MSTask.exe - what's happening?

Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

I have disabled all automatic updating. I have disabled all planned tasks in
Windows.
Now and then I get an alert from Norton 2003 firewall:
"Microsoft Windows Task Scheduler (part of the Windows sub-system) is
attempting to access the internet."
Until now block I have blocked manually, because I scheduled nothing.
What could be going on?


--
regards,

|\ /|
| \/ |@rk
\../
\/os

mccm dot vos at hccnet dot nl
23 answers Last reply
More about mstask what happening
  1. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Do you have the .NET Framework installed?

    --
    George Hester
    _______________________________
    "Linea Recta" <mccm.vos@abc.net> wrote in message
    news:42d1354a$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > I have disabled all automatic updating. I have disabled all planned tasks
    in
    > Windows.
    > Now and then I get an alert from Norton 2003 firewall:
    > "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    > attempting to access the internet."
    > Until now block I have blocked manually, because I scheduled nothing.
    > What could be going on?
    >
    >
    >
    > --
    > regards,
    >
    > |\ /|
    > | \/ |@rk
    > \../
    > \/os
    >
    > mccm dot vos at hccnet dot nl
    >
    >
  2. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Not that I know of. How can I check?


    --
    regards,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl


    "George Hester" <hesterloli@hotmail.com> schreef in bericht
    news:eAUau6WhFHA.1460@tk2msftngp13.phx.gbl...
    > Do you have the .NET Framework installed?
    >
    > --
    > George Hester
    > _______________________________
    > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > news:42d1354a$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > > I have disabled all automatic updating. I have disabled all planned
    tasks
    > in
    > > Windows.
    > > Now and then I get an alert from Norton 2003 firewall:
    > > "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    > > attempting to access the internet."
    > > Until now block I have blocked manually, because I scheduled nothing.
    > > What could be going on?
    > >
    > >
    > >
    > > --
    > > regards,
    > >
    > > |\ /|
    > > | \/ |@rk
    > > \../
    > > \/os
    > >
    > > mccm dot vos at hccnet dot nl
    > >
    > >
    >
  3. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    One way to check is if you have Show all files and folders and not hide
    Hidden folders enabled you should have a folder Microsoft.NET somewhere on
    the system. You should also have a Framework applet in Control Panel |
    Administrative Tools.

    Also Windows Update will show you if you need it or need an update to it.
    It is in the Windows 2000 section not the Critical Updates section.

    http://v4.windowsupdate.microsoft.com/en/default.asp

    --
    George Hester
    _______________________________
    "Linea Recta" <mccm.vos@abc.net> wrote in message
    news:42d16122$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > Not that I know of. How can I check?
    >
    >
    >
    >
    > --
    > regards,
    >
    > |\ /|
    > | \/ |@rk
    > \../
    > \/os
    >
    > mccm dot vos at hccnet dot nl
    >
    >
    >
    > "George Hester" <hesterloli@hotmail.com> schreef in bericht
    > news:eAUau6WhFHA.1460@tk2msftngp13.phx.gbl...
    > > Do you have the .NET Framework installed?
    > >
    > > --
    > > George Hester
    > > _______________________________
    > > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > > news:42d1354a$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > > > I have disabled all automatic updating. I have disabled all planned
    > tasks
    > > in
    > > > Windows.
    > > > Now and then I get an alert from Norton 2003 firewall:
    > > > "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    > > > attempting to access the internet."
    > > > Until now block I have blocked manually, because I scheduled nothing.
    > > > What could be going on?
    > > >
    > > >
    > > >
    > > > --
    > > > regards,
    > > >
    > > > |\ /|
    > > > | \/ |@rk
    > > > \../
    > > > \/os
    > > >
    > > > mccm dot vos at hccnet dot nl
    > > >
    > > >
    > >
    >
    >
  4. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Indeed, it seems I have a folder 'Microsoft Windows-netwerk' visible in
    Windows Explorer, although I never use it.
    When I do a manual Windows update check, I see 'Microsoft .NET Framework
    versie 1.1' under the non-essential updates. It is quite large 23 MB and I
    don't need it.

    But is this the cause of the autonomous 'Microsoft Windows Task Scheduler'
    activity??
    I disabled all automatic updating and all tasks because I don't want any
    autonomous actions.


