Help In Finding What is Downloading Continously From My Computer

Question

I have a major problem on my hands: Something is continously downloading thru my network and I want to find out what/who is behind it. I've done everything to shut down XP auto update, yet still something downloading. It never stops, it will download all day and night! Nothing in running processes gives me any clues. What can I do to identify the remote server that is sending data to my puter? If is is MS, where is the massive data being stored? MS has already installed all the available Updates.

HELP!!!

Kevin Osiowy · Answer

Definitely go the ZoneAlarm route! Had it for years and wouldn't run any machine with online access without it.

JimAztec · Answer

Ok, found out that the problem is: its a 6KB spyware file in c:\windows called services.exe

Unfortuantly antivirus or MS AntiSpy cannot remove it, they detect it, but cannot remove it. So I am looking for help in getting rid of it.

BigBrother · Answer

JimAztec, Do you use any of the popular file sharing applications such as BitTorrent, Kazaa, Morpheus, Grokster, Limewire, etc...? Steve

JimAztec · Answer

No. No third party network apps are installed.

100mph · Answer

Why you think that 'something downloading'? Get a free ZoneAlarm. It will help you to filter outgoing traffic: http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=staticcomp_za

BigBrother · Answer

JimAztech,   Install an firewall application such as Zone Alarm which can prompt you to give or deny permission to every application which attempts to access the internet.  You should quickly learn what applications are accessing the web.    Steve

100mph · Answer

----------------------------------------------------------
Process File: services or services.exe
Process Name: Windows Service Controller

Description:
services.exe is a part of the Microsoft Windows Operating System and manages the operation of starting and stopping services. This process also deals with the automatic starting of services during the comptuers boot-up and the stopping of servicse during shut-down. This program is important for the stable and secure running of your computer and should not be terminated. Note: services.exe is also a process which is registered as the W32.Randex.R Trojan.
----------------------------------------------------------

This link:
http://securityresponse.symantec.com/avcenter/venc/data/w32.randex.r.html

And the second link below ...

Message Edited by 100mph on 02-06-2005 12:11 AM

JimAztec · Answer

It appears the varient of services.exe I catched is a little different then described on anti-virus sites since there is no reference to it in registry. It appears services.exe is just a smoke screen for the real file you want in mssyncr.exe in system32. Go into safe mode so you can delete both files and them do a search for mssyncr.exe in registry and that removes it completely.

Kaspersky is the only anti-virus that can remove it, although I removed it manually since the installed anti-virus that came with my Dell could not handle it.

Windows General

Help In Finding What is Downloading Continously From My Computer

Was this post helpful?