"mto" <nobody@dontsendmeanyspam.com> wrote in message
news:C3CdnaCAs_06pa-iXTWJgA@seg.net...
<SNIP>
>>>Been wondering why on earth
> > > Windows Explorer would be trying to connect to 62.211.180.7:80 and
> > > 62.211.180.14:80 and why Messenger tries every 2 minutes or so to
> > > connect to my own IP#, port 1900, even though it is shut off every
> > > which way to Sunday.
> > >
> <SNIP>
> > >
> > > address digger says -
> > > <quote>
> > > dns 63.211.180.7
> > >
> > >
> > > 63.211.180.7 has dubious reverse DNS of unknown.Level3.net - which is
> > > a valid hostname, but not one that resolves to 63.211.180.7
> > >
> > >
> > >
> > > whois -h magic 63.211.180.7
> > > Trying whois -h whois.arin.net 63.211.180.7
> > >
> > > OrgName: Level 3 Communications, Inc.
> > > OrgID: LVLT
> > > Address: 1025 Eldorado Blvd.
> > > City: Broomfield
> > > StateProv: CO
> > > PostalCode: 80021
> > > Country: US
> <SNIP>
> > Have a search in Google>>Newsgroups>>NANAE on Level3... you will have a
> > nice surprise!
> >
> > Dick
>
> OK! So Level 3 is a known spam-haven. Wonderful - and the next
> question is why is Windows Explorer trying to phone home to them every
> couple of minutes -
>
> AdAware, SpyBot & antivirus updated an hour ago all read clean. Checked
all
> of the email accounts for html email or undeleted trash. Clean
everywhere.
> Found a spider.sav file in My Documents & investigated/deleted that.
After
> each of the above the warning reappeared, so it isn't any of those.
>
> Cleared all the files from Temp Internet and reduced cache size to 100 MB.
> About to go get a dedicated trojan detector.
>
> Further ideas?

In playing around I have found that the Windows Explorer outgoing connection
attempts seem to all be connected to page loading at MSNBC.com.