Unsolved
This post is more than 5 years old
99 Posts
0
161818
February 23rd, 2004 23:00
Network problem???
Have a network of six computers, Dell Diminsions, Windows XP,one computer does the dialing to connect to the internet, 56k modem. After I disconnect from the Internet, the modem immediately dials out again. When I disconnect it stays that way until I redial. I disconnected the network and the problem stopped. I can not find out what program or computer is constantly dialing out to the Internet after shut down of # 1 computer. All automatic up-dates are off. Have Norton System works, SpyBot, and routinely run virus checks etc. Also I changed the modem twice. Same problem.
Any ideas what may be the problem.
No Events found!
jwatt
4.4K Posts
0
March 2nd, 2004 04:00
And if SETI6 and the other SETI machines are disconnected from "ONE", the dialups don't occur, right?
If so, that increases the importance of running HijackThis on SETI6.
Jim
frazser
99 Posts
0
March 2nd, 2004 04:00
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\vincent splain>netstat -a
Active Connections
Proto Local Address Foreign Address State
TCP SETI6:epmap SETI6:0 LISTENING
TCP SETI6:microsoft-ds SETI6:0 LISTENING
TCP SETI6:1025 SETI6:0 LISTENING
TCP SETI6:1029 SETI6:0 LISTENING
TCP SETI6:2620 SETI6:0 LISTENING
TCP SETI6:2623 SETI6:0 LISTENING
TCP SETI6:3439 SETI6:0 LISTENING
TCP SETI6:5000 SETI6:0 LISTENING
TCP SETI6:1028 SETI6:0 LISTENING
TCP SETI6:netbios-ssn SETI6:0 LISTENING
TCP SETI6:3439 ONE.mshome.net:2869 ESTABLISHED
TCP SETI6:5000 ONE.mshome.net:3617 ESTABLISHED
TCP SETI6:epmap SETI6:0 LISTENING 0
TCP SETI6:1025 SETI6:0 LISTENING 0
UDP SETI6:microsoft-ds *:*
UDP SETI6:isakmp *:*
UDP SETI6:1030 *:*
UDP SETI6:1123 *:*
UDP SETI6:2882 *:*
UDP SETI6:ntp *:*
UDP SETI6:1037 *:*
UDP SETI6:1900 *:*
UDP SETI6:3072 *:*
UDP SETI6:ntp *:*
UDP SETI6:netbios-ns *:*
UDP SETI6:netbios-dgm *:*
UDP SETI6:1900 *:*
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain> Proto Local Address Foreign
Address State
'Proto' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:epmap 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:microsoft-ds 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:1025 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:1029 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:2620 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:2623 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:5000 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:1028 0.0.0.0:
0 LISTENING
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:epmap [::]:0
LISTENING 0
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> TCP SETI6:1025 [::]:0
LISTENING 0
'TCP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:microsoft-ds *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:isakmp *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:1030 *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:1123 *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:2882 *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:ntp *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:1037 *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:1900 *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:3009 *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain> UDP SETI6:1900 *:*
'UDP' is not recognized as an internal or external command,
operable program or batch file.
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>:\Documents and Settings\vincent splain
>
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>
C:\Documents and Settings\vincent splain>
frazser
99 Posts
0
March 2nd, 2004 04:00
crosoft Windows XP [Version 5.1.2600]
) Copyright 1985-2001 Microsoft Corp.
\Documents and Settings\vincent f. splain>netstat-a
etstat-a' is not recognized as an internal or external command,
erable program or batch file.
