PCs continuously trying to access MS Hotmail Update Site.

Hello,

I have a small business with about 25 PCs on the network.

Three of these PCs (all Win XP - SP1 with all latest securuity update
installed) continuoulsy (every 20 minutes) try to access
au.download.windowsupdate.com at i.p. address 64.4.23.93.

I checked the i.p. address on ARIN WHOIS and it is a Microsoft HOTMAIL
address.

None of us use Hotmail in the office.

Any idea why these three PCs are behaving like this?

Frank

Hello I am also experiencing the same problem but to a greater scale, having
a larger network, one of my remote offices keeps trying to continously
download windowsxp-kb887742-enu_726044e097a719719d048eb87bd9cc199e6d0116.psf
from several diferent Microsoft uodate sites. some of these sites do resolve
to hotmail resources accordind to ARIN, I am currently wasting 4mb/sec of
bandwidth on this

"Frank" wrote:

> Hello,
>
> I have a small business with about 25 PCs on the network.
>
> Three of these PCs (all Win XP - SP1 with all latest securuity update
> installed) continuoulsy (every 20 minutes) try to access
> au.download.windowsupdate.com at i.p. address 64.4.23.93.
>
> I checked the i.p. address on ARIN WHOIS and it is a Microsoft HOTMAIL
> address.
>
> None of us use Hotmail in the office.
>
> Any idea why these three PCs are behaving like this?
>
> Frank
>
>
>

Pick your weapon. You have spyware

http://www.spywarewarrior.com/rogue_...tm#trustworthy

Peter


"Edgar" <> wrote in message
news:89E2E5F1-F0A4-4765-883D-...
> Hello I am also experiencing the same problem but to a greater scale,
> having
> a larger network, one of my remote offices keeps trying to continously
> download
> windowsxp-kb887742-enu_726044e097a719719d048eb87bd9cc199e6d0116.psf
> from several diferent Microsoft uodate sites. some of these sites do
> resolve
> to hotmail resources accordind to ARIN, I am currently wasting 4mb/sec of
> bandwidth on this
>
> "Frank" wrote:
>
>> Hello,
>>
>> I have a small business with about 25 PCs on the network.
>>
>> Three of these PCs (all Win XP - SP1 with all latest securuity update
>> installed) continuoulsy (every 20 minutes) try to access
>> au.download.windowsupdate.com at i.p. address 64.4.23.93.
>>
>> I checked the i.p. address on ARIN WHOIS and it is a Microsoft HOTMAIL
>> address.
>>
>> None of us use Hotmail in the office.
>>
>> Any idea why these three PCs are behaving like this?
>>
>> Frank
>>
>>
>>

"Peter Foldes",

This is not necessarily spyware. Here's why:
1. Automatic updates downloads updates throughout the day.
2. If there is a network interruption during the download, the BITS service
picks up right where it left off
3. The accessing from the download site might have to do with an update that
Windows continutes to attempt to install or restore.

Let us know if you have any more questions.

Sincerely,

Pat Walters [MSFT]


"Peter Foldes" <> wrote in message
news:OZ#...
> Pick your weapon. You have spyware
>
> http://www.spywarewarrior.com/rogue_...tm#trustworthy
>
> Peter
>
>
> "Edgar" <> wrote in message
> news:89E2E5F1-F0A4-4765-883D-...
> > Hello I am also experiencing the same problem but to a greater scale,
> > having
> > a larger network, one of my remote offices keeps trying to continously
> > download
> > windowsxp-kb887742-enu_726044e097a719719d048eb87bd9cc199e6d0116.psf
> > from several diferent Microsoft uodate sites. some of these sites do
> > resolve
> > to hotmail resources accordind to ARIN, I am currently wasting 4mb/sec
of
> > bandwidth on this
> >
> > "Frank" wrote:
> >
> >> Hello,
> >>
> >> I have a small business with about 25 PCs on the network.
> >>
> >> Three of these PCs (all Win XP - SP1 with all latest securuity update
> >> installed) continuoulsy (every 20 minutes) try to access
> >> au.download.windowsupdate.com at i.p. address 64.4.23.93.
> >>
> >> I checked the i.p. address on ARIN WHOIS and it is a Microsoft HOTMAIL
> >> address.
> >>
> >> None of us use Hotmail in the office.
> >>
> >> Any idea why these three PCs are behaving like this?
> >>
> >> Frank
> >>
> >>
> >>
>
>

I'm pretty sure its not spyware as we have fairly comprehensive security
policies in place. I will certainly look into that possibility though.

I had already considered an interrupted download so one day after work last
week I did a "forced" update on two of the PCs to make sure that they had
all the available updates.
One PC seemed to have stopped the behavior but soon it started again.
Any idea why it's trying to access the MS Hotmail site?