    --
    regards,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl


    "George Hester" <hesterloli@hotmail.com> schreef in bericht
    news:eKjOFBYhFHA.1412@TK2MSFTNGP09.phx.gbl...
    > One way to check is if you have Show all files and folders and not hide
    > Hidden folders enabled you should have a folder Microsoft.NET somewhere on
    > the system. You should also have a Framework applet in Control Panel |
    > Administrative Tools.
    >
    > Also Windows Update will show you if you need it or need an update to it.
    > It is in the Windows 2000 section not the Critical Updates section.
    >
    > http://v4.windowsupdate.microsoft.com/en/default.asp
    >
    > --
    > George Hester
    > _______________________________
    > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > news:42d16122$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > > Not that I know of. How can I check?
    > >
    > >
    > >
    > >
    > > --
    > > regards,
    > >
    > > |\ /|
    > > | \/ |@rk
    > > \../
    > > \/os
    > >
    > > mccm dot vos at hccnet dot nl
    > >
    > >
    > >
    > > "George Hester" <hesterloli@hotmail.com> schreef in bericht
    > > news:eAUau6WhFHA.1460@tk2msftngp13.phx.gbl...
    > > > Do you have the .NET Framework installed?
    > > >
    > > > --
    > > > George Hester
    > > > _______________________________
    > > > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > > > news:42d1354a$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > > > > I have disabled all automatic updating. I have disabled all planned
    > > tasks
    > > > in
    > > > > Windows.
    > > > > Now and then I get an alert from Norton 2003 firewall:
    > > > > "Microsoft Windows Task Scheduler (part of the Windows sub-system)
    is
    > > > > attempting to access the internet."
    > > > > Until now block I have blocked manually, because I scheduled
    nothing.
    > > > > What could be going on?
    > > > >
    > > > >
    > > > >
    > > > > --
    > > > > regards,
    > > > >
    > > > > |\ /|
    > > > > | \/ |@rk
    > > > > \../
    > > > > \/os
    > > > >
    > > > > mccm dot vos at hccnet dot nl
    > > > >
    > > > >
    > > >
    > >
    > >
    >
  5. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    No I don't think you have the Framework installed unless you have a prior
    version. But I don't think so. You really don't need it until you try to
    install something that requires it then you can install it if you want. Yes
    the size is prohibitive for most people.

    So getting back to your original concern.

    I'm not sure here why you are getting this activity. One thing you might
    try is to disconnect the machine from the Internet before you go to sleep
    but leave the machine on. Then in the morning check to see if there are any
    error message boxes up and/or look in the Event Viewer. We want to see if
    an error occurs when access to the Internet is attempted and it is not
    successful. You will need to enable its access in the Firewall first.
    Since you won't be connected it shouldn't be an issue.

    There is a folder for tasks in the Control Panel | Scheduled Tasks.

    --
    George Hester
    _______________________________
    "Linea Recta" <mccm.vos@abc.net> wrote in message
    news:42d18602$0$811$3a628fcd@textreader.nntp.hccnet.nl...
    > Indeed, it seems I have a folder 'Microsoft Windows-netwerk' visible in
    > Windows Explorer, although I never use it.
    > When I do a manual Windows update check, I see 'Microsoft .NET Framework
    > versie 1.1' under the non-essential updates. It is quite large 23 MB and I
    > don't need it.
    >
    > But is this the cause of the autonomous 'Microsoft Windows Task Scheduler'
    > activity??
    > I disabled all automatic updating and all tasks because I don't want any
    > autonomous actions.
    >
    >
    >
    > --
    > regards,
    >
    > |\ /|
    > | \/ |@rk
    > \../
    > \/os
    >
    > mccm dot vos at hccnet dot nl
    >
    >
    >
    >
    >
    >
    > "George Hester" <hesterloli@hotmail.com> schreef in bericht
    > news:eKjOFBYhFHA.1412@TK2MSFTNGP09.phx.gbl...
    > > One way to check is if you have Show all files and folders and not hide
    > > Hidden folders enabled you should have a folder Microsoft.NET somewhere
    on
    > > the system. You should also have a Framework applet in Control Panel |
    > > Administrative Tools.
    > >
    > > Also Windows Update will show you if you need it or need an update to
    it.
    > > It is in the Windows 2000 section not the Critical Updates section.
    > >
    > > http://v4.windowsupdate.microsoft.com/en/default.asp
    > >
    > > --
    > > George Hester
    > > _______________________________
    > > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > > news:42d16122$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > > > Not that I know of. How can I check?
    > > >
    > > >
    > > >
    > > >
    > > > --
    > > > regards,
    > > >
    > > > |\ /|
    > > > | \/ |@rk
    > > > \../
    > > > \/os
    > > >
    > > > mccm dot vos at hccnet dot nl
    > > >
    > > >
    > > >
    > > > "George Hester" <hesterloli@hotmail.com> schreef in bericht
    > > > news:eAUau6WhFHA.1460@tk2msftngp13.phx.gbl...
    > > > > Do you have the .NET Framework installed?
    > > > >
    > > > > --
    > > > > George Hester
    > > > > _______________________________
    > > > > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > > > > news:42d1354a$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > > > > > I have disabled all automatic updating. I have disabled all
    planned
    > > > tasks
    > > > > in
    > > > > > Windows.
    > > > > > Now and then I get an alert from Norton 2003 firewall:
    > > > > > "Microsoft Windows Task Scheduler (part of the Windows sub-system)
    > is
    > > > > > attempting to access the internet."
    > > > > > Until now block I have blocked manually, because I scheduled
    > nothing.
    > > > > > What could be going on?
    > > > > >
    > > > > >
    > > > > >
    > > > > > --
    > > > > > regards,
    > > > > >
    > > > > > |\ /|
    > > > > > | \/ |@rk
    > > > > > \../
    > > > > > \/os
    > > > > >
    > > > > > mccm dot vos at hccnet dot nl
    > > > > >
    > > > > >
    > > > >
    > > >
    > > >
    > >
    >
    >
  6. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    On Sun, 10 Jul 2005 22:33:15 +0200, "Linea Recta" <mccm.vos@abc.net>
    wrote:

