How to determine source of suspicious internet activity?

[Doc]

Recently I've noticed activity I'd describe as suspicious. There's
some kind of internect data transfer activity even when I'm not doing
anything. even with ZoneAlarm and Windows firewall running, and ater
a scan and clean with AdAware with the latest update. I'm running
WinXP Media Center.

I also notice in ZoneAlarm there are several exe files with names like
3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
exmodul32.f.f.exe What are these? The exe gives me concern.

Thanks.

[pcbutts1]

Use crap cleaner http://www.ccleaner.com/download/downloadpage.aspx?f=3 run
it first in regular mode then in safe mode. Download Spybot and run that in
safe mode.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



"Doc" <docsavage20@yahoo.com> wrote in message
news:1185646569.957589.100140@19g2000hsx.googlegro ups.com...
> Recently I've noticed activity I'd describe as suspicious. There's
> some kind of internect data transfer activity even when I'm not doing
> anything. even with ZoneAlarm and Windows firewall running, and ater
> a scan and clean with AdAware with the latest update. I'm running
> WinXP Media Center.
>
> I also notice in ZoneAlarm there are several exe files with names like
> 3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
> exmodul32.f.f.exe What are these? The exe gives me concern.
>
> Thanks.
>

[Pennywise@DerryMaine.Gov]

Doc <docsavage20@yahoo.com> wrote:

>Recently I've noticed activity I'd describe as suspicious. There's
>some kind of internect data transfer activity even when I'm not doing
>anything. even with ZoneAlarm and Windows firewall running, and ater
>a scan and clean with AdAware with the latest update. I'm running
>WinXP Media Center.

Run TCPview to see what's going on.
http://www.microsoft.com/technet/sys...s/TcpView.mspx

>I also notice in ZoneAlarm there are several exe files with names like
>3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
>exmodul32.f.f.exe What are these? The exe gives me concern.

one of those show no results in Google (a bad thing) go into
ZA,programs and disallow those programs from calling out, and find
better anti-spyware.

--

Hidden figures revealed in The Last Supper painting.
http://www.news.com.au/gallery/0,236...007150,00.html

[Mr. Arnold]

"Doc" <docsavage20@yahoo.com> wrote in message
news:1185646569.957589.100140@19g2000hsx.googlegro ups.com...
> Recently I've noticed activity I'd describe as suspicious. There's
> some kind of internect data transfer activity even when I'm not doing
> anything. even with ZoneAlarm and Windows firewall running, and ater
> a scan and clean with AdAware with the latest update. I'm running
> WinXP Media Center.
>
> I also notice in ZoneAlarm there are several exe files with names like
> 3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
> exmodul32.f.f.exe What are these? The exe gives me concern.

You can use the tools in the link like Process Explorer, Active Ports and
TCPview. You can right click a process in the upper pane and go to
Properties. You can do it in the lower pane too if you are Showing All
Dll(s) in the lower pane, which will be everything that's hosted by a given
process.

http://preview.************/klw1
http://www.microsoft.com/technet/sys...s/default.mspx

[Plato]

Doc wrote:
>
> Recently I've noticed activity I'd describe as suspicious. There's
> some kind of internect data transfer activity even when I'm not doing
> anything. even with ZoneAlarm and Windows firewall running, and ater
> a scan and clean with AdAware with the latest update. I'm running
> WinXP Media Center.
>
> I also notice in ZoneAlarm there are several exe files with names like
> 3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
> exmodul32.f.f.exe What are these? The exe gives me concern.

None of those sound legit. I'd not let zonealarm access those files.

--
http://www.bootdisk.com/

[David H. Lipman]

From: "Doc" <docsavage20@yahoo.com>

| Recently I've noticed activity I'd describe as suspicious. There's
| some kind of internect data transfer activity even when I'm not doing
| anything. even with ZoneAlarm and Windows firewall running, and ater
| a scan and clean with AdAware with the latest update. I'm running
| WinXP Media Center.
|
| I also notice in ZoneAlarm there are several exe files with names like
| 3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
| exmodul32.f.f.exe What are these? The exe gives me concern.
|
| Thanks.


Please submit samples of the suspicious files to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all participating vendors.

You can also submit a suspect, one at a time, via the following email URL...
mailto:scan@virustotal.com?subject=SCAN

When you get the report, please post back the exact results.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Andy Walker]

Doc wrote:

>I also notice in ZoneAlarm there are several exe files with names like
>3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
>exmodul32.f.f.exe What are these? The exe gives me concern.

In addition to the excellent advice from David Lipman, you might want
to take a look at the following Google hit translation for
"3exmodul32f.i.exe".

http://preview.************/329v6j

[cattanack@yahoo.com]

Doc wrote:
> Recently I've noticed activity I'd describe as suspicious. There's
> some kind of internect data transfer activity even when I'm not doing
> anything. even with ZoneAlarm and Windows firewall running,

There's part of the problem, you are running two firewalls at one
time.

Overly hypersensitive security keeps people clueless.

Trust only one firewall.

Use it.

I like outpost free.

> and ater
> a scan and clean with AdAware with the latest update. I'm running
> WinXP Media Center.
>
> I also notice in ZoneAlarm there are several exe files with names like
> 3exmodul32f.i.exe that all have names with exmodul32f.i.ex or
> exmodul32.f.f.exe What are these? The exe gives me concern.

Ditch the ZA, it helped you understand a little, I guess, and has left
you clueless in the end.

> Thanks.

Get wireshark, a packet sniffer. Figure out how to use it.

New level of understanding.