Unwanted Internet Connection

[Guest]

A PC running XP SP2 on a business network is creating an unwanted
Internet/LAN connection. The connection runs at 10Mbps and appears in the
tray in addition to the normal LAN connection which runs at 100Mbps. The
unwanted connection is always labeled "fgfgndC". Its properties are that of
an Internet Shared Connection to another PC. We do not use this feature on
our network.

If we disable the connection it re-enables after a few seconds. When
running, both connections appear to be sending/receiving data continuously.

This all occurs even if nothing else is connected to the network except the
router and cable modem.

We have run MRT, AdAware, and Norton IS but nothing unusual (such as a virus
or hijack) was found.

Thanks.

 

[Malke]

A PC running XP SP2 on a business network is creating an unwanted
Internet/LAN connection. The connection runs at 10Mbps and appears in the
tray in addition to the normal LAN connection which runs at 100Mbps. The
unwanted connection is always labeled "fgfgndC". Its properties are that of
an Internet Shared Connection to another PC. We do not use this feature on
our network.

If we disable the connection it re-enables after a few seconds. When
running, both connections appear to be sending/receiving data continuously.

This all occurs even if nothing else is connected to the network except the
router and cable modem.

We have run MRT, AdAware, and Norton IS but nothing unusual (such as a virus
or hijack) was found.

Thanks.

Since a search for "fgfgndC" brings nothing from Google, please go
through these malware scanning steps systematically. The MS Malware
Removal Tool is a very limited tool and not useful for troubleshooting
malware and you need to be more thorough in your scans. Follow the
instructions at the link and be sure to disconnect the computer from the
network and do all work in Safe Mode.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with either Sysclean or Multi_AV, plus AVG Anti-Spyware
(formerly Ewido - http://www.ewido.net/en/) and follow instructions to
do all scans in Safe Mode.

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the link above (not here, please).

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigStoreUSA). Please be aware that not all local shops are skilled at
removing malware and even if they are, your computer may be so infested
that Windows will need to be clean-installed. Have all your data backed
up before you take the machine into a shop.


Malke

 

[Steve Winograd [MVP]]

A PC running XP SP2 on a business network is creating an unwanted
Internet/LAN connection. The connection runs at 10Mbps and appears in the
tray in addition to the normal LAN connection which runs at 100Mbps. The
unwanted connection is always labeled "fgfgndC". Its properties are that of
an Internet Shared Connection to another PC. We do not use this feature on
our network.

If we disable the connection it re-enables after a few seconds. When
running, both connections appear to be sending/receiving data continuously.

This all occurs even if nothing else is connected to the network except the
router and cable modem.

We have run MRT, AdAware, and Norton IS but nothing unusual (such as a virus
or hijack) was found.

Thanks.

The shared Internet connection could be your router. If so, it's
nothing to worry about.

Unplug the router from your computer and see if the connection goes
away. Plug the router back in and see if the connection comes back.

If it's your router, you can remove the connection by disabling the
UPnP (Universal Plug and Play) capability in your router's web-based
configuration program.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Guest]

I have a similar problem with IE7 - see 'Internet Explorer 7 - unwanted VPN
connection'. I have VPN connections defined for Remote Desktop Sharing to 3
remote sites. After I access one of them my system starts the last one usen
when I start IE7, and also when I request a new web page. My connection to
the internet id configured as a LAN. Can you offer me any suggestions?

 

[Guest]

Thank you for the responses.

Steve Winograd was correct; the router's UPnP was the problem.
Unplugging/re-plugging the CAT5 cable acted as a switch for the connection.

Prior to this, I also assumed a virus/dialer had been downloaded and
undertook the detailed diagnosis as recommended by Malke. For those
interested, here's the run time for each scan (1.3GHz Dell PC, 14Gb of files):

Sophos 2h:51m:41s
Trend 0h:16m:51s
McAffee 0h:26m:15s
Kaspersky 5h:56m:22s

All of the scans, plus my on-board Norton IS 2007, found no problems.

Thanks again.

 

[Steve Winograd [MVP]]

Thank you for the responses.

Steve Winograd was correct; the router's UPnP was the problem.
Unplugging/re-plugging the CAT5 cable acted as a switch for the connection.

Prior to this, I also assumed a virus/dialer had been downloaded and
undertook the detailed diagnosis as recommended by Malke. For those
interested, here's the run time for each scan (1.3GHz Dell PC, 14Gb of files):

Sophos 2h:51m:41s
Trend 0h:16m:51s
McAffee 0h:26m:15s
Kaspersky 5h:56m:22s

All of the scans, plus my on-board Norton IS 2007, found no problems.

Thanks again.

You're welcome. I'm glad to help.
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Guest]

Sorry for this personal question but I could not resist: are you related to
Terry Winograd? I took a couple of courses by him at MIT's AI Lab in the
late '70s.

 

[Steve Winograd [MVP]]

Sorry for this personal question but I could not resist: are you related to
Terry Winograd? I took a couple of courses by him at MIT's AI Lab in the
late '70s.

Yes, he's my brother. Did you see his SHRDLU program and the blocks
world in those days? I had fun playing with them.

Terry now teaches Computer Science at Stanford University:

http://hci.stanford.edu/winograd/
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[Guest]

Steve,

Gotta stop talking like this ... not the intent, I think, of the MS
Communities.

Terry gave me a B+ in the Introduction to AI course. I was then in the
Architecture Machine Group ... now, the Media Lab ... and Nicholas Negroponte
considered this grade a "fail"! Still, I aced everything else. Not bad for
a Brit!

The SHRDLU does not ring any bells. In "those days" LISP was the holy grail
and I bet it was written in that language. But I did enjoy everything in the
AI Lab concerning robotics and diagnosis systems. If only "House" could be
told that systems dating from the '70s can do his job soooo much better!

Another colleague from those days is Paul Pangaro who left Sun and is now at
Stanford, I think. Do you know him? An expert in cybernetics and knowledge
systems.

GC/inetix

 

[Joan Archer]

There's no mistaking he's your brother Steve <g>
Joan

 

[Guest]

Here's an solution update 5 days later ...

I was able to leave the UPnP box checked in the router's network
configuration by making the following change to XP components:

1. Open "Add or Remove Programs" in Control Panel
2. Select the "Add/Remove Windows Components" icon in the left pane
3. Scroll to and select "Networking Services" and click "Details..."
4. Check the "UPnP User Interface" box

OK out, allow the services to install, and restart if necessary.

The unwanted connection does not reappear plus you get a "UPnP Broadband
Router" icon in "My Network Places".