Strange Dial-up

[smeitie]

I have a customers server that has a strange dial out connecting to somewhere on a permanent basis. No icon appears in the systray and I have removed all the Windows dial up connections and it still dials out.
I figure it is some kind of spy s/w, but what is the best way to find it.

Thanks in advance

Roy

 

[Seaspray0]

go into the registry and look at these 2 locations:

hkeylocalmachine\software\microsoft\windows\currentversion\run

hkeylocalmachine\software\microsoft\windows\currentversion\runservices

These are kinda like an autoexec.bat for windows and viruses and spyware love to imbed themselves here.

Each user can also have personalized &quot;autoexecs&quot;. look in hkeyusers\<SID>\software\microsoft\windows\currentversion\run and runservices.

Don't forget the start/programs/startup folder for each user.

Alot of it will not make sense in the registry but if you've looked at enough of them you know what should and shouldn't be there by their names and the paths and programs being called and what paramaters are passed to them. Do a backup before changing or deleting any of these.

 

[smeitie]

I tried all this but it made no difference.

I then installed some Spy software and it removed the harmful programs.

All is now well.

Thanks for your help.