Windows Autodialer process identification?

Occidental

I'm looking for a program that will identify the program which is kicking off the autodialer in Windows.

I have a user who is having problems with Windows autodialing to the standard Eircom dialup for no apparent reason. Virus defs are fine and I've run Spyboy, AdAware and Hijackthis on the machine, but have found nothing of interest.

Orion

Not sure if there's any specific software to do just this but any half-decent firewall will tell you what's trying to connect to the internet.

Outpost and Zone Alarm are two that spring to mind.

shinobi

Occidental wrote:

I'm looking for a program that will identify the program which is kicking off the autodialer in Windows.

I have a user who is having problems with Windows autodialing to the standard Eircom dialup for no apparent reason. Virus defs are fine and I've run Spyboy, AdAware and Hijackthis on the machine, but have found nothing of interest.

Could it be some software auto updating or requiring registration? ie Windows/Antivirus or Realplayer?

Occidental

Very strange. ZoneAlarm and McAfee were both running(or appeared to be) but found nothing. I've run through the Hijackthis process list one by one and the only item I couldn't find any info on was a file called WindowsFirewall32.exe. Did a quick search on the hard disk and lo and behold, three copies of this file all with todays date.

I've deleted these and removed the registry key and everything seems back to normal now. None of the AV or Ad removal sites seem to have any details on this file.

cheers,


Pat

Redrocket

i remember kerio personal firewall used to monitor which programs launched other programs, it might pick up which app or dll launched the dialer.

Occidental

Also seems to call itself fsdsdf.exe and WindowsFirewall32.dat, all 32kb in size. Neither of these two are listed on the AV or Ad sites either.

stevenmu

SysInternals have a tool that lets you this, along with some other pretty cool tools. I think it was Process Explorer, it shows you a tree of all running processes organised by which process launched which.

jor el

Yeah, that porcess explorer is the business. You can get it to replace the standard task manager too and it gives loads of info and options for all running processes.

As for the WindowsFirewall32.exe file, anyone know if there's a way to submit info to AV and anti-spyware sites when you find a new one so that they can keep up to date?

theothernt

Hi,

Occidental - Out of interest, did you try scanning for viruses and adware/spyware when in Safe Mode?

In relation to the WindowsFirewall32.exe, all I could find was this...

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MYTOB.AH&VSect=Sn

- Neil

azezil

control panel - network connections - tools - advanced - dialup preferances - tick "disable auto dialling when i am logged on"