computer connecting to internet by itself

Four days ago, I came home from work and found that my computer had been online since 1:30PM (at which time no one was home). I checked to make sure that AVG (anti-virus) wasn't set to automatically dial up for updates, which it wasn't. I have Spyware Blaster, Spyware Guard, Spybot, AdAware, AVG, and ZA firewall (free version) installed on this computer, but they've all been there for at least 6 weeks, and this problem with the computer connecting to the internet by itself didn't present until just a few days ago (and I don't recall installing anything new last week). Same thing has happened every day since, although now the time seems closer to 11:30AM.
Is there any way I can find out what program is at the root of this? I assume it must be something I've previously "given permission" to, because ZA allows the activity. Or will I have to just disconnect the computer from the phone line whenever I'm not intentionally online?
Thanks,
Rebecca

 

Are you on a network, because if you are there is a setting to dial up when another network computer attempts to access the internet...

 

You could look into History and see where on the internet the computer has been.
Why is this happening?
Have you set up any scheduled tasks, other than updating antivirus, for programs for that or any other time?
If neither idea helps, please provide more information.
What versions of Windows and Internet Explorer are you using?
How did you leave the PC? Off, Standby, Hibernation?
If either of the latter, on what internet page was the PC when you left?
I see you use dialup. A telephone call could "wake up" your PC unless you had turned it fully off.

 

Try turning on the internet lock in Zone Alarm. Any attempts to access the internet while the lock is on should be logged by ZA. To engage the internet lock, right click on ZA's tray icon and select "engage internet lock ".

 

No, I'm not on a network. And I'm not *aware* of having set up any scheduled tasks at all on this computer. By this I mean that I didn't *intentionally* set any, although if qutomatically scheduled updates were ever a default during installation of something, it's probably possible that I didn't read the fine print closely enough, and simply clicked "next" on the option during set-up.
Welshjim, when you say "look into History ", do you mean click on the arrow at the end of the address box and see what urls show up there? There doesn't appear to be anything unfamiliar to me, but neither can I figure out the order of those urls, so I don't think that helps me.
I'm running Windows ME. When I'm not actually sitting at the computer, I close all active windows so that only my desktop still shows up (although there are obviously other things still running in the background, like my AVG, for one). After 10 minutes the screen goes black, but the computer's not in any kind of official standby or hibernation (or should I say again, not that I know of). I mostly use Firefox as my browser now, although IE still haunts me from time to time, like when I click on a link in Outlook Express or something.

Zander, would I engage the ZA internet lock just when I'm offline to prevent the computer from dialing up?

Thanks for your help,
Rebecca

 

FYI, even with the internet lock turned on in ZA, the computer dialed itself up again this evening! Each time it does this, there never seems to be any visible browser activity (i.e., I just see the "online" icon in my taskbar), so the following question is probably moot, but anyway: Is there a way I can view my History chronologically (rather, reverse chronologically)?
Would the internet lock simply disallow any internet activity once the computer had established a connection? There must be some way of determining what's trying to "phone home ". Should I reset ZA to not allow ANYTHING and start over from scratch with that?
Thanks,
Rebecca

 

If the computer dials up while the internet lock is engaged nothing will be allowed to connect to the internet. When you have the lock engaged and the computer dials up, open ZA and click on alerts and logs. Click on the date/time column at the top to sort by date. If date/time has a small arrow pointing up, click it again so that the arrow points down. This will sort the alerts so that the newest are at the top of the list. Have a look at the newest one(s). If you haven't tried to use the internet since you engaged the lock, the top one in the list should be the one you want to look at. Have a look at the program column to see if it shows you what program it is that's trying to connect. If it doesn't show anything that tried to connect, you may have a program set to pass lock. Try right clicking on the tray icon and select stop all internet activity. I probably should have had you do this right away but until now, the pass lock possibility completely slipped my mind. If you select stop all internet activity, nothing will be allowed to connect including anything that may be set to pass lock. The computer will still dial-up but once it's connected, whatever it is that's trying to connect will be denied access and it should have an entry for it in the log.

 

Thanks, Zander -
OK, I'll activate the internet lock AND "stop all internet activity" from here on in when I'm not at the computer.
Still curious, though, if there isn't any way to track down what's trying to gain access. I've run AVG, AdAware and Spybot, and they all come up clean (except for some leftover Download Accelerator **** that I can't seem to get rid of, but that's been there all along, and as I said, the self-initiated dial-ups just began late last week).
How does one go about setting a program to pass lock in ZA? Not that I want to do it, simply wondering how I might have inadvertently done that...
Thanks again,
Rebecca

 

I do not see any mention of what OS is being used but if it happens to be Windows XP is it possible that Windows Updates or some other thing like Anti-Virus etc. is doing this ?

