Just when I thought I had seen it all~~~$#@!?%

[Bovon]

Well, heres a new wrinkle guys..somebody explain this one, and you will be the tech of all time.

This afternoon, I had to do some outside chores, grocery store, post office, a couple other stores...a total of about 4 hours away from the house.

Before I left, I went off line and played a couple of games, then left the house. The machine was left on, but offline with no apps (IE/Outlook Express and other apps running).

When I came home, the machine was connected online with 3:50 something minutes showing.

Here is the clincher...I could not disconnect!!

I had control over the machine on all things except closing the online connection.

My ISP will disconnect any online service that has no activity over two hours!!

I had to close all apps I had running (I had opened several during this time before trying to disconnect from the net)

Still, I could not disconnect from the net, and apparently my ISP could not either (remember the 2 hour limit)

I had to reboot to get back to a normal windows service.

Anybody ever hear of such of a thing happening?...I sure as he** haven't!

[This message has been edited by Bovon (edited 07-30-2001).]

[Bovon]

Oh yeah, I forgot the obvious. There is no one here but myself!!.

I live alone. no kids...no dogs/cats/no nothing.

Ghosts?..hmmmmmmmmmmm

[Timbob505]

Maybe your computer was possessed? Perhaps its time to call Ghostbusters? I'm not sure, but I have seen strange things happen before...one time my tv decided to turn itself on. It turned on to a channel that doesn't exist like 1 or 2 I think, it turned up its own volume all the way so static sound was eminating all through the house, and the power button did not work to shut it off! I had to unplug it to get it to stop. I plugged it back in and it never did that again. Hopefully, yours is also a one-time event. If not, maybe its time for an exorcism? Good luck!

Timbob

[RLG]

Bovon:

I'd suggest that you quickly download and run AD-AWARE if you haven't already done so. Also check your modem log to see if anything was up/downloaded during that time, (check your cache folders as well) also call your isp or check their records to see whether you were on line with them. Your machine may have been online with someone else... in which case it IS possible that your machine was hijacked and it might have happened before. The essential thing is to ensure it can't happen again.

If you don't run a firewall like ZONEALARM you'd better get one soon as.

In the meantime I'd be inclined to pull the line connection until you know a bit more.

Doesn't sound too healthy to me.

Cheers, RLG


Oh, Timbob505: You got a cat in the house? Mine walks on the remote occasionally. Similar result!

[This message has been edited by RLG (edited 07-30-2001).]

[Fingers]

Do you have "The Cleaner" on that machine? If you do...I'd be running it; if you don't... I'd be downloading it.
http://www.moosoft.com/

[joerg]

I to have seen my electronics do strange things. Ocassionaly my stereo will turn on and start going through different cd tracks at random when it doesnt have a random listening feature. When i used netzero a few months back i also had strange things like that happen with my isp it would run for more than the 30mins you get with out auto closing. Found out that windows media player was downloading software.

[Krymson]

It's probably either an adware program like RLG said, or some type of virus/trojan. I don't think a hacker can hack your computer offline, so I dont think thats the problem http://www.sysopt.com/forum/wink.gif . Go run ad aware and go scan for viruses(try www.mcafee.com (http://www.mcafee.com) and do a test drive scan)

[robby3_16]

I know this is a long shot, but maybe your entire computer froze with the exception of the timer on the ISP. It has happened to me before, where my computer was froze but my ISP was running. Try checking with your ISP, like stated earlier, for logs of what was done through your connection, and if it was connected at all.

[Axel]

Are you running ISDN, a CABLE modem or DSL through your NIC?

Do you have Wake on LAN enabled?

Basically - someone pings the IP and your connection starts up -

That or I'd have to say you have a virus or a trojan going -

Get a firewall - almost ANY firewall and cut out any ports you aren't using -

black ice - norton firewall - there are a few others noted above -

[Bovon]

Straight 56K V90 land line connects...ran Norton, nothing shows up...hmmm, this is getting craizer by the minute. I have been offline sence about 3-4 pm, and alls well so far...

