# Spies in my modem **URL:** \ **Category:** Factual Questions\ **Created:** [March 9, 2000, 2:16am UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343 "2000-03-09T02:16:00Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [March 9, 2000, 2:16am UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343/1 "2000-03-09T02:16:00Z")
I’m sitting there reading an endless post in great debates, while composing one of my own. Ten minutes goes by and I haven’t clicked anything. All of a sudden my modem lights start flashing. I put the cursor on the modem icon, and the little bugger is sending and receiving like mad. I thought maybe it was a new ad loading, but nothing at all is going on, it’s just sending and receiving, what I don’t know, and it didn’t ask my permission. I’ve noticed this going on at other times too! If I disconnect, I automatically get the reconnect window as if I had started netscape while logged off. I click cancel and it comes up again. I’m getting real paranoid about this. Does anybody have any idea what’s going on here? ---
**Author:** ![Erroneous](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erroneous](https://boards.straightdope.com/u/Erroneous)\ **Post date:** [March 9, 2000, 4:15am UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343/2 "2000-03-09T04:15:00Z")
All I can say is that I’m having a lot of fun poking around your C:\picturesofmenaked\ directory. ---
**Author:** ![TheNerd](https://avatars.discourse-cdn.com/v4/letter/t/858c86/32.png) [@TheNerd](https://boards.straightdope.com/u/TheNerd)\ **Post date:** [March 9, 2000, 5:36am UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343/3 "2000-03-09T05:36:00Z")
If you’re running ICQ, your computer may be periodically updating the central server. There are a few other programs which might look on the internet every once in a while (like a mail-checker). Or you could have been hacked. 🙂 ---
**Author:** ![SoulFrost](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@SoulFrost](https://boards.straightdope.com/u/SoulFrost)\ **Post date:** [March 9, 2000, 6:54am UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343/4 "2000-03-09T06:54:00Z")
Probably just confirmation datagrams…nothing to worry about. Your ISP is just seeing if you’re really still there. Or, as was mentioned earlier, some other program may be updating itself (AltaVista, ICQ, and some MS products do this routinely.) -David ---
**Author:** ![neutron\_star](https://avatars.discourse-cdn.com/v4/letter/n/51bf81/32.png) [@neutron\_star](https://boards.straightdope.com/u/neutron_star)\ **Post date:** [March 9, 2000, 7:41am UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343/5 "2000-03-09T07:41:00Z")
To see who’s connected to your computer : Go to a DOS prompt. Type ‘netstat’ {without the apostrophe’s) While nerd & Soulfrost are probably correct, it could very well be that you have a Trojan, like NetBus or BackOrifice. Have you been running programs you got from IRC, Usenet, email, or suspicious web sites? * * * “Honey we’re recovering Christians.” –Tori Amos - _In the Springtime of his Voodoo_ ---
**Author:** ![EnigmaOne](https://avatars.discourse-cdn.com/v4/letter/e/d2c977/32.png) [@EnigmaOne](https://boards.straightdope.com/u/EnigmaOne)\ **Post date:** [March 9, 2000, 8:11am UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343/6 "2000-03-09T08:11:00Z")
A correction to neutron star’s post… Type ‘netstat -a’ then hit the enter(return) key. You should see something similar to the following listing: Active Connections Proto Local Address Foreign Address State TCP local host:1028 H1:0 LISTENING TCP local host:5190 H1:0 LISTENING TCP local host:1028 [tfep-fb8.dial.aol.com:16303](http://tfep-fb8.dial.aol.com:16303) ESTABLISHED TCP local host:137 H1:0 LISTENING TCP local host:138 H1:0 LISTENING TCP local host:nbsession H1:0 LISTENING TCP local host:2670 H1:0 LISTENING TCP local host:137 H1:0 LISTENING TCP local host:138 H1:0 LISTENING TCP local host:nbsession H1:0 LISTENING TCP local host:22701 H1:0 LISTENING TCP local host:22702 H1:0 LISTENING TCP local host:22703 H1:0 LISTENING TCP local host:22704 H1:0 LISTENING TCP local host:22705 H1:0 LISTENING TCP local host:22706 H1:0 LISTENING TCP local host:1029 H1:0 LISTENING TCP local host:1298 [vip-wa.proxy.aol.com:80](http://vip-wa.proxy.aol.com:80) TIME\_WAIT TCP local host:137 H1:0 LISTENING TCP local host:138 H1:0 LISTENING TCP local host:nbsession H1:0 LISTENING UDP local host:5190 _:_ UDP local host:nbname _:_ UDP local host:nbdatagram _:_ UDP local host:2670 _:_ UDP local host:nbname _:_ UDP local host:nbdatagram _:_ UDP local host:22701 _:_ UDP local host:22702 _:_ UDP local host:22703 _:_ UDP local host:22704 _:_ UDP local host:22705 _:_ UDP local host:22706 _:_ UDP local host:1029 _:_ UDP local host:nbname _:_ UDP local host:nbdatagram _:_ I’ll wager the formatting gets botched up in the html rendering, but you get the idea. Sorry, I know some of you hate AOL, but it’s not a hassle if you control it rather than letting it control you. ## If you poke around your computer a bit, you’ll find lots of other networking utilities that will give you good information: arp, nbtstat, ping and so on. – **Kalél** _Common ¢ for all ages…_ “Well, there was that thing with the Cheese-Wiz…but I’m feeling **much** better now!” – John Astin, Night Court ---
**Author:** ![handy](https://avatars.discourse-cdn.com/v4/letter/h/b5a626/32.png) [@handy](https://boards.straightdope.com/u/handy)\ **Post date:** [March 9, 2000, 3:46pm UTC](https://boards.straightdope.com/t/spies-in-my-modem/8343/7 "2000-03-09T15:46:00Z")
You might try the free online virus scanner from [mcafee.com](http://mcafee.com) Also, hit crtl alt del & see what programs are running.