Task manager tries to connect to the internet Options

[pandy]

I'm scared of automatic cleanup.

Why? I could understand distrust in third-party cleanup software though.

Microsoft and I don't always agree and what should be done. The only cleanup program I've trusted was a freeware. But it want paid and became bulky.

There's also a folder called AppData in there with the subdirectories Local, LocalLow and Roaming. Do you have those?

I have those as well.

Thank you. Then I can leave that at least.

Try your other email program as well, to see if both add files. If that's the case I would suspect a Windows bug (while if it's only one email program maybe the bug is in there, though that doesn't explain all the images and PDF files).

I don't want to mess up my mail. OK, I could set it to leave the mail on the server, I guess. But it's so old now, Eudora, I'm afraid it'll mess up anyway. The one I used after that crashed beyond repair. I only have the mail.

I'll update my current program, been meaning to anyway. If that doesn't help I'll contact the author. It's that kind of program.

I guess it could also be some buggy maintenance program doing this, such as third-party antivirus, indexing etc.

I didn't use any third party AV until the previous hickup. And those run on demand, not in the background, and I have set them to only scan, not take any action. Maybe it is the email program anyway. The oldest file was from the beginning of 2023. Could be about then I updated it. I'll install the new version tomorrow. Today I deserve a night off.

[pandy]

The plot thickens. I didn't get many more files in the folder yesterday. Perhaps a hundred in total.

When I started email today I once again got a lot. So it seems to be mainly the first time email is active after a reboot. Only I don't turn the computer off, I just hibernate.

When I glanced through the files I saw at least three that aren't related to email. Notetab's two help files. But they at least exists on disk. The third was the most peculiar. An eBook (epub) with the author name misspelled. The file does exist but not under that name. The name can very well have been misspelled at some point, but I have corrected it and probably long ago. It could be I copied the file to another directory, renamed it, and deleted the original file. Notetab has moved around a bit too. Could these three be deleted files that the gremlin found? I certainly haven't sent or received any of them by email. But none of these three files is corrupt which they ought to be if they were deleted long ago.

I've bought a license for the new version of the email program and am about to install it. Either this helps or not I'll contact the author. Maybe someone else have had the same problem.

[Christian J]

When I started email today I once again got a lot. So it seems to be mainly the first time email is active after a reboot. Only I don't turn the computer off, I just hibernate.

Maybe it happens when Windows updates force a reboot?

[pandy]

But it hasn't done that in a long time.

It didn't help to update the email program. 1232 files. And it looks like the ones I last deleted is recreated. At least those three odd ones I mentioned. I don't think they were there yesterday though. I would have noticed. Especially the help files stand out. .chm files, the icon with the bright yellow question mark. And I sorted by file type when I looked through them.

Now I see the email programs ini file is also copied. And I have a new ISO file. MNF43.ISO, 54 kB. That file doesn't exist elsewhere on my computer. Only here and in the backup of odd files I made yesterday.

[pandy]

Forgot to say. I had hopes at first after installing the new version of the email program. No new files. I both fetched and sent email to provoke it. Then I made a hard reboot. And then they came.

So it seems the bulk comes after windows has loaded AND the email program is active. But some minor activity can also happen after that.

Could some kind of malware do this? With the purpose to slowly crash the computer? Or a spy program that's after email related stuff and needs to temporary store files somewhere but isn't so good at it and grabs some other files too? I'm thinking of that taskmanager.exe that TinyWall stopped from getting out. Some related program could still be active maybe.

I have scanned with three different AV and they only find files I know is OK and have been around a long time.

[pandy]

Found a tip about ProcessExplorer in a thread about a similar problem. It's supposed to show what process writes the files. I'm downloading it. If I understand how to use it is another matter. It's one of the Sysinternals programs. I tried a lot of them many years ago, but I didn't know enough to make real use of them.

https://learn.microsoft.com/en-us/sysintern...rocess-explorer

[pandy]

Nah. It just lists active processes and tells you a little about what they are. I don't see how I can relate a process to a file unless I catch it in the act, and that isn't likely to happen with a long list of active processes.

If I could tell ProcessExplorer to hide all processes that are running now and then reboot I would be able to catch it. But I don't see such an option.

[pandy]

I caught it.