[awforrest]

I'm with RLG -- You've got spyware!! Almost no doubt.

Go here now:
www.lavasoft.de (http://www.lavasoft.de) www.zonelabs.com (http://www.zonelabs.com)

[Gomer]

Am I correct in assuming you have your password for dialup stored?

[Bovon]

Thanks, awforrest for the links...I'll do that.

Yep Gomer, my dialup password is saved on my machine...never heard of that causing any problems, but I can see where if some software was able to bring up the connect applet...it would need the password..so, guess I'll have to start typing it in every time, huh.

[Dudster]

Is your Dial-up set to "Connect Automatically"?

[This message has been edited by Dudster (edited 07-31-2001).]

[Bovon]

Okedoke...I will try the suggestions you guys have left here.

Yes, it was actually connected. I picked up the telephone to be sure, then I opened Outlook Express and IE, checked mail, surfed a couple of sites to see if I could find a glitch there anywhere...nothing found..all was normal.

Then, I tried to close the connection..nope, nada...would not disconnect. In retrospect, I could have pulled the plug for the modem, but didn't think about that...just brought up the shutdown screen and clicked shutdown...the machine hung at the shutdown splash screen..so I just reset. No further problems.

I do run ZoneAlarm, and the logs do not show any unusual activity.

I use NAV, and it was udated 6 days ago...but I have not run a through virus test yet...I'll do that today, after a new download of the latest definition files from Symantec.

Thanks for the input guys...sure as he** has baffled the 'cow chips' outta me.

[Bovon]

Dudster, no...I have to click on connect. If it were setup for an automatic connect, that probably would have answered the question.

I only had desktop running, and when I got back here and sat down at the computer...the first thing I noticed was my few floating-off ICQ names were onscreen..then I looked at the connection icon, it was showing online..I picked up the phone to actually hear the modem...it was there also.

[Wombat]

I run Norton Internet security 2001 and when I was first setting it up I would come home or just glance at the screen when I passed it and quite often there was a message saying that a particlar prog was trying to dial out and should it allow this to happen, I always said no.
Some games try to access the net to automaticaly get updates, and the same goes with financial progs and sometimes with download accelerator. I don't know if you are running such programs and I don't know if zone alarm has the disable auto dial the internet feature.
You may need to check the config in ZA.

Phew

[Llew]

Couldn't resist,I read down the thread...more things that come to mind...

I've occationally fumbled and dropped the TV remote,and had all kind of weirdness happen...restarting the tube,or pulling the batteries out of the remote was all I could do...

similar things have happened on the comp...due to some unrepeatable combination of key fumbles...thou I notice you didn't have occation for either of these,I'm just adding for referance.

One thing I've done,and it saved me from passing on the PrettyPark virus once...was to go into Network in Control Panel,and end the binding between TCP and "Windows Family Logon"...then Remove WFL from your network configuration. WFL is added automatically by Win9x Setup...wish I knew why,I've had no negative effects from removing it. Click Yes when Network asks if you're aware that your network is "incomplete" <more MS fear advertizing>...reboot to refresh your system...and enjoy the two fabulous benefits that this adjustment provides...first,I've noticed that my modem connections run a good 8-10% faster and smoother without WFL in the mix,up and download...second,eliminating WFL makes it impossible for your comp to store and recall your ISP password,you have to put it in manually every single time...or no connection.

I had the PrettyPark virus for over a week before I finally figured out why my Dial-Up Networking window was popping up and asking for my password every time I booted up...luckily for me I had made this alteration,especially since I auto-hide my taskbar...I mainly made the change because I resent anything MS automatically loads onto my machine...and later noticed the performance benefits.

