Unknown Process using Network

**justinw** · August 29th, 2005, 10:55 PM

When my computer is idle and I have no programs running or extra processes, my the local area connection graph in the task manager constantly shows connection.

I've tried ending all the non-system processes and that didn't work. I have no clue what process is using the network.

Are there any third party programs that can tell?

(The reason this is a problem is that: 1. It could be spyware or something, and 2. I have a limited amount of bandwidth here at college.)

**JayMan** · August 29th, 2005, 11:10 PM

Do you have the auto update feature turned on? If so perhaps this is causing the network usage?

Are their any processed besides the idle process that are showing to use the CPU?

JayMan

**budsracing24** · August 29th, 2005, 11:37 PM

what do you have starting up when you run msconfig??
I striped mine down on all our Pc's to bare basics when you have a100mb cable
coming in to a server and hubed out to 5 other pc's i agree with JayMan
even updaters from any thing can show a draw from your conection...

**justinw** · August 30th, 2005, 08:38 AM

Only taskmgr, idle proc, SYSTEM, and inetinfo.exe ever have > 0 cpu. I just took a couple more things out of startup. I'll restart and see how that goes later.

**sr71000** · August 30th, 2005, 08:42 AM

Get sygate personal firewall to replace the windows firewall or whatever you're using. It'll show you exactly what programs are accessing the network and when!

ps. they have paid and free versions...look for the free one, it'll do all that you need!

**justinw** · August 30th, 2005, 10:20 AM

As soon as i restarted after installing the firewall, this file was trying to use the network:

==========
File Version : 5.1.2600.2180
File Description : NDIS User mode I/O Driver (ndisuio.sys)
File Path : C:\WINDOWS\system32\DRIVERS\ndisuio.sys
Connection origin : remote initiated
Protocol : UDP
Local Address : 66.71.54.255
Local Port : 137 (NETBIOS-NS - Browsing requests of NetBIOS over TCP/IP)
Remote Name :
Remote Address : 66.71.54.114
Remote Port : 137

Ethernet packet details:
Ethernet II (Packet Length: 92)
Destination: ff-ff-ff-ff-ff-ff
Source: 00-07-e9-07-23-33
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 128
Protocol: 0x11 (UDP - User Datagram Protocol)
Header checksum: 0x7701 (Correct)
Source: 66.71.54.114
Destination: 66.71.54.255
User Datagram Protocol
Source port: 137
Destination port: 137
Length: 8
Checksum: 0x8908 (Correct)
Data (58 Bytes)
==========

This file and NT Kernal and System (ntoskrnl.exe) are the only ones i can find sending/recieving packets.

Is it bad to block the kernal. Might that mess with updates or something.