Computer dials into ISP on boot up

[MorseLady]

Hi,

Since installing MS Loopback adaptor I now find that my XP computer dials up on boot and I don't want it to do this for security reasons. Sometimes when I go to close down the computer it dials up instead of going to the Standby/Turnoff/Restart buttons. I never configured the computer to dial up on boot so what has happened? I cannot find how to disable it DOH! but exams next week and I am stressed and possibly doing stipuid things

Is it the loopback adaptor which is messing up my XP Home? I only installed it for practice, intending to instal mand use it on my coursework computer running W2000 Server. I cannot get this loopback adaptor off my XP computer now, the delete option is greyed out. I can disable it but I want to delete it and it is beginning to annoy me :mad:

[NooNoo]

Check your ie settings, see if it's set to dial a connection when no connection present...

[Atodini]

Hi ML,

Just a couple of thoughts...

In Internet Explorer/Tools/Internet Options/Connections is the "Dial whenever a network connection is not present" box checked? If so uncheck it.

It should be possible to uninstall MS Loopback from safe mode.

Have fun!

John

;)

[MorseLady]

I checked but I have it set at never dial a connection. I have also found you have to click cancel about four times bfore the dial box stops coming up.

I have also discovered that for the third time my computer is dialling into premioum rate sites on its own, it was on my phone bill and NTL confirm it was an Internet premium number.

Is something funny going on? I am firewalled and have NAV and all my ports are al stealth but could I have a trojan somewhere?

I can't think straight at the moment with the exams next week feel like giving up computing altogether, I am really stressed and maybe missing simple things I should know.

I will try uni9nstalling loopback from Safe Mode and I have since thought what about using system restore to go back before I installed it? I note it did not create a restore point, something I would normally have done myself and just shows you how I am losing my grip over exam worry or maybe I was never any good anyway.

[NooNoo]

No, you have picked up a dialler - nasty things these, stealth at its worst. You need to run an updated Spybot (http://security.kolla.de/index.php?lang=en&page=download) - install it and before running it click on line, find updates, download updates and restart it, then run the search and destroy. Also pay a visit to www.anti-trojan.net.

And quit being hard on yourself.

[MorseLady]

Noo, I feel quite good about being right about having something on my computer and strangely enough I downloaded a few security applications from CNET last night and Spybot was one of them so I will install it pronto and see what I have on here. Adaware is not doing much of a job.

The premium rate call we did not make was made at a time when I am not online and I have been told that my ISP is well known for getting the charges wrong and adding calls.

I have edited this post to say that I have installed and run Spybot and there are a number of registry changes DSO Exploit which looks very much like the culprit. I also have a number of ordinary ad trackers.

[Radical Dreamer]

Set it to never dial a connection, and maybe set your security to not allow download on demand installs.

[MorseLady]

That is how it has been set all the time. The DSO Exploit appears to be a security hole in IE and I wonder if I have left myself open to exploitation because I did not put SP1 on after I reinstalled XP and I am using IE6 with no SP1 - I will put them on from my copies on disc immediately if it means my security is compromised.

I have just run the immunizer 150 products and the bad page blocker. This spybot is cool.

[Atodini]

SP1 would not have stopped you getting DSO Exploit!

There's been a epedemic of it among our customers recently and its an absolute pig to remove!!! It gets in just about everywhere. Somewhere there's a "mainstream" site distributing it as few of those infected are into porn / music / file swapping etc. It really screws up XP / Win 2K machines

Learn more about it here....

http://www.computing.net/security/wwwboard/forum/4774.html

and here for full technical info.

http://www.ciac.org/ciac/bulletins/l-125.shtml

There is no removal tool that I can find.

Hate to say it but the only sure way we've found is format / reinstall (after saving all your documents).

tip: Check all items you need to keep carefully! DSO Exploit really does infect all sorts of files.....

Good Luck

John

:sad:

[MorseLady]

I have just downloaded spywareblaster as recommended by spybot, this apparently has extra security for active X controls.

I had already made the decision to format and reinstall as I realise from my studies that this is a very serious threat and as I use Internet banking I cannot be too careful about security.

Mea Culpa for not reinstalling SP1 I will do this when I have reinstalled XP. Should I run spybot on all my backup CDs and my floppies and my NTFS storage partition and my other computer running W2000 Server and ME and a FAT32 storage partition and my husband's computer running ME?

I have learned a hard lesson today and thank you everyone.

[Atodini]

That is a very good idea. You really can't be too careful.

Whatever we tried, format / reinstall was the only permanent fix. Unfortunately none of the six machines we've had this last fortnight was networked so I cannot advise as to whether it can cross-infect. Hopefully someone else will know.

Incidentally every machine was running XP (home or pro) with SP1 installed!

John.

[MorseLady]

John, non of our computers are networked but I do swap CD ROMS between them and I also update my husband's ME from the updates I save to CD ROM and I sometimes give him pictures on floppy, although I tend to email them upstairs these days! I better check everything but where did it come from? I will explore the links given to me on here and try and avoid it happending again.

My computer is still dialing up on its own despite all the measures I have taken.

Just had a thought, I was getting these small grey dialogue boxes poping up offering me very offensive services - could this have anything to do with it? I have not had any for a few days.

John and Noo, thanks again.

[NooNoo]

My father ran up a £200 phone bill in two days - and he wasn't online. He was out at work. The dialler dialled the premium rate and it stayed online - when the connection broke it redialled. He knew nothing of it until he was trying to get on to compuserve and couldn't because the phone line was already in use. The only thing that uses that phone line is a fax machine!! Be very careful.

[MorseLady]

Noo, are you saying the trojan is in my phone line? Am I safe if the computers are disconnected and all the phone lines pulled out of the wall socket? I am really scared, we are pensioners and this could ruin us.