BillyBob

 

I'm using Windows ME. I check for Windows Updates manually - can't remember how to check to make sure the automatic updates are still disabled, but as I mentioned earlier, I've had this computer for 3 years now, and it's never done this (dial-up business) before. Well, that's not entirely true - AVG did it a couple of times (but I figured out right away what was going on then, and changed the settings to manual updates); when THAT happened, though, the internet connection only remained active during the actual download - then the computer would disconnect. This time around, once the connection is made, the computer just stays online indefinitely...
I'll leave ZA with all locks in place when I log off this morning and see if the computer tries dialing up again around noon -- and if it does, then I'll check the ZA log and see if it caught anything.

 

computer caught in the act!

OK, the computer just dialed itself up to the internet again, with all ZA locks in place. This is what the ZA log tells me:

Entry Detail

Description Packet sent from 217.124.135.113 (TCP Port 3514) TO 216.211.10.164 (TCP Port 445) was blocked
Rating Medium
Date / Time 2004/10/20 etc (the exact time is listed)
Type Firewall

The source DNS is 217.in-addr.arpa; Destination DNS is W7F6W5 (as is the case for every single entry - must be me, obviously)

But wait a minute, something that's INCOMING can't trigger a dial-up by my computer, can it? Everything in my log shows up as "incoming." Is it just a coincidence that this thing tried to nab me as soon as the computer went online?

Still stumped...

 

Hi Rebecca,

What are the Dial up connection options set at under IE tools > Connections tab? If not set, tick never dial a connection.

You might also see what's starting at bootup thru this site http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Also look at ZA's program permissions page - what's allowed out and what's given "server" rights? Act as server means an app is given permission to listen for commumnications from the net. One example would be an AV's look for updates feature.

Regards - Charles

 

rebecca--charlesvar's suggestion may have solved the problem, but you may be interested in the following info
Here are the results of a DNS search on those two numbers. Are you the person in Spain or Canada?
"217-124-135-113.dialup.nuria.telefonica-data.net (217.124.135.113)

217.124.128.0 - 217.124.135.255
Telefonica Data Espana (NCC#2001027547)
Red de servicios IP
Spain
IPNET MANAGEMENT
Telefonica Data Espana
C/ Beatriz de Bobadilla 18
28040 Madrid
SPAIN
+34 902 230 210
+34 91 4567825
secure@telefonica-data.com "
Port 3514 is used by a filesharing program "MUST Peer-to-Peer ". Are you familar with that?

"nwc10-164.nwconx.net (216.211.10.164)

216.211.0.0 - 216.211.127.255
The City of Thunder Bay
1050 Lithium Drive
Thunder Bay, ON
CA


TBayTel Internet Operations
ipadmin@tbaytel.net
+1-807-625-3045


216.211.10.128 - 216.211.10.255
Thunder Bay Telephone
1046 Lithium Drive
Thunder Bay, ON
CA


TBayTel Internet Operations
ipadmin@tbaytel.net
+1-807-625-3045 "
Port 445 seems to often be used by worms, viruses.
http://www.google.com/search?sourceid=navclient&ie=UTF-8&q=Port+445
But the ZA report says it is blocked. So you should be OK.

I have understood that when all this happens you only see a blank page on the Internet. What is in the Address line? If nothing, it would seem that dialup is not in fact connecting (same result as ZA). However the outward call may be being charged to your phone bill. You might want to look at your phone bill to see if you are being charged for long distance calls. The calls may not be to connect you to the internet, but to make an actual phone contact, perhaps to generate phone charges or to pass data.

And although it may be moot now, your today's History (what sites you have been at) is accessed either by clicking on History in the Toolbar, next to Favorites and Search. History for earlier days is accessed from C:\Windows\History I believe for WinMe. You can always run a Find for "History" if that is not correct.

 

Charlesvar -
Everything in my task list looks copacetic, although I just checked it now, not when the computer was actually dialing up by itself (for the fourth time today). I'll definitely check the task list as soon as I hear it trying to do its thing again the next time.
Looking at ZA's program control page, there is nothing that shows up checked in green under "server" - everything is a blue question mark. Under "access ", though, there ARE a bunch of green check marks, both in the 'trusted' and in the 'internet' columns: AdAware, AIM, AVG downloading update, Firefox, IE, Thunderbird, MSN messenger, OE, Spybot, Spyware Blaster, Spyware Guard Live update, and ZoneLabs client.
Maybe I should try to lock each of those out one day at a time and see if the automatic dial-ups stop?

