Win XP Constantly accessing internet

[tpeters]

I recently did a clean (new) install of WIN XP. Everything has gone fine with the following exception.

Whenever I am logged on to the Internt I notice that I am constantly receiving data. I have no idea where this data is being stored but it is quite immense. I thought the Win XP Firewall was supposed to stop anything similar to this. I also have used Zone Alarm but I am stll constantly receiving data.

I have also run AdAware but it still continues.

Is this "normal for Win XP?

Could this be a virus? (I have yet to install Norton Systemworks 2002 since I have read many negative reports)

Thanks in advance for any help.

Tom

 

[NumbaJuan]

turn off the automatic updates

 

[spyordie007]

constantly recieving data wouldnt concern me quite nearly as much as constantly sending data.

-Spy

 

[grunjee]

Originally posted by: NumbaJuan
turn off the automatic updates

Also turn off "Background Intelligent Transfer Service". It seems to be another Automatic Updates in case you turn off AU.

 

[prosaic]

How is it that you know that you are constantly receiving data from the Internet? Just curious to know what signs you are seeing?

- prosaic

 

[tpeters]

On the Dial up Connection status it always shows that I am receiving data from the internet. Even when I am not doing anything I am receiving approximately several MG per hour.

Per the above I have eliminated the Automatic Update. However this has had no impact.

 

[prosaic]

Wow! That has to be annoying. On dial-up several megabytes per hour has to put a serious crimp in Internet performance.

I can't imagine that Windows XP itself is doing this. Have you installed any file sharing software (you know, peer-to-peer stuff like Kazaa)? You might try listing all of the programs listed in the "Programs" dialog of ZoneAlarm and whether local network and / or internet access is denied / allowed on each of lthem. ZoneAlarm has to be aware of this, and it should allow you to curtail the activity.

I guess I should also ask whether or not the Windows XP built-in Internet Connection Firewall is turned on.

- prosaic

 

[tpeters]

No there are no additional programs. Just Win XP, Microsoft Office 2000, Zone Alarm and AdAware, along with TaxCut.

Yes, the Win XP firewall is up.

 

[prosaic]

You really should look in the Programs listing in the ZoneAlarm control applet. If you have ZoneAlarm up and running then you have to have given whatever this process is permission to connect to the Internet. Tell us the programs listed in the ZoneAlarm applet, and what type of access they have (local, Internet, server).

- prosaic

 

Also, do you have your computers on a network connected using a hub? Here at college before I updated my network card drivers it showed that i was always recieving data from the network (I think it was becuase our hall is on a hub, not a switch or router).

Are you using a hub or something?

 

[-SpYrL-]

My XP will start up, and with no one even being logged on my cable modem will constantly be active also.

 

Originally posted by: -SpYrL-
My XP will start up, and with no one even being logged on my cable modem will constantly be active also.

Mine too. Don't worry about it. NO ONE IS HACKING YOU.

 

[Lobo1]

Try useing netstat to see the active connections.

 

[magomago]

Maybe it is Microsoft with all its DRM and anit piracy measures by checking files on your hdd?

 

[bolomite]

my guess is it's MS Messenger service. go to start --> run --> msconfig. Go to startup, uncheck 'msmsgs'

 

[prosaic]

There are a lot of reasonable (and one or two not-so-reasonable) possibilities being presented. But, guys, we already know there's a firewall in place. He could just be scientific about it and actually look to find out what has been given access to receive data from the Internet. If there's nothing out of the ordinary showing up in the firewall's allowed programs list and nothing weird happening in the logs (assuming that the firewall has been told to use logging) then there's nothing to worry about.

Tpeters did also say that the connection is dial-up and that it is the dial-up connection that's suggesting that several megabytes (megabits?) per hour are being received. (Megabits might be a bit more within the realm of reasonable behavior.) It just occurred to me that some people refer to that auto-connect (as opposed to always on) DSL crapola as dial-up. That's not the case here, is it?

At any rate, the fact that it's a dial-up connection that's reporting this reception of data seems to be a pretty clear indication that the machine is connected directly to a modem and not networked to it -- unless we're miscommunicating.