    >Indeed, it seems I have a folder 'Microsoft Windows-netwerk' visible in
    >Windows Explorer, although I never use it.
    >When I do a manual Windows update check, I see 'Microsoft .NET Framework
    >versie 1.1' under the non-essential updates. It is quite large 23 MB and I
    >don't need it.
    >
    >But is this the cause of the autonomous 'Microsoft Windows Task Scheduler'
    >activity??
    >I disabled all automatic updating and all tasks because I don't want any
    >autonomous actions.

    Go to the control panel and click on scheduled tasks. You should have
    an icon "add scheduled tasks" if there is a second task icon, right
    click and delete. This will stop programs from running online checks
    for updates etc which is probably what is happening.


    --
    Colyn Goodson

    http://home.swbell.net/colyng
    http://www.colyngoodson.com
  7. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Linea Recta wrote:
    > I have disabled all automatic updating. I have disabled all planned tasks in
    > Windows.
    > Now and then I get an alert from Norton 2003 firewall:
    > "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    > attempting to access the internet."
    > Until now block I have blocked manually, because I scheduled nothing.
    > What could be going on?

    Some program is using Task Scheduler to access the 'net, but you've
    blocked TS, so Norton very kindly is telling you that TS is being used.
    You have to decide whether the program in question should be allowed
    access to the 'net - but you'll have to find it first. Go to the running
    processes window, and check. Not that running porcesses tells you much,
    since it just lists the active modules, many of which have names that
    don't give you any clue to the program they're a part of, but it's a
    place to start. Look especially for processes initiated by the programs
    that start at boot.

    Some of your programs may be set to look for updates automatically, many
    programs actually get Help from the 'net, and so on. Personally, I
    detest this "integration" of my stand-alone machine with the 'net, and
    like you have blocked just about everything. But once in a while you
    have to let a program do its thing.

    Happy hunting. :-)
  8. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    On Mon, 11 Jul 2005 09:15:20 -0400, Wolf Kirchmeir
    <wwolfkir@sympatico.ca> wrote:

    >Linea Recta wrote:
    >> I have disabled all automatic updating. I have disabled all planned tasks in
    >> Windows.
    >> Now and then I get an alert from Norton 2003 firewall:
    >> "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    >> attempting to access the internet."
    >> Until now block I have blocked manually, because I scheduled nothing.
    >> What could be going on?
    >
    >Some program is using Task Scheduler to access the 'net, but you've
    >blocked TS, so Norton very kindly is telling you that TS is being used.
    >You have to decide whether the program in question should be allowed
    >access to the 'net - but you'll have to find it first. Go to the running
    >processes window, and check. Not that running porcesses tells you much,
    >since it just lists the active modules, many of which have names that
    >don't give you any clue to the program they're a part of, but it's a
    >place to start. Look especially for processes initiated by the programs
    >that start at boot.
    >
    >Some of your programs may be set to look for updates automatically, many
    >programs actually get Help from the 'net, and so on. Personally, I
    >detest this "integration" of my stand-alone machine with the 'net, and
    >like you have blocked just about everything.

