Internetworkers: http://www.ibiblio.org/internetworkers/

["Shea Tisdale" <shea AT sheatisdale.com>]

You most likely have spyware.  Or you possibly have your email or internet
set to make automatic connections.  Check those setting and then download
and run spybot search and destroy or ad-aware.

The program you mentioned, RASAutoU.exe, is the Microsoft Windows
NT4/2000/XP/2003 Remote Access Dialer.  It can appear whenever you have you
system set to automatically connect such as in email or IE, or you're your
system is set to handle an incoming modem connection.  It is designed to
make a connection without user input - therefore it is particularly useful
to spyware makers.



> -----Original Message-----
> From: internetworkers-bounces AT lists.ibiblio.org [mailto:internetworkers-
> bounces AT lists.ibiblio.org] On Behalf Of Calvin Powers
> Sent: Thursday, August 05, 2004 8:06 PM
> To: internetworkers
> Subject: [internetworkers] Virus Removal Help Needed!!!
> 
> Howdy all,
> 
> Once again I'm throwing myself on the mercy of internetworkers to help
> me fix what I can only describe as a virus.
> 
> First a few words about my environment. I use a work issued lap top.
> Runs Win 2K. We are required at work to always have the latest MS
> critical patches installed, which I manually check for every Monday. I
> have Norton Antivirus through my company and I have it automagically
> check for updates and plus i manually check on every Monday. Finally, I
> have Zone Labs personal firewall installed. I use the comapy's default
> profile, not sure what all it allows and disallows. But when I am on the
> company internal network, I can share drives etc.
> 
> When I travel, I use a VPM program called AT&T Net Client to dial up to
> the company network and get access to the company network over a VPN.
> 
> At home I have a private network on a 192.168.2.0 subnet. On my personal
> firewall, i have noted that as a trusted network so I can share files
> acros machines. The linksys router which I use to connect to Time
> Warner's Road Runner is configured to block incoming requests.
> 
> My symptoms are that every few minutes My AT&T network dialer starts up
> and  tries to start me through its set up wizard. This is very
> annoying.If I look in the task manager I see that rsautou.exe is running
> (and taking up lots of CPU) whenever the AT&T network set up dialog is
> on the screen, which is basically all the time. I believe that
> rsautou.exe has something to do with windows dialing over modems or some
> such. Not sure.
> 
> My firewall program doesn't give me any alerts or warnings. I've run
> Norton Antivirus in deep scan mode, while running in Windows Safe Mode
> multiple times and it never complains about a single file. I've run
> adaware (the freebie version) and it cleaned up some registry entries,
> but the problem is still around.
> 
> The only other thing I can think to add is that last week I did catch
> the Beagle virus going around. But I used the symantec tool (both og
> them) to remove it and Ive since re-run the tool multiple times and it
> always reports that the virus is not present.
> 
> But still every few seconds or so, the AT&T network dialer pops up. I
> have considered uninstalling it. But I suspect that it has nothing to do
> with AT&T net client. I suspect something else is causing it to start up.
> 
> Anyone got any ideas for me to try? I can't think of anythign to do but
> run around, scream, and tear my hair out. :-)
> ---
> Come and play at the InterNetWorkers Web site!
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit
> http://lists.ibiblio.org/mailman/listinfo/internetworkers