If this is a regular thing at basically around 7:20am then there must be a scheduled program on your server.
Use the following steps to try to find it.
1. Look through your scheduled tasks to see if there is anything
2. go to the command print and run the command "at" (exclude the quotes). This is same/similiar to 1. but at times I have seen that there are things shown by at that is not shown in scheduled tasks
3. Run MSCONFIG from run and check under services and startup to see if there are any programs that you dont know about. if there are then try unticking them then rebooting your server to flush them out of memory
4. Go to www.sysinternals.com and download process explorer. You will be able to use this to see the current processes that are running on your system. For each process check the file that is being used to run it to ensure that it is genuine and not some program that you dont know about.
5. Check to ensure that you dont have any programs installed that try sending reports to some address at that specified time
6. You could write a batch script that starts around 6:30am and runs in a loop and does a netstat -o into a file till around after 8am. Then you can look through this file to see if you can find that connection. this might or might not capture the connections because the connection could start and finish within a few seconds.
7. Also have a look at your eventviewer. There might be errors logged in it .. assuming its a genuine program that is trying to connect out.
Hope this helps
Main Topics
Browse All Topics
by: slyongPosted on 2009-03-12 at 00:18:24ID: 23865546
Hi,
You can open up a command prompt and use the command "netstat -ano"... otherwise, you can use two-way firewall (for example zonealarm) to see which application is trying to go out.