    Same for me.

    > But once in a while you
    >have to let a program do its thing.
    >
    >Happy hunting. :-)

    --
    "Today, the theory of evolution is an accepted fact
    for everyone but a fundamentalist minority, whose
    objections are based not on reasoning but on
    doctrinaire adherence to religious principles"
    -- James D. Watson
  9. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Taking in George's help as well ...

    1) You can tell if you have Microsoft .Net installed as follows: Start,
    Settings, Control Panel, Add/Remove Programs. I have listed ...
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB886903)

    If you have any version installed, then run any updates required to ensure
    it's the latest version.

    2) It might be useful to work out who's trying to contact whom via Task
    Scheduler, this might reveal a trojan/virus. Do the messages from Norton
    give an IP address? If your Norton firewall doesn't give the IP address by
    default, you may be able to configure it to, or it might be in the logs, or
    it might if you do whatever is its equivalent of locking the internet. Once
    you have an IP, check it out here (you may have to register, but it's free
    at no risk) ...
    http://www.whois.sc/
    .... or if that reveals nothing useful, in a DOS box do ...
    tracert <IP Address> (<> are field delimiters, don't type them)
    .... and work backwards form the last server listed and named. The server
    will usually have a domain, say 'blah.blah.blah.suspect.net'. If this
    domain is suspicious, eg: it had has nothing to do with any 'trustworthy'
    source such as Microsoft or your AV or firewall software, then start looking
    for a trojan/virus. Note though that much legitimate software such as
    Windows Media Player, Logitech mouse drivers, etc, can periodically check
    for an update, though they should and usually do make this an explicit
    option at installation time. If you find you have such, look in the
    software options to switch the feature off.

    Note another use for this technique ...

    Occasionally spam goes to an internet address to fetch a picture trying to
    sell you watches and doubtless you know what else (:-)! To report it, you
    need a domain and/or an IP, but examining the HTML source in Outlook doesn't
    always reveal what site is being accessed. The way I trace this is to
    engage the internet lock in the firewall, Zone Alarm, then click on the mail
    to preview or open it. ZA throws up a message box detailing what IP was
    being accessed.

    "Linea Recta" <mccm.vos@abc.net> wrote in message
    news:42d1354a$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > I have disabled all automatic updating. I have disabled all planned tasks
    in
    > Windows.
    > Now and then I get an alert from Norton 2003 firewall:
    > "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    > attempting to access the internet."
    > Until now block I have blocked manually, because I scheduled nothing.
    > What could be going on?
  10. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    "Colyn" <me@thephotofactory.com> schreef in bericht
    news:f2a3d1pb3lr1e88s3lpukgj52k5gs6b67o@4ax.com...
    > On Sun, 10 Jul 2005 22:33:15 +0200, "Linea Recta" <mccm.vos@abc.net>
    > wrote:
    >
    > >Indeed, it seems I have a folder 'Microsoft Windows-netwerk' visible in
    > >Windows Explorer, although I never use it.
    > >When I do a manual Windows update check, I see 'Microsoft .NET Framework
    > >versie 1.1' under the non-essential updates. It is quite large 23 MB and
    I
    > >don't need it.
    > >
    > >But is this the cause of the autonomous 'Microsoft Windows Task
    Scheduler'
    > >activity??
    > >I disabled all automatic updating and all tasks because I don't want any
    > >autonomous actions.
    >
    > Go to the control panel and click on scheduled tasks. You should have
    > an icon "add scheduled tasks" if there is a second task icon, right
    > click and delete. This will stop programs from running online checks
    > for updates etc which is probably what is happening.


    I have 3 tasks there, they were created by Norton Apps, but I had decided to
    just disable them, to make my actions reversible.

    These are:
    Norton Antivirus - Scan My computer
    Norton Systemworks One Button Checkup
    Symantec NetDetect

    But as goes for all MS stuff, I have also disabled all automatic updating
    and other activities for all Norton Apps.
    And I always disable automatic updating for all other programs.