Frank


"Pat Walters [MSFT]" <a-> wrote in message
news:42206287$...
> "Peter Foldes",
>
> This is not necessarily spyware. Here's why:
> 1. Automatic updates downloads updates throughout the day.
> 2. If there is a network interruption during the download, the BITS
service
> picks up right where it left off
> 3. The accessing from the download site might have to do with an update
that
> Windows continutes to attempt to install or restore.
>
> Let us know if you have any more questions.
>
> Sincerely,
>
> Pat Walters [MSFT]
>
>
> "Peter Foldes" <> wrote in message
> news:OZ#...
> > Pick your weapon. You have spyware
> >
> > http://www.spywarewarrior.com/rogue_...tm#trustworthy
> >
> > Peter
> >
> >
> > "Edgar" <> wrote in message
> > news:89E2E5F1-F0A4-4765-883D-...
> > > Hello I am also experiencing the same problem but to a greater scale,
> > > having
> > > a larger network, one of my remote offices keeps trying to continously
> > > download
> > > windowsxp-kb887742-enu_726044e097a719719d048eb87bd9cc199e6d0116.psf
> > > from several diferent Microsoft uodate sites. some of these sites do
> > > resolve
> > > to hotmail resources accordind to ARIN, I am currently wasting 4mb/sec
> of
> > > bandwidth on this
> > >
> > > "Frank" wrote:
> > >
> > >> Hello,
> > >>
> > >> I have a small business with about 25 PCs on the network.
> > >>
> > >> Three of these PCs (all Win XP - SP1 with all latest securuity update
> > >> installed) continuoulsy (every 20 minutes) try to access
> > >> au.download.windowsupdate.com at i.p. address 64.4.23.93.
> > >>
> > >> I checked the i.p. address on ARIN WHOIS and it is a Microsoft
HOTMAIL
> > >> address.
> > >>
> > >> None of us use Hotmail in the office.
> > >>
> > >> Any idea why these three PCs are behaving like this?
> > >>
> > >> Frank
> > >>
> > >>
> > >>
> >
> >
>
>

It turns out that these PCs were trying to download a security update for
Windows Media Player Ver 9.

I had previously blocked access to any website with "WindowsMedia" in the
url on our router / firewall in an attempt to limit streaming video / audio
downloads (of course that didn't work) and I had forgotten to remove the
block.

Frank


"FKlassen" <> wrote in message
news:5P0Ud.514635$6l.93187@pd7tw2no...
> I'm pretty sure its not spyware as we have fairly comprehensive security
> policies in place. I will certainly look into that possibility though.
>
> I had already considered an interrupted download so one day after work
last
> week I did a "forced" update on two of the PCs to make sure that they had
> all the available updates.
> One PC seemed to have stopped the behavior but soon it started again.
> Any idea why it's trying to access the MS Hotmail site?
>
> Frank
>
>
> "Pat Walters [MSFT]" <a-> wrote in message
> news:42206287$...
> > "Peter Foldes",
> >
> > This is not necessarily spyware. Here's why:
> > 1. Automatic updates downloads updates throughout the day.
> > 2. If there is a network interruption during the download, the BITS
> service
> > picks up right where it left off
> > 3. The accessing from the download site might have to do with an update
> that
> > Windows continutes to attempt to install or restore.
> >
> > Let us know if you have any more questions.
> >
> > Sincerely,
> >
> > Pat Walters [MSFT]
> >
> >
> > "Peter Foldes" <> wrote in message
> > news:OZ#...
> > > Pick your weapon. You have spyware
> > >
> > > http://www.spywarewarrior.com/rogue_...tm#trustworthy
> > >
> > > Peter
> > >
> > >
> > > "Edgar" <> wrote in message
> > > news:89E2E5F1-F0A4-4765-883D-...
> > > > Hello I am also experiencing the same problem but to a greater
scale,
> > > > having
> > > > a larger network, one of my remote offices keeps trying to
continously
> > > > download
> > > > windowsxp-kb887742-enu_726044e097a719719d048eb87bd9cc199e6d0116.psf
> > > > from several diferent Microsoft uodate sites. some of these sites do
> > > > resolve
> > > > to hotmail resources accordind to ARIN, I am currently wasting
4mb/sec
> > of
> > > > bandwidth on this
> > > >
> > > > "Frank" wrote:
> > > >
> > > >> Hello,
> > > >>
> > > >> I have a small business with about 25 PCs on the network.
> > > >>
> > > >> Three of these PCs (all Win XP - SP1 with all latest securuity
update
> > > >> installed) continuoulsy (every 20 minutes) try to access
> > > >> au.download.windowsupdate.com at i.p. address 64.4.23.93.
> > > >>
> > > >> I checked the i.p. address on ARIN WHOIS and it is a Microsoft
> HOTMAIL
> > > >> address.
> > > >>
> > > >> None of us use Hotmail in the office.
> > > >>
> > > >> Any idea why these three PCs are behaving like this?
> > > >>
> > > >> Frank
> > > >>
> > > >>
> > > >>
> > >
> > >
> >
> >
>
>