Monitor who/what initiates automatic dialup??

[Guest]

Have ICS configured and all works across home network w/ XP Home box
supplying the internet connection through a dialup connection w/ ICS.

Problem is there is one (or more) applications which are auto-dialing that I
do not know who they are--I've disabled XP automatic updates and AVG
automatic updates as well so they are required manual. I still have
something I can't determine who 'tis dialing the modem that I'd like to find
out who/what it is...any tools to do that?

 

[Richard Urban]

Any of your installed programs are likely to do automatic updates. You have
to open each program and go to preferences/options to find out where to turn
this function off.

If you have disabled everything, you may have a rogue dialer on your
computer. Check your phone bill closely for astronomical charges, which are
a result of this.

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[3c273]

You might use a pcket sniffer like Ethereal from www.ethereal.com (free)
and look for DNS packets. This will tell you which machine is doing the
calling, and if you let it dial out, the response will probably give you a
clue as to what program is doing the calling. (If the machine is trying to
reach www.symantec.com, then it is probably Norton Antivirus, etc)
Louis

 

[Guest]

That's the problem--I've done this for everything I can find but it there is
at least one program that either I haven't found/can't the options for or
that doesn't make it visible...

As for the rogue dialer, that pretty well describes at least the symptom,
but not much about how to find/solve it.

 

[Guest]

Good idea...I'll try it. I was hoping perhaps there was a higher level tool
that could intercept the access to the DUN connection and determine which PID
was responsible from which one could find the app....

I'm not all that happy about the proliferation of these automagic updates
that--I'd _much_ prefer to have a 'puter that only does what _I_ ask it to...

 

[Rock]

Have ICS configured and all works across home network w/ XP Home box
supplying the internet connection through a dialup connection w/ ICS.

Problem is there is one (or more) applications which are auto-dialing that I
do not know who they are--I've disabled XP automatic updates and AVG
automatic updates as well so they are required manual. I still have
something I can't determine who 'tis dialing the modem that I'd like to find
out who/what it is...any tools to do that?

Have you done a thorough scan for malware in safe mode using a
combination of programs?

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper’s Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm

 

[Richard Urban]

Well, if you were using one of the advanced versions of ZoneAlarm (ZoneAlarm
Pro or ZoneAlarm Internet Security Suite) you would be notified as to what
program is trying to dial out. You could then disallow it and follow up on
the problem, with the information that ZA provides you with.

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

 

[Guest]

OK, I'll look into it...

It appears I did find the culprit however---Macromedia Flash. It had
signalled once some time back and I had told it to go away while I was in the
throes of setting up the new box and had forgotten about it. Last night it
popped up a nag window that identified itself--unfortunately, there was no
option to tell it to not auto-check, only one that allowed you to put it off
for a short time. I uninstalled it and the symptoms have gone away.

Thanks for the ZA heads up, though...this is the first experience w/ a
recent MS OS on a internet connection where all this security stuff is such
an issue--w/ old or uncommon OS'es, there isn't the stuff out there that one
has to be concerned with so I haven't paid much attention before...

I'd go back to the old box as the interface except it seems that MS broke
something in a recent Server edition on CHAP so that box ceased passing
logon authorization about a month ago. So far, the ISP has been unable to
suggest a workaround and I've not had time to pursue it in depth...