    --
    regards,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl
  11. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    "Java Jive" <java@evij.com> schreef in bericht
    news:42d29046$1@news.greennet.net...
    > Taking in George's help as well ...
    >
    > 1) You can tell if you have Microsoft .Net installed as follows:
    Start,
    > Settings, Control Panel, Add/Remove Programs. I have listed ...
    > Microsoft .NET Framework 1.1
    > Microsoft .NET Framework 1.1 Hotfix (KB886903)


    I don't seem to have these installed.


    >
    > If you have any version installed, then run any updates required to ensure
    > it's the latest version.
    >
    > 2) It might be useful to work out who's trying to contact whom via Task
    > Scheduler, this might reveal a trojan/virus. Do the messages from Norton
    > give an IP address? If your Norton firewall doesn't give the IP address
    by
    > default, you may be able to configure it to, or it might be in the logs,
    or
    > it might if you do whatever is its equivalent of locking the internet.
    Once
    > you have an IP, check it out here (you may have to register, but it's free
    > at no risk) ...
    > http://www.whois.sc/
    > ... or if that reveals nothing useful, in a DOS box do ...
    > tracert <IP Address> (<> are field delimiters, don't type them)
    > ... and work backwards form the last server listed and named. The server
    > will usually have a domain, say 'blah.blah.blah.suspect.net'. If this
    > domain is suspicious, eg: it had has nothing to do with any 'trustworthy'
    > source such as Microsoft or your AV or firewall software, then start
    looking
    > for a trojan/virus. Note though that much legitimate software such as
    > Windows Media Player, Logitech mouse drivers, etc, can periodically check
    > for an update, though they should and usually do make this an explicit
    > option at installation time. If you find you have such, look in the
    > software options to switch the feature off.


    That sounds very technical, but I have found the alerts in the Norton log:
    (note I removed my IP)

    10-07-2005 16:48:39
    Details: This one time, the user has chosen to "block" communications
    Inbound TCP connection
    Local address,service is (VOS-Q8MY1RJB257(myIP),1025)
    Remote address,service is (62.47.245.204,3990)
    Process name is "C:\WINNT\system32\MSTask.exe"
    ---------------------------------
    09-07-2005 18:09:53
    Details: This one time, the user has chosen to "block" communications
    Inbound TCP connection
    Local address,service is (VOS-Q8MY1RJB257(myIP),1025)
    Remote address,service is (62.55.107.103,2911)
    Process name is "C:\WINNT\system32\MSTask.exe"


    >
    > Note another use for this technique ...
    >
    > Occasionally spam goes to an internet address to fetch a picture trying to
    > sell you watches and doubtless you know what else (:-)! To report it, you
    > need a domain and/or an IP, but examining the HTML source in Outlook
    doesn't
    > always reveal what site is being accessed. The way I trace this is to
    > engage the internet lock in the firewall, Zone Alarm, then click on the
    mail
    > to preview or open it. ZA throws up a message box detailing what IP was
    > being accessed.


    I'll see what I can do using your techniques.


    --
    thanks,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl


    >
    > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > news:42d1354a$0$805$3a628fcd@textreader.nntp.hccnet.nl...
    > > I have disabled all automatic updating. I have disabled all planned
    tasks
    > in
    > > Windows.
    > > Now and then I get an alert from Norton 2003 firewall:
    > > "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    > > attempting to access the internet."
    > > Until now block I have blocked manually, because I scheduled nothing.
    > > What could be going on?
    >
    >
  12. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    "Wolf Kirchmeir" <wwolfkir@sympatico.ca> schreef in bericht
    news:tfuAe.1323$6e3.163797@news20.bellglobal.com...
    > Linea Recta wrote:
    > > I have disabled all automatic updating. I have disabled all planned
    tasks in
    > > Windows.
    > > Now and then I get an alert from Norton 2003 firewall:
    > > "Microsoft Windows Task Scheduler (part of the Windows sub-system) is
    > > attempting to access the internet."
    > > Until now block I have blocked manually, because I scheduled nothing.
    > > What could be going on?
    >
    > Some program is using Task Scheduler to access the 'net, but you've
    > blocked TS, so Norton very kindly is telling you that TS is being used.


    Yes, the Norton firewall is proving to be useful.


    > You have to decide whether the program in question should be allowed
    > access to the 'net - but you'll have to find it first. Go to the running
    > processes window, and check. Not that running porcesses tells you much,
    > since it just lists the active modules, many of which have names that
    > don't give you any clue to the program they're a part of, but it's a
    > place to start. Look especially for processes initiated by the programs
    > that start at boot.
    >
    > Some of your programs may be set to look for updates automatically, many
    > programs actually get Help from the 'net, and so on. Personally, I
    > detest this "integration" of my stand-alone machine with the 'net, and
    > like you have blocked just about everything. But once in a while you
    > have to let a program do its thing.


