program dialing internet

[proudusa]

Windows 98SE system constantly has program trying to dial the internet. When not plugged in you get the message saying: No connection to the internet is currently available..yada yada yada.

I removed a trojan from this system, have removed all spyware and removed entries from the registry under current user and local machine\software\microsft\windows\currentversion\run, runone and runservices.

Where else could this program be hiding??

THanks

 

[Cirrus9]

Have you checked the internet connection properties? Do you have a dial-up profile and is it set to "dial whenever a network connection is not present"? If it is, set it to "never dial a connection".
If you have already been through that route, do you know which program is trying to dial? Have you checked to see which programs are set under internet options programs? Sometimes if the default program for a certain category like email is set to an internet service provider as default, it will attempt to dial. Just some ideas....

 

[Rob2806]

Try using Spybot as this sounds like a virus or trojan.

 

[proudusa]

Under Internet Options-> Connections it is set to neve dial a connection. Under Dial-up settings you have the bellsouth, spinway.com_DO_NOT_EDIT and webfolle1x_connection.

It doesn't tell me which program is trying to dial out. I did remove a trojan and have manually cleared registry entries but still get this attempt.

Thanks

 

[thorswolf]

You can also check other registry keys and locations that lauch apps. LOCAL_MACHINE is not the only one that spawns programs, the CURRENT_USER key also has one (same path to the RUN). You can also check the config.sys, autoexec.bat, win.ini, system.ini, and the STARTUP folder of the START menu.

Check the list of running programs which could also give you a hint.

I know these are sort of basic, but they often get overlooked.

Hope it helps

 

[carrr]

You might try running an eval copy of theis trojan removal tool:

http://www.simplysup.com/

I've been having a lot of success with it lately.

 

[carrr]

If that brings you no joy, then download and run this:

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Process Explorer...should help you pin down the source for manual removal.

 

[proudusa]

Thor,

I had checked also in the Current_USR key. Had deleted some remnants of spyware. Going through config.sys, autoexec.bat, etc now but don't see anything that stands out. I disabled everything in msconfig for good measure and rebooted. Dial-up connection comes up immediately regardless.


Looks like RNAAPP is loaded automatically at startup which had to do with MS dial up internet connection. Guessing this is the issue. haven't tried the other software yet but will try it to confirm.

Can't see where RNAAPP

 

[proudusa]

Thor,

I had checked also in the Current_USR key. Had deleted some remnants of spyware. Going through config.sys, autoexec.bat, etc now but don't see anything that stands out. I disabled everything in msconfig for good measure and rebooted. Dial-up connection comes up immediately regardless.


Looks like RNAAPP is loaded automatically at startup which had to do with MS dial up internet connection. Guessing this is the issue. haven't tried the other software yet but will try it to confirm.

Can't see where RNAAPP is loading from