Dial up connection auto dialling

[steveryan]

I manually created a new dial up account yesterday and ever since it has been trying to dial out on it's own. At first a screen would pop up and say that I or a program wanted to connect to www.level3.com www.1asia.com www.verio.com and various other sites. Today when I switched my pc on this started to happen again so I clicked settings when the box popped up and ticked the box so it wouldn't happen again until I logged back on. Re-booted a while later and now the connection does dial out on it's own without me touching a thing, then my firewall popped up with this message -





I've done a Google search for winsysvc and it returned no results, is it safe to allow it to connect? It's never happened before using DSL and other 56k connections. I've done a full scan with AVG and Adaware and they came up with nothing. Thanks in advance.

[tekkieman]

Sounds like a dialer program to me. Dowload and run Spybot (freeware).

http://spybot.eon.net.au/index.php?page=home

That should remove the program. You should also update the program before running it.

[northcat_8]

You can prevent it from doing that by checking your msconfig startup tab for unknown or questionable programs. You start up folder in your start menu. And if you go to your control panel, select Internet Options and on the connection tab, select "never dial a connection".

DO NOT LET IT CONNECT...you know the website, but it may be dialing an actual long distance phone number.

I would also run spybot and/or Lavasoft's Ad-aware 6.

I would also look through your add/remove programs list and see if anything in there looks suspicious and remove it if it does.

Damn spyware bastards...I wish I could reach out through the connection and choke them to death.

[Capmaster]

I got some spyware/adware loaded once that dialed a south Pacific island called Vanuatu. Luckily I was there and at the time I had dial-up with the modem speaker enabled. I quickly disconnected it. It was a 900 number. The phone co. was familiar with the scam and reversed it. Devious scum

[steveryan]

Thanks for the ideas but it's still happening. I'm 100% certain it's winsysvc (whatever that is) that is causing it. I just re-booted and the connection dialed out without me touching a thing even though I ticked the never dial a connection tab. I've deleted winsysvc in msconfig/startup but it always re-appears and i've created a rule in Kerio firewall to deny it access but it still trys. Getting mightily pissed off now

[Capmaster]

Thanks for the ideas but it's still happening. I'm 100% certain it's winsysvc (whatever that is) that is causing it. I just re-booted and the connection dialed out without me touching a thing even though I ticked the never dial a connection tab. I've deleted winsysvc in msconfig/startup but it always re-appears and i've created a rule in Kerio firewall to deny it access but it still trys. Getting mightily pissed off now

Did you take tekkieman's suggestion and try Spybot? It's worth a shot before you do anything drastic like reformatting or reloading Windows. I personally use Pest Patrol, but there's also Adaware and a few other new ones. They work wonders.

[iooi]

I've done a Google search for winsysvc and it returned no results, is it safe to allow it to connect? .

Found a bit on it Here Handy site to have bookmarked for problems like this... Strange google didnt throw any results up Didnt for me either..

You have the W32.Friendgreet.worm worm virus (not quite a virus – read on). This background task is installed by electronic greetings cards which users send to each other for fun unaware of its worm-like activities. At the time of writing, November 2002, there is a debate as to whether this should really be classified as a virus given that on receipt and opening of the electronic greeting cards, users are warned, by way of a License Agreement screen, of the fact that answering Yes will mean that they consent to the software installing itself on their PC and e-mailing persons in their Microsoft Outlook Contacts list with an e-mail inviting them to download FriendGreetings or related products. The problem is, very very few users actually read License Agreements, so most users end up clicking Yes and installing something on their PC which they probably would never have entertained having ! It is for this reason, and because of pressure from corporate customers, that antivirus software manufacturers such as Symantec are now treating WINSRVC as a virus.

Recommendation :
The above notwithstanding, every PC that we have ourselves dealt with and which had WINSRVC in its Task List, had problems, some of them extremely severe. Make no mistake, in our experience this is a nightmarish background task; so, virus or not a virus, you should remove WINSRVC from your system. Removing WINSRVC is not simple – this Symantec page shows you how to do it if you have Norton AntiVirus.

Hope that helps you.

[dxj40c]

If you use IE, try going to Tools/Internet Options/Connections and click "Never Dial A Connection", that works for software that tries to dial their home-sites for 'upgrades' when you go online. If it's a worm or dialer, your guess is as good as mine. Good Luck.

[hech54]

Most likely you have been Hijacked.
Go here:
http://www.spywareinfo.com/

Go to the forums section here after some reading....especially the FAQ sections:
http://www.spywareinfo.com/forums/

Run Spybot, CWShredder and Ad-Aware(disable Norton FIRST) to see it they find the problem. If it is not fixed.....download and run a program called Hijackthis and post it's log to the message board(the first one on the forums page) and someone will help you remove the offending program or dialer. Help does not come instantly but they WILL get to you.

READ THE FAQ FIRST before posting the log from Hijackthis to let them know you DID try Spybot, CWShredder and Ad-Aware prior to posting the log.

[glockjs]

quit looking at porn

ad aware might help too

[steveryan]

Think i've solved it, the problem was winsysvc. I found it in the Windows/system32 folder and renamed it. It doesn't appear to have had any adverse effect so far, touch wood Thanks for all the help.