    If there is any updating to be done I gladly do so manually, at a time
    convenient to me, and not e.g. when it's disturbing the capture of an
    important video. I think these automatic processes are a stupid invention
    and it takes ages to hunt them down in all kinds of places to disable them.
    But I noticed these alerts are only appearing very recently.


    >
    > Happy hunting. :-)


    --
    thanks,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl
  13. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Noting that your NNTP Posting Host is ...
    http://www.whois.sc/62.251.76.14
    Netherlands - Noord-holland - Amsterdam - Isp Dsl-vi
    tracert gives:
    adm-b2-pos2-0.telia.net [213.248.64.190]
    .... which is in the same top-level address band as both of these, I wonder
    if this is just some keep-alive signal from your network?

    1) Are you running bespoke connection software provided by your ISP?
    2) Are you using dialup or broadband?

    I would most expect a keep-alive signal using dialup and running bespoke
    software provided by your ISP, but I think that would be outbound, whereas
    yours are inbound. Perhaps your ISP's servers generate a keep-alive, in
    which case I think that would be inbound - ISTR NTL used to do that when I
    used to connect via their cable modem broadband, but I got rid of them
    several years ago now. I suggest you ring your ISP, probably technical
    support, and ask if they know anything about these attempted connections.

    "Linea Recta" <mccm.vos@abc.net> wrote in message
    news:42d2b65e$1$811$3a628fcd@textreader.nntp.hccnet.nl...
    >
    > 10-07-2005 16:48:39
    > Details: This one time, the user has chosen to "block" communications
    > Inbound TCP connection
    > Local address,service is (VOS-Q8MY1RJB257(myIP),1025)
    > Remote address,service is (62.47.245.204,3990)
    > Process name is "C:\WINNT\system32\MSTask.exe"

    http://www.whois.sc/62.47.245.204
    Austria - Vorarlberg - Dornbirn - Highway Customers
    tracert gives:
    M687P012.adsl.highway.telekom.at [62.47.245.204]

    > ---------------------------------
    > 09-07-2005 18:09:53
    > Details: This one time, the user has chosen to "block" communications
    > Inbound TCP connection
    > Local address,service is (VOS-Q8MY1RJB257(myIP),1025)
    > Remote address,service is (62.55.107.103,2911)
    > Process name is "C:\WINNT\system32\MSTask.exe"

    http://www.whois.sc/62.55.107.103
    United Kingdom - Mways-bigdial
    tracert gives:
    rdsl-lond-uk02.nw.mediaways.net [62.55.96.197]
  14. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    "Java Jive" <java@evij.com> schreef in bericht
    news:42d30039$1@news.greennet.net...
    > Noting that your NNTP Posting Host is ...
    > http://www.whois.sc/62.251.76.14
    > Netherlands - Noord-holland - Amsterdam - Isp Dsl-vi
    > tracert gives:
    > adm-b2-pos2-0.telia.net [213.248.64.190]
    > ... which is in the same top-level address band as both of these, I wonder
    > if this is just some keep-alive signal from your network?
    >
    > 1) Are you running bespoke connection software provided by your ISP?


    I never heard of bespoke. I'm using an ADSL modem (SpeedTouch 330) connected
    to USB port and with its Alcatel software.


    > 2) Are you using dialup or broadband?


    Broadband. (Though I also have a dialup modem installed for faxing and
    electronic banking purposes, and I have a dial up internet connection for
    reserve).


    >
    > I would most expect a keep-alive signal using dialup and running bespoke
    > software provided by your ISP, but I think that would be outbound, whereas
    > yours are inbound. Perhaps your ISP's servers generate a keep-alive, in
    > which case I think that would be inbound - ISTR NTL used to do that when
    I
    > used to connect via their cable modem broadband, but I got rid of them
    > several years ago now. I suggest you ring your ISP, probably technical
    > support, and ask if they know anything about these attempted connections.


    Just got another one this evening:
    11-07-2005 20:1324
    Details: This one time, the user has chosen to "block" communications
    Inbound TCP connection
    Local address,service is (VOS-Q8MY1RJB257(myIP),1025)
    Remote address,service is (62.127.26.94,2276)
    Process name is "C:\WINNT\system32\MSTask.exe"


    When I get this alert again, I wil make the firewall block the attempts
    definitely.