Seriously, some of the dial-up connections I've seen behaved this way all of the time. There was a service called Prodigy that used to constantly update their own proprietary software installations on their victims' (er, customers') systems -- much to the detriment of browsing performance and without so much as a "by your leave". It may be that AOL and others do this sort of thing, too. It has been a long time since I've touched a system with proprietary ISP-stuff on it -- other than to scrape it off, that is. Does anyone know if this sort of behavior is a possibility in this case?

- prosaic

 

[prosaic]

BTW, tpeters, I just want to say that your intuition about holding off on installing Norton Systemworks is absolutely right. I have to admit that I'm no fan of the product in the first place, but, regardless of how you feel about that set of utilities, now is not the time to complicate matters further. You need to get this issue straightened out first.

It's entirely possible that you are seeing something that is quite normal for your configuration. I think it unlikely, under the circumstances, that anything evil is going on. It's more likely that some doo-dad (like a chat client or an auto-update mechanism -- Windows not being the only software to do this stuff) is doing its thing.

- prosaic

 

[grunjee]

Originally posted by: grunjee

Also turn off "Background Intelligent Transfer Service". It seems to be another Automatic Updates in case you turn off AU.

Did you try this yet?

Also, which ISP do you use? I can tell you that MSN is terrible about this stuff, particularly the Messenger IM program.

 

[bsobel]

Originally posted by: magomago
Maybe it is Microsoft with all its DRM and anit piracy measures by checking files on your hdd?

Rumors start from stupid uninformed posts like that.

Bill

 

[bsobel]

I thought the Win XP Firewall was supposed to stop anything similar to this

XP's firewall protects you against incoming connections from outside your machine, not local applications connecting out.
Bill

 

[foxkm]

You all are suprised that XP does this? XP does a lot of network probing example: ever go into your printers and see auto printers
installed that are on your network? You think that XP just magically knows they exist.. No XP goes out on the network and searches for them. There are registery hacks to turn these things off.

Just the price you pay for using a "Media Enhanced" OS

-foxkm

 

[prosaic]

Oh, puhleeze. Can we stick with the subject? There's no registry hacking required. The user of a home network has the tools in this OS to allow or disallow whatever the heck he wishes without resorting to any registry -- can we call it editing? It's editing, not hacking, for criminey's sake! And if you think that Windows XP has gone out over his dial-up modem looking for printers on the Internet, well...

Tpeters has posted with what he feels may be an issue. We haven't even absolutely established that there is actually a problem, much less that the Evil Overlord Gates is comandeering his dial-up connection. I'd be willing to bet that tpeters would rather figure out this issue than hear conspiracy theories.

- prosaic

 

[Saltin]

There is no way the BITS (Windows Update) would be causing that amount of traffic. BITS is measured in kb, it's trivial.

To the original poster, could you do me a favour....

Go to Start>Run and type in regedit.

Expand the following key.

HK Local Machine>Software>Microsoft>Windows>Current Version>Run


Once you have the "Run" key highlighted, have a look in the right hand pane. Please list the keys and thier values that appear in the right hand side.

Thanks!

 

[RustyNale]

Originally posted by: prosaic
Oh, puhleeze. Can we stick with the subject? There's no registry hacking required. The user of a home network has the tools in this OS to allow or disallow whatever the heck he wishes without resorting to any registry -- can we call it editing? It's editing, not hacking, for criminey's sake! And if you think that Windows XP has gone out over his dial-up modem looking for printers on the Internet, well... Tpeters has posted with what he feels may be an issue. We haven't even absolutely established that there is actually a problem, much less that the Evil Overlord Gates is comandeering his dial-up connection. I'd be willing to bet that tpeters would rather figure out this issue than hear conspiracy theories. - prosaic

Right On!!!

Tpeters, HERE"S a better program than Ad-aware, it's called spybot--and like ad-aware, it's free. It picked up and removed cookies and registry settings that Ad-aware 6 missed. Question for you, have you checked your Zone alarm logs to see what program is accessing your comp? Have you tried shutting all access to the internet off, then enabling each program one at a time to see if any of them are the offender? As for Instant Messenger, you have several places that need to be shut off for it to be truly shut down-- Outlook, Outlook Express, IE, Services. Let us know..

 

[Doh!]

Windows Time will kick in as soon as you connect (unless you disable it of course).