I used another Sysinternals program. I rebooted, opened the systemprofile folder, started Process Monitor, started the email program and sent a few mails to myself. After a minute to two it happened.

Only I don't get anything out of it. The process has no name. Looking at details most fields are blank. Those that aren't are too low level for me.

I suppose you don't get anything out of this either? She says hopefully.

The right field that's partly hidden in the first screen cap says "SyncType: SyncTypeOther". Very enlightening.









FYI the upload thing only allows one image now. If I try to attach another it replaces the first one.

[pandy]

I emptied the folder and now 4 new files are created. Three are copies of egpor95.vcf that doesn't exist anywhere else. Neither does the fourth, 732117007_a. Spooky!

[Christian J]

The right field that's partly hidden in the first screen cap says "SyncType: SyncTypeOther". Very enlightening.

No idea what it is, but I get a couple of MS-related search hits for that phrase.

[pandy]

The sync part seems related to the problem anyway.

[Christian J]

Maybe some process is gathering suitable files for syncing with other devices (both legit and spyware would perhaps both work in a similar way).

[pandy]

Yes, that's what I was touching on before. A temp storage for some reason. But after seeing how common similar problems are, I lean towards a Windows bug.

The most peculiar is really those long ago deleted files.

[pandy]

My conclusion was wrong. Yesterday it didn't happen closely after I booted up. I even rebooted to provoke it. It did happen later though. Several times, I guess, since I had 5000 files something when I went to bed. Hasn't happened yet today either.

Sorry for going on about this. But this thread became like a log of everything related to the problem, so I thought I could just as well continue, for my own sake.

[Christian J]

Same time of day? Perhaps it tries to do it a certain time, or if Windows is not running as soon as it's restarted?

Can you see if any process has connected to the Internet around the same time?

[pandy]

No, I don't think it was the same time. When started to look into this it happened very soon after boot up - if email was running. I have very irregular hours and I also rebooted to provoke it.

I don't know how to check connections and I didn't note down the time stamp on the last bunch. If something tries to connect it won't succeed anyway since TinyWall will block it. And its block list alas only covers the last 5 minutes.

[Christian J]

Glasswire keeps longer logs.

[pandy]

OK. Can several firewalls run at the same time or do they fight?

Today a nasty app called bigo live opened on my phone. It's on Google Play, so assumedly a legit live streaming app. But all I saw on the splash screen were big boobs and tushies. That's the first time I have had an app install on my phone without my consent. How does that happen? I hardly ever use my phone for the web. I don't even read email on it. I use it for SMS and a hand-full of apps that I've used for ages.

WTF is going on? I'm beginning to feel stalked here.

[Christian J]

OK. Can several firewalls run at the same time or do they fight?

No idea, FWIW I've only used it to monitor traffic, not block.

Maybe Pi-hole could be used as well for monitoring? Since it runs on its own hardware it won't fight anything.

That's the first time I have had an app install on my phone without my consent. How does that happen? I hardly ever use my phone for the web. I don't even read email on it. I use it for SMS and a hand-full of apps that I've used for ages.

Could it be that one of your old apps has changed owner, and a recent update by the new owner has changed its functionality?

Nowadays I'm feeling very reluctant to update apps for this reason, and because even legit developers may suddenly start displaying ads, change functionality etc.

[pandy]

No idea, FWIW I've only used it to monitor traffic, not block.

So I can tun off some features? I'll try it tomorrow.

I had a connection monitoring program at some point. In those days I wouldn't even have ran Windows firewall or AV. Today I'm so tired of everything and just make do with what's there.

Could it be that one of your old apps has changed owner, and a recent update by the new owner has changed its functionality?

I don't think so. It was among "recently installed" or what it's called. But I found that later. It just splat open from nowhere. I thought it was FF with a porn site loaded and wondered how that happened. And I don't have any apps that are even remotely similar. I just have boring things like map apps, photography related apps, bird and flower recognition apps, apps that list historical places... Things like that. Please don't tell anyone.

This is crazy. I think it's 10 or 15 years ago I had a virus that actually did something (I don't count the odd attachment that can't do anything if you don't click it) and I've never had anything on my phone. Now it's something new each day.

BTW I got nothing in the systemprofile folder today. There is no system to this.