Welshjim -
I'm in Canada. Nwconx was my old ISP (I just changed 2-3 weeks ago) - although Tbaytel (my current ISP) is kind of like a parent company to Nwconx, I think. When I go to tbaytel.net's homepage, there's an option for customers to click on nwconx for their mail there.
When the computer logs on, there's no browser activity at all - my desktop is all that ever shows up, I just see the little internet connection icon in the lower right corner, next to my clock (and if I'm around, I hear the dial-up process. That's the only way/reason I know it's happening.
If it matters any, the address lines in both IE and Firefox are set to open up "blank" when either browser is opened. I've been using Firefox pretty much exclusively for the last 3 weeks. I'm going to see if I can find a "history" listing for Firefox somewhere...
Whenever I've interrupted the automatic dial-up, my tbaytel ISP dial-up networking screen shows up - but I guess I'll have to wait for my next phone bill to see if there are any long-distance charges being incurred.
Sure appreciate all your help, and I'll get back to you if I discover anything new the next time this doggone machine takes the initiative to dial-up the internet!

 

Hi Rebecca,

AVG downloading update That would be my vote. Don't use it, but there ought to be auto checking for updates and that may be what's doing this. Should show up in ME's scheduled tasks. I'm not on WinME at the moment so can't check exactly how, but from the contol panel options, have you checked what if anything is Scheduled?

Don't know how AIM works, if its anything like Messenger, has options to automatically connect.

Regards - Charles

 

I've just double checked the AVG update settings, and they're turned off, so I don't think that's it. And I have to click on both AIM and MSN messenger and enter my password in order to sign on to those, so I don't think they're likely to be involved either.

When I went to turn off the computer last night, I found that it had snuck in another dial-up on me, and had been online for an hour and a half (ZA locks all in place). Interestingly, the first entry in the ZA log for this particular connection time is a "routed" one (what's routed mean, in this case?), followed by three consecutive "outgoing" ones (never noticed anything but "incoming" in the 'direction' column before) -- all "UDP" protocols (I'm estimating that >98% of my entries show "TCP (flags:S)" in that column rather than "UDP "; and incidentally, can you tell me what those two terms mean?).
All four source IPs belong to TBaytel, which is my ISP (216.211.8.194:3942 & 216.211.8.194:3943), and all four hit within 20 seconds of one another. Based on the internet connection time, it looked like the activity happened when the computer first logged onto the internet, but since I didn't hear/see the computer actually doing it, I suppose there could have been some lag time between the start of the connection and the ZA "events ".
Starting today, I'm disconnecting the phone line from the computer when I'm not online, just to be safe, but I'd still like to figure out what's causing this...

I've been racking my brain trying to think of what I might have changed/ installed on the computer last week, and the only thing I can come up with is that I downloaded the zip version of Firefox 1.0PR (I had been using the 0.9 version before), and have been using that as my browser ever since. Can't recall if I actually did that on Friday, which is when this self dial-up problem started, but I can't think of a single other program that I've added or made any changes to... Maybe I should start a new thread in the forum's Mozilla section, and see if anyone else has experienced something similar?

 

Just looked through some other threads on computers connecting to the internet on their own, and found the suggestion to check "never dial a connection" under control panel> internet options> connections> settings tab> dialup settings. My setting had been set to "always dial my default connection" (although I haven't touched those settings in years -- it's always been that before, and this dial-up problem just arose last week).
Still, I think I'll leave the computer connected to the phone line today after all, and see what happens.

 

rebecca--Does THE "MUST peer to peer (p2p)" filesharing program look like anything you have run in the past? This is what the Zone Alarm data you provided reports as the program that is doing the dialing. Remember that ZA also says it blocked the return traffic.
It is not too clear to me why you did not change the setting "Always dial... "
I understand the problem only started recently so that would seem the best reason to make that change now, even though you had this setting for years.
In any event, making the change would not change the possibility that you have a dialer spyware on your PC, but it would at least allow you to see if the change would stop it from doing its thing automatically.

 

"MUST peer to peer (p2p)" filesharing program? What the dickens is that? Is that what the "UDP" protocol stands for? I didn't know I had any filesharing programs on my computer.
About the "always dial "/ "never dial a connection ", I failed to finish the sentence in my last post -- sorry about that! I did indeed change the setting to "never dial" this morning - thus the mention of my plan to leave the computer hooked up to the phone line after all.
Had I remembered to check that particular setting sooner, that would obviously have been the logical place to start my troubleshooting, but frankly, I'd completely forgotten about the Internet Options under Control Panel.
In any case, the computer didn't dial up at 11:30 or at 1:30 today, so it looks like changing the setting has worked. As much as I'd like to know what sparked this flurry of self-initiative on the part of my computer, I thing I'm going to just settle for the fact that the problem is resolved.
Thanks for all your help!
Rebecca
PS - but feel free to answer my p2p question above; I'll check back again later!

 

rebecca--Filesharing programs allow you to trade programs, music, etc. with others. Kazaa and Napster are the most famous. That Spanish company seems connected with MUST P2P, a filesharing program. As I said before, check your phone bill.
But glad to hear the good news.