Constant transmissions over Internet

  • Thread starter Thread starter zSplash
  • Start date Start date
Z

zSplash

What's the deal with the constant "sending and receiving" over the Internet
with Outlook/Win2k/IExplorer/(whatever)? I don't know that it used to
happen, but I have recently noticed mucho slowing down of viewing websites
and getting email, and I see that my PC is constantly sending and receiving
over the modem. Is that normal? Is there anything I can "reset" to prevent
such constant transmissions? For example, when I first log on, before
opening Outlook, I see that (before I open any program), my PC has "sent"
3,000 kb, and received 18,000 kb. Is this normal or preventable?

TIA
 
Hi Splash - Courtesy of Colin M. McGroarty with some additions by me:

You can get more info about the worm here:
http://isc.sans.org/diary.html?date=2003-08-11

and here:
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Complete directions for fixing this can be found here:
http://www.bigblackglasses.com/Article.aspx?Article=342,
and here: http://www.kellys-korner-xp.com/xp_qr.htm#rpc USE THESE BY
PREFERENCE. There are "fix" scripts available at both sites.

Also, a stand-alone removal tool, Stinger, from McAfee, has been updated to
handle this as one of the 26 things it fixes. Available here:
http://vil.nai.com/vil/stinger/ Be sure that you get the patch installed
though.

and another from CA here: http://www3.ca.com/virusinfo/virus.aspx?ID=36265

but, if you can't get there because of the shutdown, then:


"URLs may wrap

Easy, but annoying fix. When your computer starts go to the services applet
found in administrative tools. Select properties for the RPC or Remote
Procedure Call service. Change the Recovery from "Restart Computer" to
"Restart Service." Now your PC will stay up long enough to fix.

Next download the Microsoft Patch found at:

http://www.microsoft.com/downloads/search.aspx?displaylang=en

The patch is currently in the top download choices for both Win 2K and Win
XP. Choose accordingly and download.

Once the patch is installed make sure to do a full virus scan with current
virus definitions.
See Symantec's web page

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Once the worm has been eliminated I recommend running Windows Update to get
all the current critical updates.
Lastly, change the RPC service back to "Restart Computer" as the recovery
method (or Take No Action for Win2k = jrb).

Hope this helps,


Colin M. McGroarty
MCP+I, MCSE, NT-CIP

(e-mail address removed)
www.McGroarty.org"



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
Thanks for all the suggestions, guys, but I don't have the virus. I've
already got the patch, I don't have msblast.exe in /system32 and I'm current
with McAfee. The constant transmissions continue. Any other ideas???
 
Maybe one of your pieces of (valid) software has an auto update feature
turned on? If not then you most likely have a spyware of some sort.
Did you try a spyware scan with something like AdAware or Spybot Search
& Destroy? What processes are running when all this activity is going
on? A firewall would tell you what application is doing the sending and
receiving.

John
 
Hi Splash - Are you running a firewall? If so, does it - like ZA, for
example - offer an indication of which program is currently active? I would
try looking at that and/or using Task Manager to see which program(s) are
using up resources, although the firewall approach will probably tell you
more for your particular problem. If you can identify the program, we may
be able to do a bit more about helping.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In
 
Thanks, Jim. I will monitor the Task Manager as you suggest. I appreciate
your help.

st.
 
Back
Top