\Documents and Settings\vincent f. splain>netstat -a
tive Connections
Proto Local Address Foreign Address State
TCP ONE:pop3 ONE:0 LISTENING
TCP ONE:epmap ONE:0 LISTENING
TCP ONE:microsoft-ds ONE:0 LISTENING
TCP ONE:1025 ONE:0 LISTENING
TCP ONE:1026 ONE:0 LISTENING
TCP ONE:1028 ONE:0 LISTENING
TCP ONE:3144 ONE:0 LISTENING
TCP ONE:3146 mail.pokynet.com:pop3 TIME_WAIT
TCP ONE:1027 ONE:0 LISTENING
TCP ONE:3001 ONE:0 LISTENING
TCP ONE:3002 ONE:0 LISTENING
TCP ONE:3003 ONE:0 LISTENING
TCP ONE:netbios-ssn ONE:0 LISTENING
TCP ONE:epmap ONE:0 LISTENING 0
TCP ONE:1025 ONE:0 LISTENING 0
TCP ONE:1026 ONE:0 LISTENING 0
UDP ONE:microsoft-ds *:*
UDP ONE:isakmp *:*
UDP ONE:3004 *:*
UDP ONE:3007 *:*
UDP ONE:3008 *:*
UDP ONE:3059 *:*
UDP ONE:3061 *:*
UDP ONE:ntp *:*
UDP ONE:ntp *:*
UDP ONE:3005 *:*
UDP ONE:3023 *:*
UDP ONE:domain *:*
UDP ONE:bootps *:*
UDP ONE:bootpc *:*
UDP ONE:ntp *:*
UDP ONE:netbios-ns *:*
UDP ONE:netbios-dgm *:*
\Documents and Settings\vincent f. splain>
this is on Computer ONE
Yes, computer dials up by it self. Will try to get the rereading on Computer SETI 6
frazser
99 Posts
0
March 2nd, 2004 04:00
Jim,
Sorry, what is "ipconfig /all" output from SETI6 and ONE
frazser
99 Posts
0
March 2nd, 2004 04:00
Jim,
That Zone Alarm Program is questioning every move I make. That is good ...correct?
Just might get into this stuff but this gray hair young man needs to get some rest. I really do appreciate this help.
Was told that the Norton Systems Internet Security program was pretty good in stopping other computers on the network from dialing unwanted addresses.
frazser
99 Posts
0
March 2nd, 2004 04:00
My error, the dial ups started again. After about one hour+minutes they started again. I still have the Plug N'play disable. After disconnecting the Internet something is still dialing out.
jwatt
4.4K Posts
0
March 2nd, 2004 04:00
Open a cmd.exe window (Start/Run cmd.exe). When the window opens, type ipconfig /all > c:\ipconfig.txt. Do that on both "ONE" and "SETI6". That will get the "ipconfig" output into the file c:\ipconfig.txt on each machine. Then paste the two files into a reply.
(edit) P.S.: Have there been any unexpected dialups since you disabled UPnP?
Jim
Message Edited by jimw on 03-01-2004 10:20 PM
jwatt
4.4K Posts
0
March 2nd, 2004 04:00
Indeed that's good. It takes a while to get programs like ZoneAlarm set up so they permit what you want, and deny what you don't want. I've not used Norton's Internet Security program. I expect any program that validates outbound connections would need to be trained in what constitutes a valid outbound connection, though.
Even if a program is prevented from dialing out, it's better to understand why it's dialing out. The reasons may be anything from legitimate programs needing access to the Internet to function properly, to trojans attempting to exploit your connection to cause problems to other machines on the Internet.
Have you tried running HijackThis on SETI6 and submitting the output? That might provide the breakthrough we need!
Jim
jwatt
4.4K Posts
0
March 2nd, 2004 05:00
UDP SETI6:1900 *:*
Those two lines make it look like UPnP is still enabled on SETI6. Since UPnP's disabled on ONE, that shouldn't cause dialouts. But I thought you'd disabled UPnP on SETI6 as well as on ONE.
I'm going to attempt to put together a summary of what we've learned. But something I'm not sure of is how the SETI machines and ONE are interconnected. I think you have a hub, and all the machines are plugged into it. Is that correct? The "netstat" output from ONE and SETI6 would help me understand how the network's interconnected.
Jim
jwatt
4.4K Posts
0
March 2nd, 2004 05:00
That's your mail client on ONE connecting to your mail server. Is your client set up to check for mail once an hour?
