Here's one for an Elite member

[mariner]

Why does my puter dial up a connection all by itself. No programs open. DUN closed. Nothing in systray that would dial. OE closed. In OE I even have it set up not to dial. Yet something still dials up with no apps open.

 

[Angrymarshmello]

What makes an Elite member know more about this than anyone else?

Check your startup folder of if you're using Win98SE go to Run, MSCONFIG, click on Startup tab, see if anything is set to go off automatically

And it would help if we had modem specs, when it does this (right after a reboot, gaming, etc)

 

[mariner]

RB, the 'Elite' comment was sarcasm at it's best :^)

Gotcha!

Using NT-SP6. Does this all/any time. Except never had it do it rihgt after booting. I think it may have something to do with OE but don't know how. Zoom isa modem.

 

[Angrymarshmello]

Well, try this:

Reboot, make a note of what programs you open up. If it opens up after a certain one, note that. Reboot again, don't open that up. I'm not much of a NT person so I'm not much help, sorry.

 

[mariner]

RB, I kinda been doing that in my head. That's what lead me to believe it was OE. This only happens if I have previously connected to my ISP since the last boot. Obviously I'm not much of an NT person myself for awhile I thought it was morningstar.com, an investment page I would leave open after I closed my connection. But it has redialed with only motherboard monitor and cpuidle pro running. I have eliminated those 2 apps as suspects. Gets curiousier and curiousier.

 

[SlickWilly]

Here's something you can try. Open up regedit by clicking start, run, type regedit, hit enter (I'm sure you know this already )
Now do a search for runservices, this should take you to the right part of the registry (I'm not in NT4). Above and below the runservices section which should be highlighted, you should see a few other "run" sections such as run, runonce, runonceex, etc. Highlight these keys and see what's running through them. Clear out any garbage you know doesn't belong, and if there's anything you doubt, do a reg export (by clicking file, export...) before you delete it. And also, check in your start button programs menu under the startup section, there may be some garbage there. If there's nothing, you may want to check the startup for other profiles (such as admin, all users, etc). I wish I could help more but I'm running 98 and 2000... Good Luck.

 

[Chris A]

Could it be Outlook or Outlook express?

 

[mariner]

thx Slick. good advice. didn't see anything that looked like the culprit. I guess it could be something I don't suspect. I have a standard startup group (try to keep it that way). runservices has a 3Dfx thing pointing at my CD-ROM. Run has some Creative lab stuff, cpuidle, mbm, norton AV, partitionmagis stuff, and a systray exe file. hmmmm, dont see anything.

has anyone seen a similar problem?

 

[Rich]

Maybe NAV is trying to do a Live Update/

Rich

 

[CyBOrz PaCe]

Didn't you say it ONLY happens after you have dialed your connection since the last boot? Does it happen instantly after you disconnect or at random times?

My guess would be something is set to run after dial up that has a timer on it to check for updates or changes. Similar to what OE would do when it checks for mail. Or it could be a program attempting to update itself upon connection, a program with the ability to redial if the connection is broken, like AIM.

I am definetly new to this stuff but, is it possible it is a "spyware" type of program attempting to connect?? Would running a program such as "OptOut" help??

Just an idea......

Any way to check some sort of Eventlog or something right after the dial out is attempted and see what files were just used or accessed?

Hope you figure it out.

CyBOrz

Another thought... How about StartupCop??

 

[LBM1A]

I had this problem before and could never figure it out.. I installed Zone Alarm and it was running one day and then it happened... REALPLAYER!! I had been away from the puter for 5 minutes or so and came back and it told everything.. Thanks Zone Alarm!!!

 

[CyBOrz PaCe]

I think ZoneAlarm and OptOut are available at the same web site.

http://grc.com/optout.htm

I think this link takes you directly to OptOut, but you should be able to get to ZoneAlarm from there.

CyBOrz

EDIT - Actually, that link gets you to optout which will help with locating and deleting spyware programs. Even some that zone alarm misses... but zone alarm is not there, "Sheilds up" is.

 

[mariner]

Rich - I don't think Norton AV is trying to dial out. I have the auto-update disabled. I update manually.

CP - The dial-up timing is more-less random but usually occurs fairly quickly (<10 minutes) after I log off. This didn't used to happen. Just started in last couple of months. I've been running OE for almost a year. I am unfamiliar with AIM.

