tracking which program is dialing the Internet

[Terry Liittschwager]

Some weeks back I let Windows Update put SP2 on my wife's machine.

Since that time, her machine randomly connects to the Internet when
unattended. She has an external modem, and it's obvious from the
modem indicator lights when it's connected. Each time I've caught it
in this condition, nothing was being transmitted/received. Of course,
who knows what happened before I noticed it, and who knows how many
times it has connected but then the connection has been closed by our
ISP for inactivity.

I have turned off every automatic update or connection option I can
find, and I have turned off Windows Auto Update.

Programs > Control Panel > Scheduled task shows nothing scheduled.

The connection is firewalled and always has been. My anti-virus is up
todate, and multiple full system scans over the past few weeks have
turned up nothing.

So, my question is, how can I get a log of every Internet connection
established and the name of the program that did it. If this isn't
available in WinXP, does anyone know of a software package that would
provide this service?

Any information or thoughts anyone can provide will be much
appreciated.

Terry Liittschwager

 

[Courtney]

Some weeks back I let Windows Update put SP2 on my wife's machine.

Since that time, her machine randomly connects to the Internet when
unattended. She has an external modem, and it's obvious from the
modem indicator lights when it's connected. Each time I've caught it
in this condition, nothing was being transmitted/received. Of course,
who knows what happened before I noticed it, and who knows how many
times it has connected but then the connection has been closed by our
ISP for inactivity.

I have turned off every automatic update or connection option I can
find, and I have turned off Windows Auto Update.

Programs > Control Panel > Scheduled task shows nothing scheduled.

The connection is firewalled and always has been. My anti-virus is up
todate, and multiple full system scans over the past few weeks have
turned up nothing.

So, my question is, how can I get a log of every Internet connection
established and the name of the program that did it. If this isn't
available in WinXP, does anyone know of a software package that would
provide this service?

Any information or thoughts anyone can provide will be much
appreciated.

Terry Liittschwager

Control Panel/Internet Options/Connections. Select "Never Dial a
Connection."

Be aware that, if you start up a program like IE or Outlook, it will not
automatically dial. You will have to do that manually from Network
Connections (you can make a shortcut).

courtney sends....


x-- 100 Proof News - http://www.100ProofNews.com
x-- 3,500+ Binary NewsGroups, and over 90,000 other groups
x-- Access to over 1 Terabyte per Day - $8.95/Month
x-- UNLIMITED DOWNLOAD

 

[Ramesh [MVP]]

Dial-up window pop-ups automatically while working:
http://windowsxp.mvps.org/Autodial.htm

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org


Some weeks back I let Windows Update put SP2 on my wife's machine.

Since that time, her machine randomly connects to the Internet when
unattended. She has an external modem, and it's obvious from the
modem indicator lights when it's connected. Each time I've caught it
in this condition, nothing was being transmitted/received. Of course,
who knows what happened before I noticed it, and who knows how many
times it has connected but then the connection has been closed by our
ISP for inactivity.

I have turned off every automatic update or connection option I can
find, and I have turned off Windows Auto Update.

Programs > Control Panel > Scheduled task shows nothing scheduled.

The connection is firewalled and always has been. My anti-virus is up
todate, and multiple full system scans over the past few weeks have
turned up nothing.

So, my question is, how can I get a log of every Internet connection
established and the name of the program that did it. If this isn't
available in WinXP, does anyone know of a software package that would
provide this service?

Any information or thoughts anyone can provide will be much
appreciated.

Terry Liittschwager

 

[Terry Liittschwager]

Control Panel/Internet Options/Connections. Select "Never Dial a
Connection."

Be aware that, if you start up a program like IE or Outlook, it will not
automatically dial. You will have to do that manually from Network
Connections (you can make a shortcut).

courtney sends....

Thanks for the thought, but that's not the problem. As stated, I have
turned off every automatic update and dial-up connection option I
could find, including that one. Actually, I never had that on even
before this as I have never liked the idea of any kind of automatic
dialing, and, in fact, that was the first thing I checked to see if it
had somehow gotten switched on. Also, as a matter of course, I never
let IE or my mail client trigger a connect. I normally connect
through an icon on the quick launch bar.

While trying to troubleshoot this thing, I even had IE try to get to a
webpage and my e-mail client try to pick up and to send mail while not
logged on to see if somehow they could get by the Never Dial a
Connection setting. They performed as expected, failing in all cases.

Terry

 

[Terry Liittschwager]

Dial-up window pop-ups automatically while working:
http://windowsxp.mvps.org/Autodial.htm

Thanks for the link.

The one thing there which may be of use is the info concerning the
Remote Access Auto Connection Manager. I checked it and found it was
set to Manual. Per the recommendation, I have now set it to Disabled,
and we shall see what happens.

I have Lavasoft's Ad-aware, recommended at the link, and it reveals
nothing (I run it regularly).

The two MS knowledgebase articles appear to apply to a connect window
coming up on startup or when launching a program.

Again, thanks for the link. That domain appears to have a wealth of
information which I am sure I can use in the future.

I have neglected my wife's machine. It has a number of small
problems, the unwanted Internet connection being first on the list. I
intend to work them one by one until I get it cleaned up, so all
pointers to help are greatly appreciated.

Terry Liittschwager

 

[Ramesh [MVP]]

Terry,

Disabling the "Remote Access Auto Connection manager" service should help. Good Luck and keep us posted.

Remote Access Auto Connection manager - Description:

"Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address."

To identify the process name (may be a difficult task), you may use a process monitoring tool like Process Explorer from www.sysinternals.com.

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://windowsxp.mvps.org

Dial-up window pop-ups automatically while working:
http://windowsxp.mvps.org/Autodial.htm

Thanks for the link.

The one thing there which may be of use is the info concerning the
Remote Access Auto Connection Manager. I checked it and found it was
set to Manual. Per the recommendation, I have now set it to Disabled,
and we shall see what happens.

I have Lavasoft's Ad-aware, recommended at the link, and it reveals
nothing (I run it regularly).

The two MS knowledgebase articles appear to apply to a connect window
coming up on startup or when launching a program.

Again, thanks for the link. That domain appears to have a wealth of
information which I am sure I can use in the future.

I have neglected my wife's machine. It has a number of small
problems, the unwanted Internet connection being first on the list. I
intend to work them one by one until I get it cleaned up, so all
pointers to help are greatly appreciated.

Terry Liittschwager

 

[Terry Liittschwager]

Terry,

Disabling the "Remote Access Auto Connection manager" service should help. Good Luck and keep us posted.

Remote Access Auto Connection manager - Description:

"Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address."

To identify the process name (may be a difficult task), you may use a process monitoring tool like Process Explorer from www.sysinternals.com.

Unfortunately, disabling the Remote Access Auto Connection manager
didn't do the trick. I thought it had because a whole day went by
without it doing it. Yesterday, however, it did it twice.

I downloaded Process Explorer and also the Microsoft Windows
debugging tool. I'm going to have a try at the problem with them.

Many thanks for pointing me to www.sysinternals.com. There's a lot of
good info there.

Terry

 

[bunny]

Have you also installed the new beta version of Microsoft Spyware? It
seems to be the program dialing for it's updates and it will run
forever until it gets them.