What task is dialling ISP?

[JockMullin]

Hi, Folks.

Does anyone know how I can tell what task (program/service or whatever) is dialling the default internet connection?

I am having a problem with XP Pro 2002 SP1 spontaneously dialling the default internet connection for no apparent reason. MS Outlook & IE are not active. There is another machine (Win98) on the network which uses the XP machine as a gateway but it also is inactive and has no open programs.

This wouldn't be a problem except once it dials it leaves the connection open and since that is also my fax line it keeps blocking the line.

When the dialup happens there is no significant amount of I/O. My suspicions are WMP or McAfee, but I have disabled auto updates in McAfee.

Spybot Search & Destroy searches but does not destroy.

How can I tell what initiated the dialup connection?

Plsd to hear.

Jock

 

[Jontmke]

Hmm... Could it be that Messenger junk? Have you disabled that? It starts up when you logon, maybe it is the culprit.

JON

 

[JockMullin]

Hi, Jon.

Good thought - I will disable that and see. However I was hoping for a more general solution - a way of telling what task initiated the connection - for future use as well.

I have tried monitoring with task mgr, and when it is trying to dial (and I have switched off the modem) the tasks that seem to be active are CRSS (whatever that is) and SVCHOST, which is what leads me to think it is a service but it might just be activated to manage the RAS service.

Many thanks,
Jock

 

[pxb006]

Could it be the Windows Automatic Update software? You can disable this in Control Panel.

 

[JockMullin]

Hi, PXB

Yeah, I thought of that one already, and disabled it. I was pretty sure that was it because it happens when the machine is otherwise idle, but no such luck.

Thanks anyway,
Jock

 

[linney]

A program like Port Explorer might help you out. I believe it keeps a log of what processes dial out.

http://www.diamondcs.com.au/portexplorer/

 

[Comtech]

Any firewall. Antivirus, AIM/Trillian/Yahoo chat.
Easy way to find out, next time it starts dialling, hit CTRL+ALT+DEL and look at what tasks are running.
Might be in the Processes list. Cheers,
Jim

http://members.cnx.net/reboot/

 

[JockMullin]

Hi, Linney.

Ok, thanks, I will take a look at that prog. Sounds like what I am looking for. Will let you know.

Hi, Jim.

McAfee antivirus only. I disabled the auto update. Disabled firewall. No chat. I did watch task mgr & there was nothing unusual in the processes list. The only processes active at all were CRSS and SVCHOST, which leads me to think it was a service. There were no apps running atall.

I have since removed MS Chat, tho I had never logged in. It hasn't happened since but it is infrequent anyway so it will take a day or so to know for sure.

Your responses are greatly appreciated.

Best regards
Jock

 

[jeffbouldin]

Install Zone Alarm. When the process tries to access the 'net Zone Alarm will pause it and ask you if you wish to allow it. It will sit there all day until you come back to the computer.

 

[JockMullin]

Hi, Jeff.

I like that idea - it would ensure the line is still available and I would know it had happened again.

Mwhile (knock on wood) it hasn't happened again since I shut down McAfee update feature and took out MS chat. But I was online alot yday so whatever it is may have used the active connection and I wouldn't likely notice.

Thanks for the suggestion.

Jock

 

[madonnac]

It could also be spyware - this has been known to establish a connection so it can serve you better advertisements

try a program like AdAware - this wil list running processes in its log file, and list all the spyware (that it knows about) on your system

 

[ghuzz]

yip, it could be spyware,,like newnet rundll, if you get zonealarm it will show it up? Kazaa bundles a lot of spyware like BD3= brilliant digital entertainment!

 

[JockMullin]

Hi, Madonnac & Ghuzz

Yes spyware is exactly what I am worried about, quite aside from the annoyance of having my phone line tied up.

However I have run Spybot Search & Destroy which didn't find anything. Also I would expect those progs to dial more frequently - this happens once or twice a day and always when the machine is otherwise inactive.

I have Zonealarm now, but haven't seen any events since. I think it was one of the 'features' I disabled in my search. Time will tell.

Thanks very much for your input.

Jock