Win XP Constantly accessing internet

[tpeters]

Wow, looks like I might have started world war three.

Comments:

Yes, it is a dial-up connection. Earthlink is the ISP. I have been using them for five years and never saw this with Win 98.

The bottom line is that I am wondering if this is just "normal" for Win XP. I just cannot figure out what is being received constantly to the tune of 2 or 3 or 4 MG an hour and having no programs (IE or Outlook running).

I also thought of Messenger and disabled that but no change.

Although I am also no fan of Microsoft my question is more one of curiosity and concern that beleiving that the evil empire is out to get us.

By the way I have not installed SP1. Not sure if that has any impact.

Another issue. I'm not sure where all this data is going but it "mostly (?) appears to be going to the temporary internet files. However, it seems there might be additional areas where this data is going however I have not done a complete scientific test.

Hey, maybe it's as simple as updating the time.

Under HKEY_LOCAL MACHINE\Software\Microsoft\Windows\Current Version\Run:

Deafult (value not set)
Apoint C:\Program Files\Apoint\Apoint.exe
EM C:\Progra~1\Logitech\MouseW~1\System\EM_Exec.exe
HKSERVE.EXE C:\Program Files\Sony\Hot Key Utility\HKserve.exe
Logitech Utility Logi_MWX.exe
Mouse Suite 98 Daemon ICO.exe
MS Config C:\Windows\PC Health\Help Ctr\Binaries\Ms config.exe\auto


In regards to Zone Alarm:

The only programs with internet permission are IE and Outlook. No network permissions for any of the programs. However, even if I have no programs with any permissions it still shows that I am receiving data. So I am not really sure that the Dial Up Connection status identifying received data really represents data that was actually "received" by the computer (only in the sense that it created a temporary internet file). By the way it is mostly receiving data but I am also sending data so maybe it is just checking the time?

I am just puzzled that I am the only one that is experiencing this. I have found nothing on Microsoft's web site nor numerous other web sites regarding this. I am not necessarily paranoid but maybe I should be.

Thanks for all the help.

P.S. Keep it civil.

Tom

 

[Jeff7181]

I have cable, and I use a router... the lights on the modem constantly blink... but the lights on my router only blink when I send or recieve data... if I'm sitting here not doing anything, the lights on the router don't blink... I think the cable modem lights just indicate traffic on the public network... not specifically traffic to and from your computer.

 

[prosaic]

No, the time synchronization feature doesn't run constantly (be default). It connects once-per-week with one of the time standards (time.nist.gov or time.windows.com -- or others if you set it up that way).

You keep saying that you're receiving several "MG" per hour. What is an MG -- other than a British automobile from Morris Garages? 😉 Seriously, are we talking about megabits or megabytes? When you say that dial-up networking is reporting this constant data reception what do you mean by that? Please tell us exactly what you are seeing.

This occurs when you are just sitting idle, not browsing and not checking e-mail? Is your e-mail client set to check for e-mail every few minutes? That alone would account easily for several megabits per hour of traffic.

What's your home page setting? If you let the browser sit on a page that constantly updates you'll see constant traffic -- depending upon certain browser settings. Also, did you install the Earthlink software to establish your ISP connection, or did you just use the native DUN tools in Windows XP to set up the dial-up connection? I believe, though am not certain, that the Earthlink software has an auto-update function, too.

If your check of ZoneAlarm is correct, then only IE and OE can get to the Internet, and your anti-virus software can't update, and neither can the automatic PC Health thingy from Sony. BTW, that's an autoupdate mechanism, unless I'm badly mistaken.

I'm beginning to think that this is probably a non-issue. If ZoneAlarm is actually nailed down as tightly as it sounds, and if you don't see significant performance degradation in browsing, I'm thinking that you're probably seeing normal behavior from your Internet apps as you have them configured. It sounds as though you're getting a few megabits of traffic, which is a few hundred kilobytes. In an hour's time that's not much traffic. If you want more precise control over what's going on you're going to have to do some research. Perhaps you could experiment by tightening browser security settings or changing the frequency of OE checking for e-mail in your accounts.

BTW, the sniping regarding the FUD (evil Gates, etc.) amongst a couple of us above is par for the course online. None of it is directed at you. Some people seem determined to get in a shot about what they see as corporate ethics issues every time someone raises a network traffic issue. Unfortunately, that stuff just lowers the signal-to-noise ratio in a thread where someone is trying to actually learn something about what's going on with a network.

- prosaic

 

[tpeters]

Sorry MB not MG (yes Megabytes)

Again, what I am looking at is the Win XP Pro Dial Up Connection Status where it shows under activity Sent and Received information.

My home Page is MSN

No I did not install the Earthlink software

Again, I have no anti-virus software since I have not installed Norton System Works 2002 (due to all the negative comments).

Over the past 9 hours I had no programs open (NOTHING). Checking the Dial Up Connection status I see that I SENT .9 MB and RECEIVED over 22 MB!!!!!

Doing is disk cleanup I noted that there were 1.2 MB of temporary internet files and that the used spaces on my hard drive is now an additional 20.9 MB. Yes 20,922,369 bytes!!!!!

At that rate my little 12 Gig hard drive will be filled in a few months.

 

[prosaic]

Okay, that helps me see a little more clearly. Thanks.

If you have ZoneAlarm active and preventing any programs other than OE and IE from accessing the Internet, then I can think of only one type of obvious possibility to explain the 22 megabytes of data being downloaded over a period of 9 hours. It sounds as though someone has set a Web site or sites to be made available offline. I never use the feature, so I don't know where the files get stored. I thought that I had heard that storage occurred in the Temporary Internet Files, but it sounds as though your TIF contents only accounts for a small portion of the disk space that has been taken up in that time. Other than this sort of thing, almost any kind of request from your machine for the downloading of files from the Internet would involve programs that aren't showing up on your programs list in ZoneAlarm as having access to the Internet.

I guess there's always a possibility that some sort of malicious software might have found a way either to use the browser executable to do its direty work or to circumvent the firewall, but I think that's pretty unlikely -- especially if this is an up-to-date ZoneAlarm installation. It's disturbing that you don't have anti-virus running. There are choices other than NAV, if you don't want to use that, and some of those choices are freeware for personal use.

That software firewall should have been a useful diagnostic tool in this circumstance, and I'm not sure what to make of what you report about it. If you could find out WHERE that data is being stored on your drive and find out just what type of data it is I would think that sort of information would be useful.

- prosaic

 

[dawks]

It would seem the only obvious explanation would be that IE is subsribed to some websites and is downloading them for offline browsing.
Thats the only real logical possibility from what you've told us. Either that or your leaving something out.

Try going Start > Run > "cmd" > "netstat -a" and see what shows up.

Thats a list of all the current TCP/IP connections your computer is currently involved in. It will give us a better idea of whats going on.

Edit: To make it easier for you to show us that, you can type netstat -a > name.txt, that will output the contents of the command to a .txt file in the directory your currently in. By default its C:\Douments And Settings\%user%

 

[tpeters]

Active Connections

Proto Local Address Foreign Address State
TCP thomas:4209 www.google.com:http ESTABLISHED
TCP thomas:1024 localhost:3006 ESTABLISHED
TCP thomas:1034 localhost:3312 ESTABLISHED
TCP thomas:3006 localhost:1024 ESTABLISHED
TCP thomas:3312 localhost:1034 ESTABLISHED