I have read up on OptOut, Zone Alarm http://www.zonelabs.com/download_ZA.htm, StartupCop http://web.zdnet.com/pcmag/pctech/content/18/08/ut1808.001.html and Black Ice but have not used them. Anyone have any recommendations/experience on any of these in addition to LBM1A? OptOut looks to be sensitive only to Aureat spyware until the full version is released in September. I'm thinking of loading StartupCop and ZoneAlarm 2.1 (freebies for personal use). I dl them while writing this post.

Nothing in Event Viewer looks related to this. I do get a 'service driver failed to start' everytime I boot. The message in EV is &quot;The following boot-start or system-start driver(s) failed to load: QUARTANT &quot;. But I don't think this is related??

I also get 2 mouse buffer errors in EV that say: 1) &quot;The ring buffer that stores incoming mouse data has overflowed (buffer size is configurable via the registry).&quot; and 2) &quot;The ring buffer that stores incoming mouse data has overflowed (buffer size is configurable via the registry).&quot; but I don't think they are the problem either - they just cause screen freezes occasionally (I really should fix them also
).

I have not dl RealPlayer - too much bad press and BBS stuff! I did find a DoubleClick entry in the registry at HKEY/USERS/S-1-5.../Software/Microsoft/RAS Autodial/Address/m.doubleclick.net. don't know how/when it got there. But there are MANY 'cookie' looking entries there.

Enough for 1 post

 

[mariner]

OK! Haven't solved my problem(s) yet but have some info. I loaded Zone Alarm 2.1.25 and Startupcop. If I wasn't married I'd be in luv These are great little apps Both are free for personal use.

Cop does exactly what it says, lets you determine what loads when windoz starts

Zone is even better. Lets you determine what apps access the internet. And, checks for .vbs attachments!

If you haven't got these, get 'em. Small footprints, idiot proof and very functional.

I would rate them as useful as Motherboard Monitor, CPUIdle, mIRC, Napster, Napigator, Download Accelerator and your handy wav->mp3 converter!

 

[mariner]

No solution yet. I just had to say again how much I like StartupCop and Zone Alarm.

In addition to giving you complete control over which programs are loaded, StartupCop even tells you the location of registry files associated with each program loaded with windoz!!

And Zone Alarm is highly configurable!

Just can't say enough about these two apps

 

[mariner]

Zone caught my remote Access Connecton Service prog dialing up w/in 1 minute after I disconnected. Not sure but I guess that this prog dials whenever I connect. Zone didn't flag it until the connection was made with my ISP so I was online but I guess no net connection had been established. Still don't know what initiates the dial-up

 

[tas]

what is motherboard monitor?

 

[CyBOrz PaCe]

Yes, OptOut is best at ferreting out the Aureat Spywear. I thought it was already was able to find some others. But from what I understand, it can find some progz that Zone Alarm won't.

They mask themselves as parts of other programs like OE. Usually Zone Alarm does not flag these when they attempt to trasnmit.

This is what I heard/read. I have not used Zone Alarm so this was not tested by me.

You might run OptOut for sh#ts and giggles. It is also very small, like 34k runs quickly and painlessly... It found 23 spyware proz on this computer....urgh!

CyBOrz

 

[Wooster]

mariner:

Check your proxy server setup. If you have this setup some where by accident, delete it (not if you have cable / DSL connection). Otherwise every time you login NT, NT will search it online and start up the dialup process

BTW, are you running cable modem or DSL? I don't remember you mention anything like that.

 

[mariner]

tas - MBM is an app that reports your cpu/mb temps and volts, and your fan speeds. Find it here http://httpd.chello.nl/~a.vankaam/mbm/

Thx for the input Cy. I'll get OptOut and give it a try

Wooster, I am on a standard modem dial-up At work now so I'll check those items tonoght.

 

[reignmaykr]

isnt this the autodial feature in NT? cant u just disable it?

 

[Slikkster]

This msg has to do with that error you're getting in Events Manager re: the mouse...

Microsoft InPort Bus Mouse Port Driver Entries
The value entries for the Microsoft InPort bus mouse are found in this subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Inport\Parameters
MouseDataQueueSize REG_DWORD >= 0x1

Specifies the number of mouse events to be buffered internally by the driver, in nonpaged pool. The allocated size, in bytes, of the internal buffer is this value times the size of the MOUSE_INPUT_DATA structure (defined in NTDDMOU.H). Consider increasing the size if the System log in Event Viewer contains the following message from the InPort source: &quot;The ring buffer that stores incoming mouse data has overflowed (buffer size is configurable via the Registry).&quot;
Default: 0x64 (100)


(from knowlege base article q102989

 

[easystreet]

Same thing happens to me unless I tell IE or Outlook Express to go offline in the dropdown box.