Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion GroupsWindows VistaWindows XPWindows MeWindows 98Windows 95Virtual PCInternet ExplorerOutlook ExpressWindows MediaSecurity
Related Topics
MS Server ProductsMS OfficePC HardwareMore Topics ...

Windows Forum / Windows Me / Internet / March 2005

Tip: Looking for answers? Try searching our database.

Extraneous Dial-Up Connection Attempts

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
randau - 04 Mar 2005 01:52 GMT
Extraneous Dial-Up Connection Attempts

I've been experiencing extraneous dial-up connection
attempts occurring during start up, shut down, and invoking
various applications that don't even require dial-ups.

It's particularly evident when using Windows Explorer to
open or view Properties of Text files by left or right
clicking on them.  It brings up the "Connect To" dialog box
and commenced dialing up my ISP before I had unchecked its
"Connect automatically" box.  Now the dialog box just sits
there waiting for me to click something on it.  Nothing
happens with Windows Explorer until the "Connect To" dialog
box is dealt with which takes two Cancels before it stops
reappearing.  Then the prior clicked function in Windows
Explorer finally manifests itself (very annoying).

Isn't there someplace where you can select NOT to have
"Auto-Dial-Up on Demand" when you invoke an application that
does require an Internet connection?

--
randau
Oregon, USA

I read and post from the Google Groups web site using a Spam
collecting email address that I don't use for anything else.
So if someone wants to contact me, please cleanup and use
the Spam resistant Email address below.

            randau2...(at)...proaxis.com
Galen - 04 Mar 2005 03:31 GMT
> Isn't there someplace where you can select NOT to have
> "Auto-Dial-Up on Demand" when you invoke an application that
> does require an Internet connection?

Well, you could set the computer to not dial at all but that defeats the
purpose and doesn't clean up what I suspect is the underlying problem here.
I suspect malware of some type given the description that you've given us.
Maybe a trojan? Maybe spyware?

Download, update, and scan with an anti-virus application. Both AVG and
AntiVir are free for personal use if I recall. I don't know of a specific
anti-trojan scanner that's free.

Download, update, and scan with AdAware and Spybot Search and Destroy. Those
are the two best free ones out there as Microsoft's Anti-Spyware beta
doesn't work on 9x or ME I don't believe.

In both the above cases try your scan in safe mode without networking and
make sure that System Restore has been disabled. After the scan is complete
reboot to regular mode and scan again. If the system comes up clean on the
second scan turn system restore back on and make a new restore point.

With what you've said I'm inclined to make my first guess for the behavior
as it being some sort of malware and that's where I'd begin. And while you
could probably stop the dialing that wouldn't do anything about keeping your
system clean, secure, and stable.

Galen
Signature


"My mind rebels at stagnation. Give me problems, give me work, give me
the most abstruse cryptogram or the most intricate analysis, and I am
in my own proper atmosphere. I can dispense then with artificial
stimulants. But I abhor the dull routine of existence. I crave for
mental exaltation." -- Sherlock Holmes

randau - 05 Mar 2005 19:31 GMT
Galen,

I run both Norton AntiVirus and AdAware spyware scans on a
regular basis.  But, thanks for your reply anyway.

(see my reply to Rick)
--
randau
cquirke (MVP Windows shell/user) - 06 Mar 2005 10:07 GMT
On 5 Mar 2005 11:31:37 -0800, "randau" <spamjunkmail2002@yahoo.com>

>I run both Norton AntiVirus and AdAware spyware scans on a
>regular basis.  But, thanks for your reply anyway.

You say that as if this excludes the possibility of active malware.  

Hah!  But seriously, folks...   ;-)

The behaviour you describe sounds as if the integration point is most
likely to be within the Explorer shell.  The best tool to enumerate
and reversably disable such integrations / intrusions is Shell
Extension Viewer... I'll Google that for you:

http://freehost14.websamba.com/nirsoft/utils/shexview.zip

I have a hunch you might find it's NAV itself (or its LiveUpdate
component) that is the problem here.

You can also do these tests, and report back:
 - Safe Mode Cmd Only
 - Safe Mode
 - Normal Mode with all startup items suppressed in MSConfig

>---------------- ----- ---- --- -- - -  -    -
  Cats have 9 lives, which makes them
  ideal for experimentation!
>---------------- ----- ---- --- -- - -  -    -
randau - 06 Mar 2005 19:09 GMT
cquirke wrote:
>I have a hunch you might find it's NAV itself (or its
>LiveUpdate component) that is the problem here.
[quoted text clipped - 3 lines]
>  - Safe Mode
>  - Normal Mode with all startup items suppressed in MSConfig

I disabled everything in the MSconfig.exe Startup tab with
still no effect on the extraneous dialups.

