E.T. Keeps Dialing Home!

Topic

New Reply

Several weeks ago, my modem started dialing on bootup and, more recently, when I bring the computer out of hibernation or when I’m working on any number of programs (no pattern to which ones I have open). I thought that was peculiar because it had happened about a year ago, and I put an end to it by unchecking “Never dial a connection” in the Internet Option’s Dialing Properties and in DUN dialing properties. In addition, I deleted the WindowsApplog files. I rechecked those settings and found no changes.

Right now I’m at my wit’s end. Here’s what else I’ve done:

–Followed the steps in MKBA 175312 (no programs that automatically check for updates, no programs listed in the Startup folder, no trojan horse viruses, no MSDTC Service, Registry key is N in HKEY_LOCAL_MACHINESoftwareMicrosoftOLEEnableRemoteConnect

Reply | Quote

Replies

(Edited by DenGar on 23-Jun-03 15:58. Edited to add some info.)

Thanks for the link–I’ll check it out. Your link to the MKBA article relates to Win XP–I’m running Win ME. If nothing else works, though, I might try the registry change suggested. Curious about Norton as the cause–I’ve been using it for years and have never had any problems, but there’s always a first time. Also, I’m not running any kind of live updates–Windows, Norton, or anything else.

Reply | Quote

DenGar,
You did check MailWasher options to see if “perform default mail check on start up” is disabled?

Bob

Reply | Quote

Yes, the option has been disabled since I first installed the program.

Reply | Quote

The best thing at this point is to use a tweaking program such as X-Setup to disable all the extra ‘stuff’ you have starting up when the PC boots. If it still dials you’ve most likely got a trojan that is undetected. Otherwise, re-enable one program at a time and boot after each. That should identify the culprit.

Joe

--Joe

Reply | Quote

Thanks. I’ll try X-Setup later today when I get some time. I’m also thinking about uninstalling NAV and reinstalling it without applying program updates–one of the links Cowboydawg suggested has a discussion that seems to focus on the dialup problem resulting from a recent update.

Reply | Quote

Are you connected to a LAN? If so, do the machines on your LAN share your modem? If so, is one of the computers on the LAN trying to dial the modem for some reason (automatic update, etc.)? I just ran into this situation when one of my son’s friends connected his PC to our small home LAN and his PC was continually dialing my modem at 20 minute intervals! Very disconcerting. Eventually, I just checked ‘Never Dial an Internet Connection’ on his PC and the problem went away. Just a thought.

Reply | Quote

No LAN–just an isolated PC forever trying to make connections with the World (Wide Web).

‘Never Dial an Internet Connection’–that’s been unchecked for more than a year, and that’s part of the puzzlement.

Reply | Quote

[indent]

---

I’m not running any kind of live updates–Windows, Norton, or anything else.

---

[/indent]
IMHO if the above statement is true, and you in fact never run Norton’s Live Update, then you most likely have a trojan trying to contact its master. I would subscribe to Norton and update my virus definitions ASAP if I were you. I would then run a complete system scan and if no virus is found I would get a copy of ZoneAlarm, AdAware 6 and Spybot Search and Destroy (all free DLs for personal use) install them all, set up ZoneAlarm to keep whatever is dialing from getting out, and run a complete scan with AdAware & SpyBot. If these three programs come up empty, then I would follow Joe’s advice and disable all unnecessary items from the startup folder and then work each one back in seperately , rebooting each time. These exercises will serve two purposes. First, it is unlikely that any virus, adware, malware or bot could hide from this thorough a search. Secondly, you will have software on your system now to keep the miscreants away from your door and exorcise them when they do sneak in.
And they will sneak in !!!

Reply | Quote

Thanks, Doc, for your input. I need to clarify, though. I do have NAV, SpyBot, and AdAware–what I don’t do with NAV is have an automatic live update. I do it manually twice a week and then run a scan. The same with SpyBot and AdAware. I will take up your suggestion about ZoneAlarm. I’ve also golne through the selective startup with no results. Still the startup dialup and random dialups while working on other programs. Hope the ZoneAlarm and Destroy will bring some results. Thanks, again.

Reply | Quote

Just a hunch here, but take a look in your address book and contacts lists for any entry or person you do not recognize.

The only trojan I’ve had came in on an executable file for a silly game and when it dropped it’s nasty little piece of code, it put it’s hook as an entry in my address book. Everytime I would start my computer, it would attempt to connect to the internet. Often and at random times it would also attempt to dial up a connection. Finally, one day shortly after the dial up attempts began, while I was on the internet, the computer began doing very strange things (screen flipped upside down, icons moving around, dialogue boxes running away from the cursor). A text messaging box would appear and someone would attempt to gaod me into responding. Knowing I had some kind of virus, I shut down the machine, unplugged the modem and then restarted the system and after shutting down the dial up attempt I removed my address book completely and copied the My Documents folder and a few other data folders for some programs off the system. When I rebooted the dial up attempts had stopped and there was no further strange activity. It was when I was reinstalling the address book that I noticed the unusual entry and removed it. I had already installed Norton AV by then and had run a complete system scan. The trojan and it’s dialer had evaded that scan. Norton found the infected file on a subsequent scan and removed it, but I’ve always wondered if it would have found the dialer there in my address book.

Take a quick look. It may save you a lot of hair pulling.

Reply | Quote

The hair pulling commenced weeks ago, and I haven’t got that much to start with.

Anyway, checked all the items in the address book: nothing strange there. Thanks.

Reply | Quote

Sorry. Fresh out of suggestions I’m afraid. Maybe this will help ????

Reply | Quote

One little FYI on ZoneAlarm. If something is trying to dial out, ZA will stop it and give you some reasonably detailed information on who or what is trying to dial out and who or what they are trying to reach. On the “Log Viewer” tab of the “Alerts & Logs” page, if you highlight a particular alert by clicking on it, ZA will display the particulars of the alert at the bottom of the page in the “Entry Details” section. This may help you to identify the culprit here.

Reply | Quote