Random Dll's Attempting Internet Access

[JoeyJoeJoe]

This is very odd. but it seems random .dll files are trying to access the internet only when I am away from the computer for like 15 mins. They attempt this through rundll32.exe or whatever it's called.

I dont' think it's a virus because it's a new Win7 install and have not installed anything odd. Plus Avast has not picked anything up.

But there's no way all these .dll files are trying to access the internet while I'm gone. I mean most of the .dll files are from non-self-updating apps.

 

[JoeyJoeJoe]

I should add some of my setup info:

Avast Antivirus
Comodo NIS (Only firewall is Activated)
Windows 7 x64

 

[damian86]

could you post the name of those dll files?
you might be blocking your system with your firewall,when you install a new firewall it takes some time in recognising the system,untill you tell the firewall what to do.if allow them or block them.thats all.
i would be worried if id be getting unknown exe's instead of dll's...

 

[ibnsina]

Your system files might be corrupted in some way, try System File Checker. If it discovers that a protected file has been overwritten, it retrieves the correct version of the file.

Do as follows:-

Click Start (Windows Icon)

Type cmd in the search box

Right click on the cmd program and click on 'Run as administrator'

Type sfc /scannow

Press enter


This will take around 5-10 to scan all the system files.

....................................................................................

Also you might have lots of programs running in the background which you don’t use, you need to disable them, so that they don't load when you turn your pc on.

Do as follows:

Click Start (Windows Icon)

Type msconfig in the search box

Click on the msconfig icon to start program

Click on Startup [at the top]

Now all those programs listed are running in the background, you need go through them and untick the ones which is not required. Leave the ones which is labelled Microsoft Corporation, Intel Corporation, Sun Microsystems Inc. Whatever antivirus checker you are using leave that as well.

There are also lots of programmes running under the Services Tab, you can disable some of those too, again don’t alter Microsoft Corporation, Intel Corporation, Sun Microsystems Inc, Antivirus program.

Once you uptick the programs you don’t require at start-up, click Apply.

Restart your system.
..................................................................................................................

If you are using Internet explorer, Reset it.

Go to Control Panel, click Internet Options,
click Advanced [on top], then click on Reset box. click Reset again, then finally click OK

 

[JoeyJoeJoe]

Thanks for the replies. I tried what Ibinsina said and it didnt seem to help. But more testing will continue.

I'm starting to write down all the .dll files that attempt to access the net after about 15 mins of being off the computer. But like I said, it seems very random, and doesnt seem to make much sense which .dll is trying to get access. It's like it's just choosing a random .dll on my hard drive and attempting to get internet access through it.

The last one that tried was "atwork_xprint.dll". I do look these dlls up most of the time and lots of time it doesnt seem to make sense that they'd access the net. This one may be legit, but not sure. It's a quicken file.

But I've had .dlls from many different progs attempt to access the net, and it really seems like most of them should not have these background auto-updates going on.

 

[damian86]

That dll belongs to a program called Quicken for windows,i searched for it on google( you should do the same)
maybe it's not accessing to the internet,it's just running,and everytime you open that program it asks if whether you want to allow it or denny it.just google those name you don't recognise and you will find it out.

 

[JoeyJoeJoe]

Ya, my last post told you I knew what it was and what it was from. I do look up the .dlls.

And if quicken was open that'd be one thing, but it's not.

I had my first .exe file pop up too wanting internet access after 15 min or so of inactivity "MessageBox.exe"

 

[jedimasterben]

Sounds like spyware to me. Download a program called Malwarebytes and run the deep scan. It's one of the best spyware removers that I know of.

 

[Deleted member 217926]

Sounds like spyware to me. Download a program called Malwarebytes and run the deep scan. It's one of the best spyware removers that I know of.

^ +1

Malwarebytes and Spybot Search and Destroy in combination take care of just about anything.

 

[rodney_ws]

This was WAY more than I wanted to know about rundll32.exe...

http://www.howtogeek.com/howto/windows-vista/what-is-rundll32exe-and-why-is-it-running/

 

[jitpublisher]

Yep, you definetly have spyware issues. The 2 programs suggested above are very good at getting rid of it. After you have it all eliminated, Win 7 should do a pretty good job of keeping unwanted programs off your system, unless you do a lot of third party software installs from the internet and such. Then it is almost impossible to keep them out completely. But run those programs a couple times month, and you should be fine.

 

[JoeyJoeJoe]

Nah, sorry guys, you were all wrong
Thanks for the help though.
It's happening because of Microsoft's "Application Experience" doing some stuff even though I opted out of it.
Other people at Commodo's site had the prob too. Here's what fixed it:


Control Panel->Administrative Tools->Computer Management->Task Scheduler->Task Schedular Library->Microsoft->Windows->

Highlight "Application Experience" you should have AIT Agent and ProgramDataUpdater at the top. Right click on ProgramDataUpdater and select Disable

Credit to Quill for finding this little nugget Thumb Up

 

[Mousemonkey]

This topic has been closed by Mousemonkey