    --
    regards,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl


    >
    > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > news:42d2b65e$1$811$3a628fcd@textreader.nntp.hccnet.nl...
    > >
    > > 10-07-2005 16:48:39
    > > Details: This one time, the user has chosen to "block" communications
    > > Inbound TCP connection
    > > Local address,service is (VOS-Q8MY1RJB257(myIP),1025)
    > > Remote address,service is (62.47.245.204,3990)
    > > Process name is "C:\WINNT\system32\MSTask.exe"
    >
    > http://www.whois.sc/62.47.245.204
    > Austria - Vorarlberg - Dornbirn - Highway Customers
    > tracert gives:
    > M687P012.adsl.highway.telekom.at [62.47.245.204]
    >
    > > ---------------------------------
    > > 09-07-2005 18:09:53
    > > Details: This one time, the user has chosen to "block" communications
    > > Inbound TCP connection
    > > Local address,service is (VOS-Q8MY1RJB257(myIP),1025)
    > > Remote address,service is (62.55.107.103,2911)
    > > Process name is "C:\WINNT\system32\MSTask.exe"
    >
    > http://www.whois.sc/62.55.107.103
    > United Kingdom - Mways-bigdial
    > tracert gives:
    > rdsl-lond-uk02.nw.mediaways.net [62.55.96.197]
    >
    >
  15. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Linea Recta wrote:
    > "Java Jive" <java@evij.com> schreef in bericht
    > news:42d30039$1@news.greennet.net...
    >
    >>Noting that your NNTP Posting Host is ...
    >> http://www.whois.sc/62.251.76.14
    >> Netherlands - Noord-holland - Amsterdam - Isp Dsl-vi
    >> tracert gives:
    >> adm-b2-pos2-0.telia.net [213.248.64.190]
    >>... which is in the same top-level address band as both of these, I wonder
    >>if this is just some keep-alive signal from your network?
    >>
    >>1) Are you running bespoke connection software provided by your ISP?
    >
    >
    >
    > I never heard of bespoke. [...]

    bespoke: custom ordered from the maker, eg, at one time people had
    "bespoke overcoats" made by a tailor. There's a story titled The Bespoke
    Overcoat, kinda amusing as I recall, but I can't recall any details of
    the story, let alone who wrote it.

    I think Java Jive intends a version of standard connection software
    tailored to the ISP's desires, including perhaps built-in drivers for
    any hardware the ISP sells or rents to you.

    HTH
  16. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Precisely ...

    "Wolf Kirchmeir" <wwolfkir@sympatico.ca> wrote in message
    news:6kDAe.5112$qg1.343250@news20.bellglobal.com...

    > I think Java Jive intends a version of standard connection software
    > tailored to the ISP's desires, including perhaps built-in drivers for
    > any hardware the ISP sells or rents to you.
  17. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    "Wolf Kirchmeir" <wwolfkir@sympatico.ca> schreef in bericht
    news:6kDAe.5112$qg1.343250@news20.bellglobal.com...
    > Linea Recta wrote:
    > > "Java Jive" <java@evij.com> schreef in bericht
    > > news:42d30039$1@news.greennet.net...
    > >
    > >>Noting that your NNTP Posting Host is ...
    > >> http://www.whois.sc/62.251.76.14
    > >> Netherlands - Noord-holland - Amsterdam - Isp Dsl-vi
    > >> tracert gives:
    > >> adm-b2-pos2-0.telia.net [213.248.64.190]
    > >>... which is in the same top-level address band as both of these, I
    wonder
    > >>if this is just some keep-alive signal from your network?
    > >>
    > >>1) Are you running bespoke connection software provided by your ISP?
    > >
    > >
    > >
    > > I never heard of bespoke. [...]
    >
    > bespoke: custom ordered from the maker, eg, at one time people had
    > "bespoke overcoats" made by a tailor. There's a story titled The Bespoke
    > Overcoat, kinda amusing as I recall, but I can't recall any details of
    > the story, let alone who wrote it.
    >
    > I think Java Jive intends a version of standard connection software
    > tailored to the ISP's desires, including perhaps built-in drivers for
    > any hardware the ISP sells or rents to you.
    >


    Today I got this:

    12-07-2005 15:55
    A computer with the IP adres 127.0.0.1 sent information that is
    characteristic of the HTTP MS IIS ASP Source Disclosure attack


    --
    regards,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl
  18. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    127.0.0.1 (aka localhost) is a standard loopback address referring to your
    own machine. Perhaps your PC is infected? I note the message refers to
    Microsoft's Internet Information Services. Are you running this? Rt-click
    My Computer, and choose Manage, Services and Applications, Services, then if
    the entry is there, double-click it. Unless you have specific reason to be
    running it, you'd know if you had, if it is started, stop it, and then set
    the startup type to Disabled.

