The programs that, at very end, allow the connection are Remote Access Connection Manager and Remote Access Auto Connection Manager; they are kernel components running as services.

There are many ways that your program can use in order to access the services; the use of the RASAPI functions is the easier way in Windows, but the most detectable too.

From your description it can't be understood if your program checks if the machine is connected, then perform its operation, or if it tries to start a new connection; from NT 4, the RASAutodial function is implemented for this purpose.

Anyway, bear in mind that if you're using a public computer and you (as usual) are not allowed to login as Administrator, you won't be able to:

- install a firewall
- stop any service

The simplest thing you can do is checking by the Task Manager if, when your program tries an outside access, a new process is started; if so, you will have localized the dialer of your program.

Hope it helps