Jim
frazser
99 Posts
0
March 2nd, 2004 13:00
JIm,
Back on line.
1. UPnP is disabled on computer ONE and SETI 6
2. Email Outlook does not check mail unless I activate it.
3.Will attempt to download Hijackthis program.
4. Have an 8 port Netgear Fast Ethernet Switch. All computers are connected to this and Computer ONE has the 56 K Modem to connect to the telephone line. I used the build-in Network wizard to set this network up. (windows XP Home).
5. Only program/s that have a auto dial to the Internet are the SETI program that each computer has. No automatic up-dates on any other program that I know of.ie Window up-dates (off) Norton Anti Virus up-dates (off) etc,
6. Computer ONE should shut down after 10 minutes of no activity.
7. Now the system seems to be running like this. On the Internet getting a SETI unit. At some point the computer shuts down and immedialty it dials up again, however I never see any activity on the Internet activity icon on the task bar. After manually shutting down the Internet connection, the computer immediaety connects again. Computer shuts down and immediatley connects again. After disconnecting from the Internet manually a number of times it will not connect for a few minutes and it starts all over again. Computer are always on,24/7.
frazser
99 Posts
0
March 2nd, 2004 14:00
Jim,
Also if just one computer is connected to the network, and it makes no difference which one, it dials to the Internet. Computer ONE standing alone works correctly.
jwatt
4.4K Posts
0
March 2nd, 2004 16:00
Thanks for the summary! Best of all, what I thought the setup was, is indeed what it is!!!
Am I right that during this attempt to track down the culprit, only SETI6 and ONE are on the LAN?
I guess the only unexplained connection is the one that showed a POP3 connection from ONE to "mail.pokynet.com". It wasn't really connected at the time of the "netstat" output, though. So that may represent a manual check for mail you made shortly before you ran "netstat". The reason I know it wasn't connected is that its state was "TIME_WAIT", which is a state that's entered during the very last stage of shutting a TCP connection down.
There's one more service I've spotted that should periodically run, although I didn't think it would run that often. It's the "Windows Time" service. Can you stop it on both machines by doing this...
Start/Run services.msc
In the resulting dosplay, right-click on "Windows Time".
Select "Properties", and click on "Stop".
Set the "Startup type" to "Manual".
Click on "Apply", then "OK".
Finally, close the main "Services" window.
I think that service will complain into the "Application" event log if it can't set the time, so you might want to check on both ONE and SETI6 to see if there are any messages from it. (That's done with Start/Run eventvwr). Also see if there are any other errors in either that Application or System event logs that might be related to network problems.
Jim
jwatt
4.4K Posts
0
March 2nd, 2004 18:00
OK, good. Just checking!
Time service was set to manual , so far only on these two machines
So there's one less possible source of "call home" behavior. Also good!
In the meanwhile I did download FireZone on Comupter SETI 6 but the program was doing something causing the computer to reboot and wanting to send messages to Microsoft, something about a Fatal Error. I did delete the program. It must be in conflict with one of my other programs.
Yikes. I've never worked with FireZone, so I don't know what the conflict might have been. Where'd you download it from? I'm finding more things about fire department systems than about firewalls searching Google!
That was a close call...time for a breather!
Can you post an updated copy of the TCPView output from SETI6?
Thanks,
Jim
frazser
99 Posts
0
March 2nd, 2004 18:00
Jim, Having a bad time with this Internet service on this end.
Only the SETI 6 and ONE computer are on, the rest disabled.
Time service was set to manual , so far only on these two machines
In the meanwhile I did download FireZone on Comupter SETI 6 but the program was doing something causing the computer to reboot and wanting to send messages to Microsoft, something about a Fatal Error. I did delete the program. It must be in conflict with one of my other programs.
Want to hold on downloading hijackthis until they get the telephone situation a little better for the Internet. Will try and download that program later tonight.
Thanks
vince