Win 98SE host Dial out when it shouldnt

Hi Larry,
I built 2 pcs for someones sign and auto graphics business. Due to room layout, 1 pc is the Host ( pc1) using ICS ( win98se using your guide). When the client pc ( pc2) boots into windows, pc1 dials out automatically. ( just like it does when IE is opened). auto dail is tuned off, but as you know when a pc2 calls up for a connection it does it automatically. Never saw this happen before when a client pc first enters windows.
One other problem. pc 1 prints across the network to the pc 2's printer. Also there is a plotter for cutting vinyl that is also setup as a network plotter for pc1. When pc1 sends any print job over to the printer or plotter, the dialup box comes up EVERYTIME to connect to the internet on pc1. close it and it goes away. Everything prints fine. I have scanned for a virus for first problem, and have no clue for the second one.

I would prefer that 1 pc was the host of everything but due to room layout it isnt really possible. We are also stuck with win98, as some of the graphic programs for making signs do not work in XP.

1. RE: Win 98SE host Dial out when it shouldnt
lbyard Aug-20-02 10:43 PM
In response to message 0

Sure looks like a worm... I would run http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html from the Safe mode to be sure klez isn't present. A program or Windows could be trying to update. I would check for startup programs and run/load lines in win.ini with Start, run, msconfig. Do a Ctrl-Alt-Delete when the dial-up starts and see if you can identify the offending program. Look in the windows registry with Start, Run, regedit for Run entries in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion. Larry

2. RE: Win 98SE host Dial out when it shouldnt
viking8 Aug-22-02 04:10 PM
In response to message 1

I have seen the exact same problem on a number of networks now. The problem is driving me nuts.
One of the systems I'm trying to fix this on is a 4 machine peer-peer network with a Win2k pro machine hosting the ICS. All other clients are Win98.
When clients boot, they invoke a dial-up.
When printing to QMS Magicolour printer ( TCP/IP Ethernet ) a dial up is invoked.
I would say this is definately NOT a rogue application ( Anti-virus, EMail client ) or an actual virus.
Personally I reckon that it is NETBIOS broadcasts triggering ICS. When you set up a modem router there is usually an option to drop packets on TCP/IP ports 137-139 ( NETBIOS over TCP/IP ). That way when you are browsing to say your printers NETBIOS broadcasts don't get propagated to the web.
Bad news is that I can't find any way of getting ICS to ignore traffic on specific ports.
If any one can help out here then please do!!!

Cheers

Rich

4. RE: Win 98SE host Dial out when it shouldnt
lbyard Aug-22-02 04:43 PM
In response to message 2

Mapping a Drive on Local Network Forces ICS/NAT Host to Dial http://support.microsoft.com/default.aspx?scid=kb;en-us;Q260555 (copy and paste the entire link) Larry

5. RE: Win 98SE host Dial out when it shouldnt
viking8 Aug-23-02 06:31 AM
In response to message 4

Thanks for the link didn't spot that one during my last Microsoft knowledge base search marathon... I reckon the info in the article is along the right lines for a lot of "random dial" problems.
I set up a test rig last night with two Win2k Pro boxes connected to a LAN with an Ethernet printer. The only devices on the network were the two Win2k machines and the printer.
Machine A has an internal 56k modem setup for ICS and a 3Com NIC set to use the default IP address supplied by ICS.
Whenever either machine tried to print the dial up was triggered.
Doing an ipconfig/all from the cmd prompt showed that both Win2k machines were set as Node type = Hybrid. This means that NetBIOS uses a mixed mode of name resolution and my guess is that in Hybrid mode when a machine wants to access a network resource it tries to use NetBIOS name service ( NBNS ) which triggers a dial up ( A bit like DNS forwarding where the DNS server propagates unknown requests to another DNS server out on the web).
A reason why a machine triggers an ICS connection when it boots could be that when the computer starts it tries a NetBIOS name lookup ( NBNS ) which fires a connection via ICS.
So, I searched the MS knowledge base for a way of changing the machine node type and found the following two articles...
Win2k / NT
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q167640
Win9x
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q158474
When I set both machines to a B node type ( Broadcast ) the printer dialling problem went away.
Also tried this with Win Me computer and it also worked.
Will need to test this theory a little more but hopefully it might be an answer to some strange dialling problems

Rich