Computing.Net > Forums > Security and Virus > PING requests constant - worm?

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

PING requests constant - worm?

Reply to Message Icon

Name: ComputersHateMe
Date: August 24, 2003 at 21:56:11 Pacific
OS: WinMe
CPU/Ram: 1.2/128MB
Comment:

I am getting pings continually (over 900 every 30 minutes) by the three same IP addresses. I've resolved them, all three of them are on the same provider as me, but in different states.
I've scanned for viruses, and found nothing. I downloaded both Stinger and the Norton tools to check/remove SoBig, etc, and found nothing. I'm trying to run online scans (McAfee, Norton, and Housecall) and it's telling me my Active X is disabled. I went in and removed any security settings for that in my IE and STILL they won't run.
I don't know what is going on here, it makes no sense, and it's slowing me down, seems like it's actually creating a DOS attack.
Can anyone offer advice?



Sponsored Link
Ads by Google

Response Number 1
Name: hylian_lynk
Date: August 24, 2003 at 22:06:03 Pacific
Reply:

Sorry to say but with the amount of worm infections currently, the infected computers ping you.
I have been getting huge logs lately, its not hackers its viruses trying to get in, people in my area without firewalls get infected within 2 minutes of going online.
Keep firewall up and patch up OS.
Odds are infections will get worse.


0

Response Number 2
Name: ComputersHateMe
Date: August 24, 2003 at 22:12:47 Pacific
Reply:

Well as of right now I am having several problems.

1 - I am continually being pinged, and even though my firewall is blocking them and dropping the packets, it's slowing me down. I have dsl and just surfing the net, let alone downloading large files feels like I'm on dialup.

2 - I've tried now several times to run an online virus programme in case mine is screwed up and I'm not knowing it - Active X is denied, even though I've allowed it in my browser controls AND in my firewall. It's as if the priv's I set have done nothing.

3 - Icons on my desktop are changing... mp3's are now using the icons that an image would use, and images are using document icons, etc etc. It's acting as if I'm out of RAM.

4 - I keep freezing and have to reboot.

5 - Each time I go to Microsoft Update, it allows to scan for critical updates, and I see only one available (because I got most of them already), it allows me to choose it, and when I go to install, it tells me there was an error (most likely, this is something to do with Active X again). So... I tried doing the same thing in Opera. I got the same result. I am unable to use any damn anything regarding Active X. However, I am able to see flash and use java applications... isn't that weird?

So evidently something is VERY wrong and this machine is the only machine it's happening to. I've got three other machines on cable right now, and nothing odd is occuring. This machine is on dsl, dynamic ip, I've changed hundreds of times, and it still keeps happening, which tells me there has to be SOMETHING on this drive somewhere.


0

Response Number 3
Name: hylian_lynk
Date: August 24, 2003 at 22:45:05 Pacific
Reply:

plug out the modem and see if u still run slow. If you are, either your infected, or you got corrupted software.
If it was hardware u would get mostly BSODs.


0

Response Number 4
Name: blender
Date: August 25, 2003 at 10:16:09 Pacific
Reply:

Hello

Your constant logging of pings are likely a result of the msblaster.d/welchia worm...
altho me is not vulnerable to the RPC DCOM vulnerability...you will still be scanned for it...I have noticed a significant slowdown also cus firewall is workin it's butt off blocking all the requests...
For the IE problem...try go into properties> advanced> reset defaults....if you didn't do that already...might work.
Or you could try repair IE
ctrl panel> add/remove prog> choose IE> click add/remove button> choose repair> follow on screen instructions.
Have you tried running your av scanner from safe mode?
Check your startup list...start> run> msconfig> startup tab> uncheck stuff you don't need to run...(you can always go back and check stuff again later.
leave av, scanreg, systray, load power profile..(something like that)(not sure bout me but may be 2), and firewall.
reboot
You might also have a pile of spyware taking up all your ram...ad-aware and spybot search and destroy will clean up a bunch...both programs are free. Update them b4 running scans.
Empty out your temporary internet files if you havn't already...

try this link for more help

how to run me well

http://www.burzurq.com/forum/trevtweak.html

Hope there is something in that mess i just wrote that will help you....just woke up...lol.
Good luck
post back if anything helped (or not)


0

Response Number 5
Name: Jim Beau
Date: August 25, 2003 at 15:34:48 Pacific
Reply:

About the ping activity..

I'm getting on average 250/hour and that's on dialup!
What's sad is that I'm getting used to this!
It shows no sign of slowing down.
Hylian Link may be right,it could get worse.

If you can download and install a spyware remover it may be that you have some spyware eating up resources.
HTH,
JB.


0

Related Posts

See More



Response Number 6
Name: Tom
Date: September 6, 2003 at 09:50:49 Pacific
Reply:

I have the same ping attacks problem.
My firewall constantly blocks and logs ping attack all through Road Runner network. I believe this is the most heavily damaged network. Many of the users are home users are not like us. They have trouble removing the worms and are constantly pinging other users. (As I have seen when I test ran the Blaster worm, it tried to ping consecutive Ips in my network.) I have emailed and phoned Road Runner about this problem. They said they seemed to have worms problem on their servers themselves (sigh). So until an easy fix for someone who does not have a firewall is widely distributed, all our connections will run like dialups. If I log my pings to a server, They appear like this:
500b/s
1.5kb/s
480b/s
1.7kb/s
621b/s
and so on and so forth...
Obvious attacks (though i may be wrong and road runner added a cap) but I doubt that. I bet that the pings are actually doing the work. I am getting about 120 pings/ 10 minute. Sometimes more are in one of the minutes, I received 26 pings. This problem causes packeting errors/timeouts in almost all internet related software excluding browsers. I pray to God that either a firewall-less fix is made or Road Runner will care more about its custumers to fix their servers first, then help out its users who are not able to remove the worms.
Note: A few netbios attacks seem to be related to the worms also.


0

Response Number 7
Name: Tom
Date: September 6, 2003 at 09:53:31 Pacific
Reply:

I forgot to mention, RR should read this page to stop broadcasting its ICMP stuff
http://www.insecure.org/sploits/routed.broadcast.ping.DOS.html


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: PING requests constant - worm?

Opaserv Update, how it works www.computing.net/answers/security/opaserv-update-how-it-works/3271.html

Constant Bombardment www.computing.net/answers/security/constant-bombardment/6108.html

ping reply www.computing.net/answers/security/ping-reply/6958.html