I upgraded from Windows 98 to Windows XP, and registered the upgrade.
Ever since, when I get online (56 K modem, and my ISP is Red Jelly Fish), something starts uploading from me immediately and won’t stop, even when I’m ‘idle.’
It’s gotten up to 60 megs uploaded in a session. It slows down my surfing by a factor of two.
How can I tell who is doing this? How do I stop it?
I should make this into a macro: Download and run Ad-Aware and Spybot S&D to clean out the spyware.
No one should be able to upload anything from you without your permission. Check your network settings and see that you have Printer and File Sharing turned off.
Do you have Windows Update set to upload updates automatically? (it’s often the default setting)
After a fresh install, there can be lots of ‘old’ updates (many of them useless or downright undesirable) that are nonetheless “new” compared to the version originally sold on the CD. IIRC, you can change this from the Control Panel (I use too many OSs to remamber exactly, but that’s the case for all the Windows before XP)
Do this NOW.
If spyware has placed a server on your computer, someone could be using your computer as a base to distribute illegal files… however “illegal” is defined in your jurisdiction.
And don’t forget ZoneAlarm, for the firewall that alerts you when something’s trying to send or receive.
Um, KP, if you install Windows XP, it may have a lot of updates that it needs to download, but that never involves uploading anything.
Beside AdAware and Spybot, as RealityChuck has suggested, you should also get and install ZoneAlarm, also a freebie.
Simulpost with Sunspace. We really should create some standard text for issuing these instructions, so we can just cut and paste! AdAware, Spybot, ZoneAlarm, keeping your antivirus software updated, and turning off the Messenger Service. It’s the same stuff, over and over. But if you think these questions get asked a lot here, you should see the help forums at my ISP!
Kerio and Outpost are two other great, free, firewalls if you don’t like ZoneAlarm or, if ZoneAlarm likes to crash on you like it did to me. Even if ZA didn’t crash, I still find I prefer the other two programs. Their interfaces are much better, IMHO.
Here are links for AdAware and Spybot Search & Destroy. When running them for the first time, make sure to check for updates.
Good advice, but not just when you run them for the first time. Unless I’m missing something, neither AdAware nor Spybot has an automatic updating feature - you need to click on the “check for updates” link in each one periodically, or you’ll never know about the new stuff. ZoneAlarm, on the other hand, can be set to look for new versions automatically, and let you know about them (in fact, ZoneAlarm just released a new version within the last week or so).
I think Adaware does automatically check for updates. But don’t quote me on that.
Early Out offer a good point worth repeating:
Downloading refers to transferring files from some other computer to your computer.
Uploading means transferring a file from your computer to a different computer.
Yes, a nitpick detail but using correct terminology goes a long way in identifying a computer problem and offering a solution.
OK, no it doesn’t. But it does have conveniently-located “Check For Updates” link.
It was definitely uploaded, and it’s fixed now.
Thanks.
Upload-ing.
:smack:
And now it keeps coming back. Rerunning adware removes it each time.
Am I right in reasoning that an app on my hard drive keeps recreating a cookie?
Either way, what can I do to track down this thing that keeps resurrecting?
bup does it come back on it’s own or are you restarting your computer?
Try running Ad-aware and Spybot back to back. Spybot had an update on the 11th - many times the updates are specifically for one piece of malware.
I downloaded both yesterday. I run both back-to-back, then reboot. Then I get online, and now I’ve noticed that right at the ten minutes of connection mark, it starts uploading like crazy.
Also (I feel dumb), I forgot to mention that sometimes when I’m not online I get this popup on my screen (I screen-captured and cropped it):
I realize it says Microsoft, but it seems to me it could easily be lying. When I look at active processes, I can’t tell which process created this dialog (does anybody know how to do that?).
Any more ideas? Any tests I could do (and thanks for all the help so far)?
Well, really quick…open up ZoneAlarm (or whatever firewall you are using) and see what programs have access to the Internet. Disable anything you don’t recognize.
Well, really quick…open up ZoneAlarm (or whatever firewall you are using) and see what programs have access to the Internet. Disable anything you don’t recognize.
It also looks like whatever it is re-installs itself every time you reboot.
That’s all I’m going to be good for…hopefully some real experts will show up shortly.
You should check your Registry for suspicious-looking programs set to run on bootup. Check under:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, RunOnce, and RunOnceEx (just to be sure)
and
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce.
Make sure there’s nothing blatantly out of place.
Also, check your Services control panel and make sure no evil services have been installed. (I’ve never seen this happen, but you can’t be too careful)
