Notepad.exe is trying to access the internet (huh???)

Discussion in 'other security issues & news' started by slurp, Apr 19, 2005.

Thread Status:
Not open for further replies.
  1. slurp

    slurp Guest

    Whenever I try to save using Notepad, ZoneAlarm Pro spits out the message this message: notepad is trying to access the internet (dest ip: 203.133.11.113:ftp). This block of IP belongs to a cable company in Taiwan, & obviously why it needs to look at all the trivial crap that I type in the notepad is beyond me (yeah, I should just type some crazy **** & send it :) ). At any rate, I've ran spyware scanners along with many others including TDS-3, but came up clean -- which doesn't surprise me since notepad.exe is a legit prog. But here's the twist...there are 2 (read: two) notepads -- one in the Windows directory & another in the System32. Is this normal? I thought it should be in the Sys32 folder. Has anyone stumbled into the same problem?
     
  2. jimmie

    jimmie Registered Member

    Joined:
    Mar 16, 2005
    Posts:
    17
    Location:
    USA
    Hi slurp...
    Here is what I have on mine:
     

    Attached Files:

  3. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi slurp,

    That destination is an FTP server that appears to host files for Ulead. The files are current. The directory listing in /pub/Trial/Index.txt shows:

    "Trial versions of our products. You can download them and try it.

    /Cool3DCool 3D
    /GACGIF Animation Collection I
    /GifAniGIF Animator
    /MS2.5MediaStudio Pro 2.5 Trial
    /MS5.0MediaStudio Pro 5.0 Trial
    /PA Photo Assistant
    /PEPhoto Explorer
    /PI4trial Ulead Photo Impact Chinese version
    /Particle Particle.Plugin for Photoshop
    /SsaverSmartSaver
    /Type Type.Plugin for Photoshop
    /UPI4 Ulead Photo Impact
    /ViewerPhotoImpact Viewer
    Wusl.exe Web Utilities System Libraries (MFC40.DLL, MSVCRIT.DLL, MSVCRT.DLL, MSVCRT20.DLL, and MSVCRT40.DLL)
    /albumWeb Album
    /screenPhotoImpact Screen Capture
    /wp4psWeb.Plugins for PhotoShop
    /wr4psWebRazor for PhotoShop"


    Do you run any Ulead software?

    Nick
     
  4. mottramr

    mottramr Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    7
    Whooeee! I have a similar problem with Microsoft Word (MS Office 2003) where every time I open the progran it tries to connect to the Internet looking for 64.94.110.11 - all other progs don't attempt to connect, but for some inexplicable reason MS Word does!

    ZoneAlarm Pro stops it and notifies me & then the system hangs (or times out then carries on as per norm.

    Pinging the address consistantly times out and zonealarm can't throw any light on this also.

    Suggestionso_O

    Thanks
    Dabbler
     
  5. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    Microsoft often connects to the internet searching for updates/search/help/...

    here is for 64.94.110.11 referring too:
    bye
     
  6. Happy Bytes

    Happy Bytes Guest

  7. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    LMAO :) sad but true: it's possible to stop ms from doing it till a certain degree but fully disabling, it won't work...and that's the case with practicaly all m$ apps...Open Office/Star Office is a real nice alternative for ms office imo less bloated anyway :D
     
  8. slarti

    slarti Guest

    I've never had notepad try to access the net. I do know alot of the trojans out there from the last couple years (well, beast anyway) had notepad.exe as one of the default processes to inject it's server into.
     
  9. UCI_MECH

    UCI_MECH Registered Member

    Joined:
    Oct 27, 2004
    Posts:
    15
    Hi mottramr,

    I used to have the exact same problem with Word 2003. I figured that Word was trying to connect remotely to somewhere. I don't know how this started. So, I just added this registery key:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE]
    "EnableRemoteConnect"="N"

    Now Word is behaving as it should. Let me know if this fixed your problem.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.