I don't understand the difference between the two Safe Mode
items above (I've not run Safe Mode before).
cquirke (MVP Windows shell/user) - 07 Mar 2005 05:34 GMT
On 6 Mar 2005 11:09:01 -0800, "randau" <spamjunkmail2002@yahoo.com>
>cquirke wrote:

>>I have a hunch you might find it's NAV itself (or its
>>LiveUpdate component) that is the problem here.

>>You can also do these tests, and report back:
>>  - Safe Mode Cmd Only
>>  - Safe Mode
>>  - Normal Mode with all startup items suppressed in MSConfig

>I disabled everything in the MSconfig.exe Startup tab with
>still no effect on the extraneous dialups.

If it's Norton (as I half-suspect it is) then you may need to disable
non-Microsoft services as well (Services tab in XP; may have to get
medieval with Regedit in Win9x).

If it's a shell integration, then Shell Extension Viewer is the better
(more on-target, safely undoable) approach.

>I don't understand the difference between the two Safe Mode
>items above (I've not run Safe Mode before).

Safe Mode suppresses some drivers and startup items while running
Windows as usual, with Explorer as the shell.  So anything that is
integrated into Explorer (shell extensions) or IE (BHOs) is active.
Safe Mode is not 100% safe for malware, but it's safer in Win9x than
it is in XP, as XP offers more ways to autorun in Safe Mode.

Safe Mode Command Prompt Only is a different animal.  In Win95/98, it
runs DOS mode instead of Windows.  In WinME, it's not an option.  In
XP, it runs XP but with CMD.EXE (the command interpreter) as the shell
instead on Explorer.exe - and this was the scenario I had in mind,
because this way, anything integrated into Explorer doesn't run.

But if you are on WinME, as I belatedly notice is likely, given the
newgroup we are in, then there's no Comamnd Prompt Only option.

>---------------- ----- ---- --- -- - -  -    -
  Cats have 9 lives, which makes them
  ideal for experimentation!
>---------------- ----- ---- --- -- - -  -    -
Lester Stiefel - 14 Mar 2005 05:42 GMT
> On 6 Mar 2005 11:09:01 -0800, "randau" <spamjunkmail2002@yahoo.com>
>
[quoted text clipped - 42 lines]
>
>>---------------- ----- ---- --- -- - -  -    -

  Try Googling for "Process Explorer" . Use this to view
and disable differing processes. Don't kill explorer.
Also open up the Norton/Liveupdate Control panel. Adjust
settings as necessary to allow you to control the dialup
connection (not them).

Signature

Lester Stiefel
In Romans 1 there are qualities of Unregenerate man listed
which describe him in the last days.
Is your quality found on this list??

Rick T - 04 Mar 2005 03:41 GMT
Most probably you have an Autoupdate of some kind that wants to connect
and update.  Find out which one(s) it is and uncheck "Autoupdate"(or
whatever) at the programs Options/Settings.

Rick

> Extraneous Dial-Up Connection Attempts
>
[quoted text clipped - 27 lines]
>
>              randau2...(at)...proaxis.com
randau - 05 Mar 2005 19:25 GMT
>Most probably you have an Autoupdate of some kind that wants to connect
>and update.  Find out which one(s) it is and uncheck "Autoupdate"(or
>whatever) at the programs Options/Settings.

I disabled everything in the Scheduled Tasks folder which
included Norton's Auto-LiveUpdate dialer and it had NO
effect on stopping the extraneous attempts to dial-up.

The only thing that did stop it was to select "Never dial a
connection" in Dial-Up Networking Properties.  Now the only
way it'll dial-up is for me to invoke it manually from a
quick launch shortcut.
Rick T - 05 Mar 2005 21:30 GMT
>>Most probably you have an Autoupdate of some kind that wants to
>
[quoted text clipped - 6 lines]
> included Norton's Auto-LiveUpdate dialer and it had NO
> effect on stopping the extraneous attempts to dial-up.

Hmm... what about
Start/Programs/Startup folder or
Start/Run/msconfig.exe   |Startup tab
anything in there?

You could have a virus or spythingie happening.  What's your
anti-malware stuff say ?

Rick
randau - 06 Mar 2005 19:06 GMT
randau wrote:
>> I disabled everything in the Scheduled Tasks folder which
>> included Norton's Auto-LiveUpdate dialer and it had NO
>> effect on stopping the extraneous attempts to dial-up.

Rick wrote:
>Hmm... what about
>Start/Programs/Startup folder or
>Start/Run/msconfig.exe   |Startup tab
>anything in there?

I disabled everything in the MSconfig.exe Startup tab with
still no effect on the extraneous dialups.

I think I can live with the "Never dial a connection" option
selected and just manually invoke a Dialup from my quick
launch shortcut when needed.

