keeps the dialup connection active, and
prevents the dialup connection to be auto-disconnected.

Please tell me how to identify the program that is accessing the
internet connection. Thanks in advance for any info.

Jay Chan

 

[Gerry]

You could have downloaded some spyware that is trying to
call "mothership". Go to google.com and do a search
for "Spybot". Download and install spybot and allow it to
scan and delete any adware or spyware it finds. I can't
guarantee this will cure the problem, but it will
certainly help you system. Good luck.

 

[Andre Cruz]

The best way you can check is using a Firewall...

 

[Guest]

SysInternals is a site that has a series of small
applications to get in depth information on your system.
If you get 'Handle' and 'ProcessExplorer', you'll
probably find out what the guy who wrote the malicious
code had for lunch.
http://www.sysinternals.com/ntw2k/utilities.shtml
Check it out.

 

[Frank Muscato]

Download Zonealarm Free Version from zonelabs.com
It will pop up when trying to connect and tell you what prog

 

[Jay Chan]

Thanks everyone from responding to my post.

I found that the problem went away as soon as I disable Windows-XP
auto-update feature. Now, I will have to run Windows-Update every
week; at least I don't have those abnormal internet access.

I will keep the info on detecting spyware just in case I need it.

Jay Chan

 

[Delwin Lee [MSFT]]

Another low tech way you can use to see what program is connecting is to
open a Command Prompt window and using the command "netstat"

 

[Jay Chan]

Another low tech way you can use to see what program is connecting is to

open a Command Prompt window and using the command "netstat"

Thanks for the suggestion of using "netstat". But I don't quite
understand the info that "netstat" presented. Would you please help me
with understanding the info from "netstat".

"netstat" shows this message when I have established an internet
connection:

Active Connections

Proto Local Address Foreign Address State
TCP Dell4300:3020 unknown.Level3.net:http ESTABLISHED
TCP Dell4300:3021 unknown.Level3.net:http ESTABLISHED
TCP Dell4300:3022
a209-247-153-134.deploy.akamaitechnologies.com:http ESTABLISHED
TCP Dell4300:3008 localhost:8128 ESTABLISHED
TCP Dell4300:3009 localhost:8139 ESTABLISHED
TCP Dell4300:3017 localhost:3018 ESTABLISHED
TCP Dell4300:3018 localhost:3017 ESTABLISHED
TCP Dell4300:8128 localhost:3008 ESTABLISHED
TCP Dell4300:8139 localhost:3009 ESTABLISHED

"netstat" shows this message when I have disconnected the internet
connection:

Active Connections

Proto Local Address Foreign Address State
TCP Dell4300:3073 206.204.52.6:http TIME_WAIT
TCP Dell4300:3075 206.204.52.6:http TIME_WAIT
TCP Dell4300:3008 localhost:8128 ESTABLISHED
TCP Dell4300:3009 localhost:8139 ESTABLISHED
TCP Dell4300:8128 localhost:3008 ESTABLISHED
TCP Dell4300:8139 localhost:3009 ESTABLISHED

I guess the "localhost" is OK. But what's about those foreign
addresses?

Thanks.

Jay Chan

 

[Jay Chan]

I ran SpyBot to clean out 70 spywares from my PC.

Now, when I run netstat command when the dial-up connection is
supposed to be in idle, I don't see any foreigh addresses any more.

Thanks.

Jay Chan