Unknown data transfer from home PC to internet

Hi,

I use a WIN XP Pro, Dell Inspiron 8200, P4 2GHZ, 30 GB HDD, internal modem
as my primary home computer.

I have two problems 1) poor startup/shut down and computer response for
which I am referring to already published material on the usergroups. Problem
2 is that -8 months back before I had a firewall installed, I noticed that
the amount of data sent from my computer was always higher than the data
received - 4-5MB vs 2-3 MB for an half hour dial up session.

After installing Zone labs pro fire wall, the sent to received data became
normal ie sent 100KB, recieved -2-3 MB. However while checking for some
problem recently I had to disable the firewall and again the massive export
of data started.

Is it possible to find which program is sending the data and whereto? and
any way to solve the same.

thanks in advance

RIM

BTW I am yet to activate the SP2 upgrade.

imoorthy wrote:

Hi,

I use a WIN XP Pro, Dell Inspiron 8200, P4 2GHZ, 30 GB HDD, internal
modem as my primary home computer.

I have two problems 1) poor startup/shut down and computer response
for which I am referring to already published material on the
usergroups. Problem 2 is that -8 months back before I had a firewall
installed, I noticed that the amount of data sent from my computer was
always higher than the data received - 4-5MB vs 2-3 MB for an half
hour dial up session.

After installing Zone labs pro fire wall, the sent to received data
became normal ie sent 100KB, recieved -2-3 MB. However while
checking for some problem recently I had to disable the firewall and
again the massive export of data started.

Is it possible to find which program is sending the data and whereto?
and any way to solve the same.

thanks in advance

RIM

BTW I am yet to activate the SP2 upgrade.

Run through these troubleshooting steps to make sure your computer is
100% spyware and virus-free. Links follow the steps. It is crucial that
you do all scans in Safe Mode with updated tools.

1) Scan in Safe Mode with current version (not earlier than 2003)
antivirus using updated definitions.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

HijackThis is an excellent tool to discover and disable hijackers, but
it requires expert skill. See below for HijackThis links. A combination
of HijackThis and about:Buster works well in removing the about:Blank
homepage hijacker. Again, this is an expert tool and novices should get
help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore because malware will be in the Restore Points. With ME, you
must disable System Restore completely. With XP, you can delete all but
the most recent (presumably clean) System Restore point from the More
Options section of Disk Cleanup (Runcleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malwa

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtract..._download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/
http://www.spywareinfo.com/forums/

General:
http://forum.aumha.org/ - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"

thanks for your advice. I could download adaware only. when I tried to
download cwshredder I get an error message as below, Please help:

You are not authorized to view this page
You might not have permission to view this directory or page using the
credentials you supplied.

--------------------------------------------------------------------------------

If you believe you should be able to view this directory or page, please try
to contact the Web site by using any e-mail address or phone number that may
be listed on the www.aumha.org home page.

You can click Search to look for information on the Internet.




HTTP Error 403 - Forbidden
Internet Explorer


"Malke" wrote:

imoorthy wrote:

Hi,

I use a WIN XP Pro, Dell Inspiron 8200, P4 2GHZ, 30 GB HDD, internal
modem as my primary home computer.

I have two problems 1) poor startup/shut down and computer response
for which I am referring to already published material on the
usergroups. Problem 2 is that -8 months back before I had a firewall
installed, I noticed that the amount of data sent from my computer was
always higher than the data received - 4-5MB vs 2-3 MB for an half
hour dial up session.

After installing Zone labs pro fire wall, the sent to received data
became normal ie sent 100KB, recieved -2-3 MB. However while
checking for some problem recently I had to disable the firewall and
again the massive export of data started.

Is it possible to find which program is sending the data and whereto?
and any way to solve the same.

thanks in advance

RIM

BTW I am yet to activate the SP2 upgrade.

Run through these troubleshooting steps to make sure your computer is
100% spyware and virus-free. Links follow the steps. It is crucial that
you do all scans in Safe Mode with updated tools.

1) Scan in Safe Mode with current version (not earlier than 2003)
antivirus using updated definitions.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

HijackThis is an excellent tool to discover and disable hijackers, but
it requires expert skill. See below for HijackThis links. A combination
of HijackThis and about:Buster works well in removing the about:Blank
homepage hijacker. Again, this is an expert tool and novices should get
help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore because malware will be in the Restore Points. With ME, you
must disable System Restore completely. With XP, you can delete all but
the most recent (presumably clean) System Restore point from the More
Options section of Disk Cleanup (Runcleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malwa

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtract..._download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/
http://www.spywareinfo.com/forums/

General:
http://forum.aumha.org/ - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke
--
MS MVP - Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"