Help! I'm tearing myhair out over this! Internet connxn

  • Thread starter Thread starter Rex
  • Start date Start date
R

Rex

Heres the scenario...

I start my computer. Within 5 to 30 minutes, I get that
little dialogue box that says:
"You (or a program you are using) is requesting
information from microsoft.com. Which connection do you
want to use?"

Now...I have done nothing. There are NO programs actively
running. And I sure would not want to ever request
information from MS. I know better than that.
But OK...no biggie, I can deal with that. That is just to
show you WHO this phantom program wishes to communicate
with.
Here's my real problem...
Whenever I am online, SOMETHING (I suspect my phantom
program that is requesting information from microsoft) is
CONTINUALLY communicating with another website.
Now...If you have ever uploaded, or downloaded something,
and tried to surf the web at the same time, you will know
how PAINFULLY slow that can be.
I have to contend with this ALL THE TIME...and it is
driving me NUTS!!!
I cannot determine WHAT is doing all this communicating,
or how to stop it.
It started doing it all of a sudden about 2 months ago. I
thought it might be some adware or spyware program, but I
did a clean install, with NO other programs installed,
and it did it. I have auto-update disabled, I have
messenger disabled. No applications are showing as being
open or active in Task Manager.
If you have ever looked at the DUN icon in your system
tray, NORMALLY more bytes are received than are sent,
usually at the ratio of around 3-5 to 1. In my case,
ALWAYS, bytes sent exceed bytes received by up to 2X.
This can happen if I just connect to the internet, and do
NOTHING. Just sit there and watch it...and it CONTINUALLY
communicates with *something* (I would guess from what I
have said, that it is microsoft.com)!

So my question is:
How can I find out WHAT is communicating over my
connection, and most importantly...HOW DO I STOP IT from
doing so?

Oh...and I am not about to fork over $35.00 to MS in
order to register a complaint!

Please, anyone ... before I tear out what little hair I
have left ... HELP!!!?!?!?!
Here, or email.
 
Editing the registry is for users who know what they are
doing. Use the below informatin at your own risk!!!

Go to Start, Then Run. Type in Regedit and press OK.
Go to HKLM, then to Software.
Go to Microsoft, then to Windows.
Go to Current Version.
Click on the folder Run.

Whats in there?
 
RUN expands to additional folders as follows:
-Run
-Optional Components
MAIL
MAPI
MSFS

As for what's actually in the "Run" folder itself...
The following:
(Default)
EssSpkPhone
Microsoft Works Portfolio
Microsoft Works Update Detection
windows auto update
WorksFUD
all of type "REGSZ"

Do you want the actual data values?

Note that any Works components were not installed with
the original Winblows instal. All the Works crap was
installed with a new Word installation.
EssSpkPhone I am assuming is a component of Easy Spread
Sheet, an EZ Office component installed seperately.

Let me know if this is what you are after.

Thank you for the prompt response.

Rex
 
How about installing a firewall program that allows you to monitor and
control which programs are allowed to access (both inbound and
outbound) the internet?
 
Ah...now there's a thought.
Know of any GOOD free ones?

This is a good idea, but I would still like to find that
phantom program doing all the communicating.


Rex
 
I tried the Kerio one, and (to me) it did not seem very
user friendly. I also tried, and prefer, the Outpost
firewall.
However...my problem persists. Yes, the firewall
identifies outgoing attempts at communication, but when
you have no idea what a particular application does, or
do not otherwise recognise what a particular outgoing
request is for...then I am unsure whether I'm supposed to
block/deny or allow/permit...ergo...I am unable to
resolve my original issue using this method, and my
original issue persists.
I thank you for the suggestion though, and hope you may
have another?

Rex
 
Thank you for the assistance.

I have no problem deleting the Wrks entries...I hate
Works anyway.
But I have since discoverred that esspkphone is a
registry entry for my modem, not, as I originally
thought, for Ez SpreadSheet, and I am therfore uncertain
about deleting it.
I will try the Tsk Mngr thing next time it pops up.
Meanwhile, can you tell me if it will be safe to delete
the esspkphone entry?
 
OK...progress...of sorts.
I did what you suhhested re using Tsk Mngr to identify
the app, and found this out:
The program bringing up the "You (or a program you are
using) is requesting information from microsoft.com"
dialogue box, is called rasautou.exe, is a MS appl that
is part of WinXP, and it is a remote dialer.
OK...delete it, and the dialogue box problem goes
away...however, as it is a protected system file,
Winblows won't LET me delete it...not permanently anyway,
and keeps putting it back in the System32 folder whenever
I do a re-boot.
Also, when I am connected to the internet, my phantom app
is STILL doing all its communicating. The dialer
(rasautou.exe) was just a means to an end, and not the
culprit behind the constant communicating. I STILL don't
know which app is doing all the communicating.
Using Tsk Mngr, also does not shed any light on this
matter as no processes appear or disappear during this
process.
Also, I have either 4 or 5 (it varies) SVCHOST.exe's
running at any given time; 1 is local, 1 is network, and
the others are all System. Should I have that many
running? If I shut any one down, I completely lose my
ability to surf the Internet, although the DUN stays down
in the sys tray.

What next?
 
The firewall has a status window that shows programs which are
currently talking with the internet. It should tell you where a
program is connected to and the amount of data it is sending and
receiving.
The firewall also has a filter window which shows a list of programs
allowed to access the internet and the rules governing the access. You
should be able to disable each program one at a time from accessing
the internet and see on the DUN status window if data transmission
stops.
 
Back
Top