Program Called

crabeater

My PC keeps trying to call out (I have it set to where I must OK it).

I have run virus checks & don't think that is the problem.

I think some program, either firewall or virus checker, is wanting to call out for updates. I have disabled auto-updating in both, but something still wants to call out.

Of course, Task Manager tells me WHAT is running, but that's not what I need.

Can anyone tell me which XP application I can use to find out what program is calling for the modem?

Thanks
C

gulliver

what is your anti-virus program, do u have the latest updates, you cld be having a TROJAN. Scan yo computer with the latest virus definition, having the latest updates from Windows will also be an added advantage your side. Can u check the registry for the startup programes, it can also be a source to know what program starts up when your machine is up. gud luck

filkenjitsu

go to this thread and follow these instructions precisely!!!!!!!!!

http://forums.majorgeeks.com/showthread.php?t=35407

TheShadow

Everything wants to call out these days. You could install the free version of zone alarm which will give you the name of the calling function. You did not say what you are running but have you considered that Windows XP after service pack 2 will want to call out to check windows update? Acrobat reader unless you have an old one will want to call out, so will Flash, Windows Media Player, Real player, Quick Time etc. So basically anything that you do will want to call someone unless you use old versions of everything. It makes it really hard to use dial-up and makes broadband users easy targets to become zombies.

JDMurray

A software firewall that monitors out-going traffic will tell you exactly what process is attempting to access your network card. I use Sygate Personal Firewall Pro. The Windows XP firewall only monitors in-bound traffic.

crabeater

filk... I have checked out the MajorGeeks site - thanks. Nothing in step 1 or 2 to worry about (I checked), but will look into downloading some of what they have there & going through the routines described.

As for eveyone else, thanks too, but I have ZoneAlarm running all the time, and check the system with AVG Anitvirus, Spybot, AdWare, and sometimes housecall.trendmicro.com, and none report any problems. I keep them updated.

I have always had auto-updates off, as I am on a slow connection & do them when nothing else happening at night. (Running XP SP1)

When the connection comes up on the screen, I check Task Manager to see what is running, but see nothing wrong or suspicious.

I really had hope that XP had a utility that would tell me more than System Monitor, which only tells how many threads. If anyone knows...

I may have to look into that 'outgoing connections' monitoring SW.

TheShadow

Strange but zone alarm is supposed to monitor outgoing connections unless you have a very old version. The newest one is so chatty that many have been removing it and using something else. I hope you have not been zombied. Most of that hand crafted code bypasses all the known checking software and buries itself in windows code. You need something that will tell you all what is being run by the various copies of svchost.exe and see what hijackthis tells you

crabeater

ZA is up to date [& re-did all of these Wed]. I normally have it set to Medium so I have to OK outgoing connections, but a government site made me lower it (need to add to trusted sites) & so it has been in learning mode for a while. You are also right about it being "chatty" - I was really getting tired of OKing so many things.

I THINK I found what was trying to call out - service called "Remote Access Auto Connection Manager". I pick that since, when I arrange the processes by PID in Task Manager, that one was right above the dialer most of the time [rasautou.exe]. I had/have it set to manual, but it was running, so I stopped it, and I see no more dialing attampts. Since I have been doing some experiments with this PC (until I set up another with an evualation XPSP2 disc from the MS book) I may have started it when I tried to to a remote assist for a friend. Of course, it still should not keep trying to call out......

Of course, if some malware started it --- I should know next time I restart the PC (I use hibernate a lot; of course at some point MS screws up & I have to restart - which I DID just a few days ago. Hmmmm). Spybot found a few 3rd party cookies from some sites that SHOULD have been blocked by WinFirewall [this PC is pre-SP2] and/or ZA, but nothing else.

Any other ideas about how to determine for sure which is trying to call out would be great. Thanks to All.