Would it be safer to go Broadband? Should I report it to my ISP. This is putting me right off the Internet.

[NooNoo]

No, I am saying that a dialler - not a trojan, a dialler can dial the internet without your permission and run up large phone bills.

Whether it is a trojan or not is another matter.

Broadband does have that huge advantage, the a dialler cannot use the phone line because the modem is connected to a network set up rather than a standard phone line.

Have you called NTL and ask if there has been any large charges and how much they are?

Did you go to anti-trojan.net and try their online check?

Yes, the easy way to stop the diallers is not have the phone line connected to the computer unless you intend to use it.

[MorseLady]

This is what scares me Noo, I had my phone bill this morning and there was a Premium Rate charge for a call made at a time I am rarely on the Internet or my computer and I had assumed it was a billing error but it has happened before. It was for nearly 20 quid for a twelve minute call, NTL say it is definitely Internet and they are getting their tech people to look at it and I have requested they let me know all the info -shall I call them again and tell them about the dialler? I do not make premium rate calls not even to vote from phone or Internet.

Shall I accept the very tempting offer of 150k Broadband installed for free and first month free and £16.99 a month after that? I am getting fed up with slow downloads anyway :bor:

Meantime, am I safe if my computer is not connected to the phone line?

[NooNoo]

Originally posted by MorseLady
This is what scares me Noo, I had my phone bill this morning and there was a Premium Rate charge for a call made at a time I am rarely on the Internet or my computer and I had assumed it was a billing error but it has happened before. It was for nearly 20 quid for a twelve minute call, NTL say it is definitely Internet and they are getting their tech people to look at it and I have requested they let me know all the info -shall I call them again and tell them about the dialler? I do not make premium rate calls not even to vote from phone or Internet.

Shall I accept the very tempting offer of 150k Broadband installed for free and first month free and £16.99 a month after that? I am getting fed up with slow downloads anyway :bor:

Meantime, am I safe if my computer is not connected to the phone line?

Yes go for the broadband at that price, it's a steal!! However you will want to network you computers together to give them all access. Just to make sure that it is good value for you, you should add up what you have spent on internet access for the last year.. divide by 12 and see if it is near £16.99 a month. 150k is not very fast, only 3 times that of dialup.... I would check out the deal a bit more to make sure.


If you tell them about the dialler, they may decide it's your fault, you are trying to get off that charge remember? :D

If you computer has no access to a phone line, it cannot dial.

[MorseLady]

Noo, I am on a flat rate charge of ten pounds a month surf anytime with a two hour timeout but can dial back in again. The service is not very good at times and I am a bit fed up with dropped connections and unable to do big downloads or hotlinking not to mention people complaining my phone is often engaged. Not sure how many hours I am online but at least three most days and often more.

The networking worries me because my husband is upstairs and I do not want cable all over the house. As he only goes on to retrieve email we have discussed him using the NTL pay as you go penny a minute service.

I will talk to NTL about the Broadband but I wonder if I would be better off going back to BT and using Freeserve. I notice that all the people on my Yahoo mailing list who hard bounce and have to be reset are on NTL so it must be an NTL problem. I have also found DNS errors, lost packets and strange routing when doing pings, traces etc on NTL. The mail server is always going down and sometimes you cannot get a connection. They did a so called core upgrade a few weeks ago and things have got worse since then.

[NooNoo]

Your call... NTL are overloaded.... is probably the kindest way to put it. NTL will be cable. If you go back to BT you could only have adsl.

You could also look to see if Blue Yonder operate in your area. that seems to be pretty good.

As for network cables all over the house... there are two ways around that, 1 is wireless and the other is a system where you use your power cables in the wall as the network cable. It would be pointless going to cable and then telling hubby he has to dialup!!

[MorseLady]

Ah, PLT Technology, my fellow radio hams hate it because it is said to generate noise on the radio bands and it is much written about and they are actively campaigning to have it made illegal both at national and international level but I believe the Radio Agency(part of the DTI) support it. I have an open mind on this at the moment but our wiring is old and we will be moving next year and then the house will be refurbished. Can you give me a link where I can learn more about what PLT can do for me please Noo?

Yes, the more I have progressed within my course the more I realise that NTL are compromised! The Internet is so important to me both as a technology and as a learning platform and isessential to some of my hobbies like ham radio, fractals, photography and web design that I would put ease of access, speed and security above price considerations. Take a look at the NTL Server Status page and if you have time the archives too and you will see how the same problems keep coming up and they never really resolve them http://www.ntl-isp.ntl.com/lookup/default.asp - I am not sure if I have a cookie for this site as a customer or if it is accessible by anyone.

I installed and ran Webroot Spy Sweeper last night andnow have it set to block spies and I am pleased to say that my scan this morning revealed I have no spies at the moment. I also have Spybot so might as well dump Adaware. With a Firewall and NAV I think I have done everything I can to protect myself and the computer is now booted with the modem cable out of the phone socket and the cable is pulled out once I have gone offline. I intend to take Atodini's advice and format and reinstall XP and same on my other compuiter if it is infected with a dialler too and I will then install all Service Patches and the updates I saved to disc from Windows Catalogue, instal a Firewall and Antivirus before going online.

I will look at Blue Yonder and BT and Freeserve and any other options and talk to some of my fellow students to see what they can get round here. I know NTL Broadband has a good name round here so could be they are deliberately making sialup poor to force us to go Broadband and they get more money :D

[Radical Dreamer]

I'd go for BB even though its slow for broadband.

1. No busy signals
2. No time to sign in
3. Always on
4. No phone charges
5. No tied up phone line
6. Faster speed (somewhat)
7. No cutoffs
8. No noisy dialing
9. etc etc etc