If that doesn't help...call a Shaman http://www.sysopt.com/forum/wink.gif

Here's an interesting ditty...I work in stage lighting production-theatre,concerts,dance,commercial displays,private parties...and I once spoke to a friend who has a good 15 years experiance on me,he was the Head Carpenter on Emerson,Lake and Palmer's last big Tour,when the Live in Montreal LP was recorded,about 1980...he said that he once worked in a mid sized theatre,doing a fairly common style setup...he and 4-5 other techs were sitting in the house seats,eating lunch...when a Bar-6 of Par Cans suddenly came on by itself...we're talking 6000 watts of lighting,full on,right in their faces...and the bar was Not Plugged In...this is not a computerized luminaire in any way,it's basically a tin can with a car headlight in it,and there was no cable connecting to it...in fact,if memory serves,there was nothing else at all on that rigging baton other than the Bar-6,which had been loosely placed prior to the lunchbreak...it's supposed to be a true story,wish I'd been there... Llew


[This message has been edited by Llew (edited 08-02-2001).]

[rick525]

A few years ago, I had a similar experience not once but twice. The first was a download manager that had had a download interupted and the settings had it try to resume the download at some preset interval. I pay closer attention to these settings now.
The other was very similar; some app that was preset to look for updates an a pre-set calander. Norton is good for that, as are some others. Now I'm on a cable modem so email is constantly accessing my isp, but I run a firewall (Zone Alarm) that I can regulate what apps access the web and when.

[rick525]

A few years ago, I had a similar experience not once but twice. The first was a download manager that had had a download interupted and the settings had it try to resume the download at some preset interval. I pay closer attention to these settings now.
The other was very similar; some app that was preset to look for updates an a pre-set calander. Norton is good for that, as are some others. Now I'm on a cable modem so email is constantly accessing my isp, but I run a firewall (Zone Alarm) that I can regulate what apps access the web and when.

[KOOL.G]

I know one thing, and this that there is software made to keep internet connection conneted in case you get disconneted. do you such software in you sytem?

[Llew]

Wow,Bovon...that's special...

I'm afraid i didn't take the time to read down the thread...I'll just post the few things that came to mind quickly...1) any chance a power surge disrupted your comp in some way? 2) do you have a cable modem,or a network? mabe a hacker turned your machine into a proxy,did his business and then left? 3)...could a cat have walked across your keys? 4)...we see poltergeists alot in stage lighting production...de de dee dee.

[e.coli]

Hmm....sounds like a trojan. Some of the more unscrupulous (sp?) types may have planted something on your machine to go on line and visit one of those web sites that charges your phone number for time.
Best to check with your phone company to see if anything like that has occurred.
Happened to someone I know... very expensive.

[Bovon]

Fingers, I ran the moonsoft "The Cleaner" Trojan soft, and here is all it found.

MultiCQ
* d:\Utilities\Temp\XXXCK.EXE (grin, this one has been on my machine for 2-3 years)
Created: August 20, 1999 Modified: September 02, 1999
Description is unavailable.


Finjan Trojan DEMO
* h:\Download\PIEGATES.EXE
Created: June 01, 2000
Type: Harmless
This is a harmless demonstration trojan. (deleted anyway)

KOOL.G, yup... I know about the soft designed to keep you connected during soft downloads, but I don't have any of those.

Llew, thanks for your tips on the binding between TCP and "Windows Family Logon"...then Remove WFL , I think I will do that myself..

e.coli durn...I'll just bet that was expensive...I'll be keeping a much better check on my machine in the future, which will include either shutting down when I am not sitting right at it, or at least pull the plug on the modem.

Well, sence my first post, I have run NAV several times on all drives with the latest defininations, I have run the moonsoft trojan remover...nothing found there that could have created this fluke. I have pulled the plug on my modem at anytime I was offline (even overnight) and the 'ghost' hasn't come back...maybe it was ole Murphy?...that sucker seems to reside here, when he isn't screwing somebody else.

Thanks for all of the helpfull responses, I appreciate them all.

[Llew]

...ur welcome...my gut tells me it was some weird flip flop in the wall power...

[andonis]

I had seen that problem before, at least the part about not being able to disconnect... (not sure what the spontaneous connection was made from) I got a few used modems that I had installed on different sytems, 2 of them the relay inside of the modem would not disconnect when commanded by the software. Had to pull the jack out of the wall to disconect the ISP. I threw those modems away and replaced with new ones and never had the problem again.
Perhaps your modem's relay is sticking like mine?