Tracing PPP trafic

[Clairvoyant1332]

I have an NT 4.0 box at home that uses a PPP dialup connection. On a fairly regular basis, if the connection is closed I'll see an Auto-Dial attempt pop up and reconnect to my ISP, after which I see some TCP port 80 connections under ipconfig. I've even seen this happen shortly after a reboot before I start up any apps. I've been using SpyBot Search And Destroy to look for spyware but nothing comes up.

Is there any sniffer software out there that will snoop a PPP dialup connection? The ones I've seen only snoop ethernet traffic.

OR... could someone suggest some other methods of finding out what initiating these auto-dial attempts?

 

[AlexIT]

Is it a workstation or server? What services are running (i.e. DNS, WINS, etc.?)

Alex

 

[Clairvoyant1332]

It's NT 4.0 Workstation. It uses DNS once it dials up, but it's not a DNS server. The only questionable apps loaded that I can think of offhand are ICQ, AIM, and RealPlayer. I'll have to dig around a bit when I get home to see what else is on there.

 

[AlexIT]

You've found it (or them):

ICQ = automatically logs in
AIM = automatically logs in
RealPlayer = always calls "home" to report it

Set these so they don't run at start up, you may have to REMOVE RealPlayer as that software is nasty about reporting in...

Try installing free ZoneAlarm it will report exactly what software is communicating with the internet. (You can also use "Lock" to prevent ANY communication and see what program reports an error.

Alex

 

[Clairvoyant1332]

I found it! I installed ZoneAlarm and while I was disconnected I found that c:\winnt\system32\msrexe.exe was trying to access the DNS server that I use when I'm dialed in. So apparently it's a process internal to WinNT, now the question is why is it doing this?

 

[bcastner]

Msrexe is not a valid Windows file. You are infected with a trojan:

WinTasks Process Library
msrexe - msrexe.exe - Process Information
Process File: msrexe or msrexe.exe
Process Name: Remote Access / Hacking tool / ICQ trojan
Description: Added to the system as a result of an ICQ Trojan that alters Win.ini and System.ini files and generates several. .exe-files with randomly chosen names.
Company: N/A
System Process: No
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): Yes

Please use Google for "msrexe.exe" as there are many, many variants of this Subseven trojan, and their removal requires special steps depending on the version.

 

[Clairvoyant1332]

Damn! And I thought I was good about my downloading habbits. I should have figured this out this was on my system a long time ago. This is embarrasing....