"Larry Timms" wrote in
<news:1ihn91h.1efqajq1mh67sN%roadrunner9119@yahoo. junktrap.com>:

> I also
> uninstalled MSIE and MSOE and put Firefox and Thunderbird on the machine

Which means the owner of that host probably will have problems using the
Windows Update site.

> when I
> tell the machine to shut down, it instead starts some frantic internet
> activity (the data flow LED on the ADSL adapter flashes almost
> continuously, the HD indicator also flashes a lot, and one can hear the
> HD in action).

Hmm, spyware phoning home maybe.

> Initially there is a pop-up window from the net software

The "net software". Uh huh. What might THAT be? What does the popup
SAY?

> that (not surprisingly) tells us that it can't disconnect yet because
> the internet connection is busy, but after that there is no further
> indication that the machine is busy - no other pop-up window, no
> flashing icon, and the cursor is just the regular arrow, not the
> hourglass.
>
> I have not yet found out how long this internet activity might continue
> - the longest time I have waited so far is 5 minutes without an end in
> sight - but I always force a shutdown by disconnecting the LAN cable,
> which makes the machine shut down within about 30 seconds.

A good firewall that shows current connections would tell you what is
connecting to where. You could also use TCP View from SysInternals.