>You could have a virus or spythingie happening.
>What's your anti-malware stuff say ?

I run Norton AntiVirus with automatic LiveUpdates and a
manual LiveUpdate and disk scan every week.  I also run an
AdAware spyware disk scan periodically.  Though, Norton has
caught a number of email viruses, its disk scans have been
clean.  AdAware has caught some spyware and regularly
catches tracking cookies on subsequent disk scans.
That's all.

--
randau
Rick T - 06 Mar 2005 20:35 GMT
> randau wrote:
>
[quoted text clipped - 29 lines]
> --
> randau

Is it Windows Update, maybe ?

Doesn't sound like you have a malware infection... what firewall are you
using and do you think you could trap the outbound connection attempt
with it ?

Rick
randau - 07 Mar 2005 18:55 GMT
>Is it Windows Update, maybe ?

Hmmm, why do you say that?  Do you think the endless
procession of Windows Updates (for security patches) may be
contributing to degradation of stability in the operating
system?  It's something I've been wondering about.

>Doesn't sound like you have a malware infection...

What makes you say that?

>what firewall are you using and do you think you could trap
>the outbound connection attempt with it ?

I don't use a Firewall.

--
randau
Galen - 08 Mar 2005 06:16 GMT
> I don't use a Firewall.

That could be a part of the problem.

Got an idea here... Let it run (let it connect) chances are that it's going
to do anything that it would do on it's own when (if built with any degree
of sophistication/capability and this does apply to malware too) it detects
you have a network connection. The run netstat from a command prompt and
find out where it's trying to connect.

From reading this post I've decided two bits of advice are in order my good
sir.

First being that no one application is the be-all-and-end-all of all
security. When in doubt get a second opinion. AntiVir or AVG are free and
reputable. Download them, update them, scan in safe mode. Prevent them from
running in real time by disabling their startup prompts so they don't
interfere with each other. One should never run two full time anti-virus
applications so make sure you disable one of them but, of course, not both.
Scan with that. The same thing applies to your anti-spyware. There are a
number of free options out there and Spybot is highly regarded in the
community. I'm not as nice as Chris :P You'll have to Google it on your own
as I seem to have lost the link somehow.

Anyhow, on to number two. A firewall serves multiple purposes. First it
keeps the bad guys out if it's properly configured. Second, if it's any
good, it lets you know what's trying to get out and gives you the option to
prevent it before it allows it to escape. I'm biased but with Windows ME I'd
consider Outpost Personal Firewall which comes in a free version or a paid
version. Both fully featured and will provide you a great deal of protection
but, like all things, they need to be properly configured. Too much work you
say? Well, in order to be a "good member of the internet community" it's
your JOB to protect your computer from infestations and, if found, to make
sure that you don't propagate the infestations. A firewall will certainly
help to achieve this goal. There is also ZoneAlarm which is available free
but, as I said, I'm a bit biased. Outpost is at www.agnitum.com but you'll
need to Google ZoneAlarm.

I'd though, for a moment or two, that I'd ask if you had some sort of driver
device helper (like nVidia or Creative) which was trying to register itself.
Given that you've disabled all non-essential goodies from the MSCONFIG
utility (for which I'd prefer the Startup Control Panel located here
http://www.mlin.net/StartupCPL.shtml as I happen to just have that link
handy though now that I think about it, it has no features for services
which Chris mentioned... Hmm... More on that later on in a new post perhaps
but I'll settle for that for now.) there shouldn't be any reason why they'd
be loading. Unless, of course, they're loaded after the device is loaded or
not at boot but rather when some certain circumstances have been met. I've
never seen anything like that for registration but just because I haven't
seen it doesn't mean that it doesn't exist. For example I've never seen a PC
based on a VIA chipset not cause endless headaches but people buy them so
there must be some out there that do.

Ah well, enough of the asides and digression. I'd consider the first two
things listed. When you find out where it's trying to connect to you will be
better armed to determine what process is telling it to connect perhaps?

Galen

Signature

"My mind rebels at stagnation. Give me problems, give me work, give me
the most abstruse cryptogram or the most intricate analysis, and I am
in my own proper atmosphere. I can dispense then with artificial
stimulants. But I abhor the dull routine of existence. I crave for
mental exaltation." -- Sherlock Holmes

Lester Stiefel - 14 Mar 2005 05:46 GMT
> Extraneous Dial-Up Connection Attempts
>
[quoted text clipped - 27 lines]
>
>              randau2...(at)...proaxis.com

  You need to address this at the Auto update feature of
the programs themselves. Just disabling the 'task Manager'
Entry will not do as the program will re-enable this.
Disable the feature in the program itself.

Signature

Lester Stiefel
In Romans 1 there are qualities of Unregenerate man listed
which describe him in the last days.
Is your quality found on this list??

 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.