choopa.net

3dslUserLoad · Post by **3dslUserLoad** » Sat Apr 23, 2011 12:21 am

TCPView is a tool which is able to log and show active connections and you can cancel some unwanted ones. But it requires some in-depth knowledge.

Zonealarm is a very powerful firewall software which can manage internet access of any running program on the computer in any way you like. I've been using an old version 6.x on my good old Win98 PC for many years now. But I don't like the WinXP version because it acts very restrictive according to the installed drivers which hinder access to the driver files itself and some registry keys and it bloates WinXP system folders with large inaccessible log files as well. But ZA won't help you until you have found the true culprit!

I would proceed as follows:
- Start TCPVIEW.
- Look at the listed connections. In WinXP the process (the EXE-file) using the malicious connection is listed too if it is not a virus or a trojan which tries to hide itself
- Locate the EXE file on your HD
- Try cancelling the process by the task manager.
- If you could locate the EXE, analyze any Autostart possibilities (in WinXP there are at least 3 of them: Autostart folder, Registry, Services); msconfig.exe -6 can help.

If you do have a trojan/virus, it will become very tricky to remove it by hand.

jjim · Post by **jjim** » Sat Apr 23, 2011 3:49 am

Thanks for all the advice. I hace spoken with my ISP who tell me that no proxy is possible via my connection . I use an Ipstar satellite conection in Australia. That may or may not be right , but they won't help in blocking it and with this type of connection I cannot access the modem. With reluctance they have changed my Static IP address - I have to see if this helps.
What is concerning is that Netlimiter does not show any usage for this activity.
What I need is someway to monitor and block Port 80 . I will try TCPView but any other suggestions much appreciated.

Post by **Meddle** » Sat Apr 23, 2011 4:45 am

Blocking port 80 is a bad idea. You're going to have to find the offending program/virus/trojan/whatever and remove it. If you do succeed in blocking port 80, you'll have to configure your browser to use another port.

3dslUserLoad · Post by **3dslUserLoad** » Sat Apr 23, 2011 11:32 pm

It doesn't matter what IP you have or what physical medium your connection to the "internet" uses - by radio, by wire, by beacon, by smoke signals or whatever.
Your provider isn't able to help you, even if he changes your static IP. The underlying problem is the configuration of your computer.
Meanwhile it seems for me it would be a good idea that you do a new clean install of WinXP only with all necessary hardware drivers on a separate partition (I recommend 2GByte FAT). With this you'll have an inviolated system you can backup on CD and which you can use as a base for further software installations.

Post by **Virgil** » Tue Apr 26, 2011 9:24 pm

Really, try spybot and hijackthis. If nothing helps go to a security forum, like kaspersky support one, and they will most likely help you step by step to eliminate all kind of nasties.