    Then check your AV software is running properly and up-to-date.

    "Linea Recta" <mccm.vos@abc.net> wrote in message
    news:42d3cd90$0$812$3a628fcd@textreader.nntp.hccnet.nl...
    >
    > Today I got this:
    >
    > 12-07-2005 15:55
    > A computer with the IP adres 127.0.0.1 sent information that is
    > characteristic of the HTTP MS IIS ASP Source Disclosure attack
  19. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    "Java Jive" <java@evij.com> schreef in bericht
    news:42d400fb@news.greennet.net...
    > 127.0.0.1 (aka localhost) is a standard loopback address referring to your
    > own machine. Perhaps your PC is infected? I note the message refers to
    > Microsoft's Internet Information Services. Are you running this?
    Rt-click
    > My Computer, and choose Manage, Services and Applications, Services, then
    if
    > the entry is there, double-click it. Unless you have specific reason to
    be
    > running it, you'd know if you had, if it is started, stop it, and then set
    > the startup type to Disabled.


    I couldn't find any mention of Microsoft's Internet Information Services.


    >
    > Then check your AV software is running properly and up-to-date.


    I daily check for antivirus & firewall updates manually. I did a complete
    system scan and there were no infections.


    --
    regards,

    |\ /|
    | \/ |@rk
    \../
    \/os

    mccm dot vos at hccnet dot nl


    >
    > "Linea Recta" <mccm.vos@abc.net> wrote in message
    > news:42d3cd90$0$812$3a628fcd@textreader.nntp.hccnet.nl...
    > >
    > > Today I got this:
    > >
    > > 12-07-2005 15:55
    > > A computer with the IP adres 127.0.0.1 sent information that is
    > > characteristic of the HTTP MS IIS ASP Source Disclosure attack
    >
    >
  20. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    Wolf Kirchmeir wrote:
    >
    > bespoke: custom ordered from the maker, eg, at one time
    > people had "bespoke overcoats" made by a tailor. There's
    > a story titled The Bespoke Overcoat, kinda amusing as I
    > recall, but I can't recall any details of the story, let
    > alone who wrote it.
    >
    Nicolai Gogol.

    Cheers,

    Cliff

    --

    Barzoomian the Martian - http://barzoomian.blogspot.com
  21. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    On Mon, 11 Jul 2005 23:32:24 +0200, "Linea Recta" <mccm.vos@abc.net> wrote:

    >I never heard of bespoke. I'm using an ADSL modem (SpeedTouch 330) connected
    >to USB port and with its Alcatel software.

    Not surprising, it's not exactly a term that's normally used in that context.
    However, the poster has impressed you with his vast vocabulary, that's all that
    really matters.
  22. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    On Tue, 12 Jul 2005 20:26:00 -0400, Gunrunnerjohn <nobody@world.com>
    wrote:


    >>I never heard of bespoke.
    >
    The last time I heard that word, I was in second grade. Back when Ike
    was having us go out in the hallway bend over and kiss our butts
    goodbye.

    --
    Colyn Goodson

    http://home.swbell.net/colyng
    http://www.colyngoodson.com
  23. Archived from groups: alt.os.windows2000,microsoft.public.win2000.general (More info?)

    "Gunrunnerjohn" <nobody@world.com> wrote in message
    news:vqn8d15qo1ae5nka6deshp79kmlnotbkta@4ax.com...
    > On Mon, 11 Jul 2005 23:32:24 +0200, "Linea Recta" <mccm.vos@abc.net>
    wrote:
    >
    > Not surprising, it's not exactly a term that's normally used in that
    context.
    > However, the poster has impressed you with his vast vocabulary, that's all
    that
    > really matters.

    People must be more easily impressed than I am. Perhaps the reason I have a
    'vast' vocabulary is that when I see a word I don't know, I go and look it
    up.
Ask a new question

Read More

Windows 2000 Microsoft Windows