Notepad.exe is trying to access the internet (huh???)

Discussion in 'other security issues & news' started by slurp, Apr 19, 2005.

Thread Status:
Not open for further replies.
  1. slurp

    slurp Guest

    Whenever I try to save using Notepad, ZoneAlarm Pro spits out the message this message: notepad is trying to access the internet (dest ip: 203.133.11.113:ftp). This block of IP belongs to a cable company in Taiwan, & obviously why it needs to look at all the trivial crap that I type in the notepad is beyond me (yeah, I should just type some crazy **** & send it :) ). At any rate, I've ran spyware scanners along with many others including TDS-3, but came up clean -- which doesn't surprise me since notepad.exe is a legit prog. But here's the twist...there are 2 (read: two) notepads -- one in the Windows directory & another in the System32. Is this normal? I thought it should be in the Sys32 folder. Has anyone stumbled into the same problem?
     
  2. jimmie

    jimmie Registered Member

    Joined:
    Mar 16, 2005
    Posts:
    17
    Location:
    USA
    Hi slurp...
    Here is what I have on mine:
     

    Attached Files:

  3. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi slurp,

    That destination is an FTP server that appears to host files for Ulead. The files are current. The directory listing in /pub/Trial/Index.txt shows:

    "Trial versions of our products. You can download them and try it.

    /Cool3DCool 3D
    /GACGIF Animation Collection I
    /GifAniGIF Animator
    /MS2.5MediaStudio Pro 2.5 Trial
    /MS5.0MediaStudio Pro 5.0 Trial
    /PA Photo Assistant
    /PEPhoto Explorer
    /PI4trial Ulead Photo Impact Chinese version
    /Particle Particle.Plugin for Photoshop
    /SsaverSmartSaver
    /Type Type.Plugin for Photoshop
    /UPI4 Ulead Photo Impact
    /ViewerPhotoImpact Viewer
    Wusl.exe Web Utilities System Libraries (MFC40.DLL, MSVCRIT.DLL, MSVCRT.DLL, MSVCRT20.DLL, and MSVCRT40.DLL)
    /albumWeb Album
    /screenPhotoImpact Screen Capture
    /wp4psWeb.Plugins for PhotoShop
    /wr4psWebRazor for PhotoShop"


    Do you run any Ulead software?

    Nick
     
  4. mottramr

    mottramr Registered Member

    Joined:
    Jun 28, 2003
    Posts:
    7
    Whooeee! I have a similar problem with Microsoft Word (MS Office 2003) where every time I open the progran it tries to connect to the Internet looking for 64.94.110.11 - all other progs don't attempt to connect, but for some inexplicable reason MS Word does!

    ZoneAlarm Pro stops it and notifies me & then the system hangs (or times out then carries on as per norm.

    Pinging the address consistantly times out and zonealarm can't throw any light on this also.

    Suggestionso_O

    Thanks
    Dabbler
     
  5. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    Microsoft often connects to the internet searching for updates/search/help/...

    here is for 64.94.110.11 referring too:
    bye
     
  6. Happy Bytes

    Happy Bytes Guest

  7. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    LMAO :) sad but true: it's possible to stop ms from doing it till a certain degree but fully disabling, it won't work...and that's the case with practicaly all m$ apps...Open Office/Star Office is a real nice alternative for ms office imo less bloated anyway :D
     
  8. slarti

    slarti Guest

    I've never had notepad try to access the net. I do know alot of the trojans out there from the last couple years (well, beast anyway) had notepad.exe as one of the default processes to inject it's server into.
     
  9. UCI_MECH

    UCI_MECH Registered Member

    Joined:
    Oct 27, 2004
    Posts:
    15
    Hi mottramr,

    I used to have the exact same problem with Word 2003. I figured that Word was trying to connect remotely to somewhere. I don't know how this started. So, I just added this registery key:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE]
    "EnableRemoteConnect"="N"

    Now Word is behaving as it should. Let me know if this fixed your problem.
     
Loading...
Thread Status:
Not open for further replies.