PDA

View Full Version : Ping Ping to much ping


grubGrob
12-18-2003, 12:56 PM
Well ive formatted my Hdd put on XP pro. installed all my software apps ticks and bits, dowloaded video card divers annd chipset stuff too, gotten the latest everything and my computer purrs along at an overclocked cool low voltage. Its stable and it was good.

I connected my modem (an internal one) I have no software problems or corruptions. I spent a week turning off all the microsoft stuff that I dont need like remote desktop and junk like that.

I connected to the net for the first time. I got my microsoft blaster fix and then the updates and patches.

Then I ghosted my Hdd cause i tested it with Burn In Test, and 3d benchmarking progs.

NOW... when i connect to the internet i noticed that my little computers that did show a internet connection are always "ON"... so i checked and sure enuf My connection was munching away at about 2kb per second... what concers me is Its sending.

I installed a firewall.... actally 2, and i run them seperately (of course) I installed and ran search and destroy and installed Anti Virus and updated and scanned.

i had a few trckers that I deleted and no virous or the like was picked up by my Anti virus protection... and my firewall tells me that

A: im pinging A LOT and
B: im apparently smurfing myself... or burrying myself in my own pings.

Anyone know what I have to turn OFF?

Hellllp please.


I am not running any peer to peer software and i have msm set to NOT start automatically.

note, ive pinged over 1000 times in the time it took to write this tale of woe


grubGrob
xp pro
P3 700e (at 933)
dial up with internal moden with
an over active rubberband ping myself stoopid...
thanks in advance
:cry:

Todd1
12-18-2003, 09:10 PM
grubGrob,

Hello, Todd1 told me about your little problem. I think I can help you. It is possible you ticked off someone or went to a site you should not have and they are pinging you like crasy. Another word for this is DoS (denial of service) attack. A simple fix would be to change your NIC, as your IP address is assigned to you MAC address, and your ISP will give you a differnet IP address and your DoS will stop.

Joeteck

grubGrob
12-18-2003, 10:54 PM
Like i said b4.
Im sending much more than im recieving.
for examople Ive only surfed to this web address www.cgtalk... and done a little looking about and my send is totally active.
When i look at my firewall I notice that ive sent out a lot of pings.

in the time it has taken to write this email... I have a bigger send total tahn I do recieve.

I have infact asked my ISP what I should do also as I am not on an aunlimited account and the wate of Banmdwidth is a waste of time / money

I presume if I ticked some one off id be recieving more pings like a flood of them...

Also my IE cashe is EMPTY.

Thanks for your ideas. I think i like the one about asking for another IP designation

Thakn you

stephen2002
12-19-2003, 12:22 AM
You could always set your firewall to block ping requests and replys.

grubGrob
12-20-2003, 07:28 AM
Thanks, tahts a nice idea....

So i did it... and still my sent is just spewing out to the unknown web....

I did infact shtdown ping and reply to not rply to pings... to no avail... in terns of active connection.

I have also asked my isp to change my ip ... also no luck yet as to a respnce from them either... actually i get alot of pings from their servers ... is UU like that a lot?

thank you steven2002 and todd1

grubGrob
12-20-2003, 07:34 AM
:drool:
Lets say ...when i was 14 i could not spell or read... and now i can... Sorry if my spellerizing is rotten... If you cant understand what im trying to say... Im sorry in advance.... thanks for being tollerant... all I can add is thank evrone that counts for spell check... I never have a problem with writing string theory or alogorithums.

: o )

kwshipman
12-20-2003, 07:49 AM
I am bad at spelling also, so I use this:
http://www.cgtalk.com/showthread.php?s=&threadid=89538

It helps a lot.:thumbsup:

quinox
12-20-2003, 10:34 AM
1) you're on dialup, many times you get a new IP every time you connect. You can check your ip by doing this:

start -> run -> cmd -> ipconfig

(I don't get that NIC shit, that mean the dial-up ISP should have an IP for everybody and thats rare these days, and you can fake a NIC so easy, would that mean you could hijack his IP?... and if the shit is caused by some program locally getting a new IP doesn't fix anything)

2) You can check which programs use a socket (internet connection) by running TCPView (http://www.sysinternals.com/ntw2k/source/tcpview.shtml)
Maybe that helps :/

3) Good luck with it :hmm:

edit: url update

grubGrob
12-20-2003, 11:35 AM
Thank you... ive had a weeee look at that errr application... and with that and TASKINFO .. I managed to turn off a lill dll that seemed to be the cause of it.

I had been cleaning my History , temp and , temporary internet folders totally empty... err after i mannaged to nab all the .css files and .js files... ok so i like the easy way... but you should see all the hard work that goes into making a goot feel on a web page...ANYWAY.

Ive not soved my problem, as it still happens BUT it did show me whats going on. The was deleted but came back on re boot.... ..then on a seperate occasion.. i deleted the dll and my out ...kept on keeping on... So problem was not fixed..


IPCONFIG just flashed in dos and disapeared
so I tried traceroute and soem other ip stuff.. they all worked...

Is it possible RPC is doing this?

Cheers and thanks.
grubGrob

grubGrob
12-21-2003, 01:07 AM
spending a day searching my registry..

I think i might fix this...yet



Stay On target STAY ON TARGET.... "he has swiched of his targeting systen" Thank you quinox

for the tip.

:applause: :beer:

grubGrob

UrbanFuturistic
12-21-2003, 02:06 AM
Have you turned off Client for Microsoft Networks in your connection properties?

hth, Paul

grubGrob
12-21-2003, 08:13 AM
I Have indeed not ticked client for microsoft network.

Only QoS and TCP/IP only


thanks
:thumbsup:

singularity2006
12-21-2003, 08:23 AM
Originally posted by Todd1
grubGrob,

Hello, Todd1 told me about your little problem. I think I can help you. It is possible you ticked off someone or went to a site you should not have and they are pinging you like crasy. Another word for this is DoS (denial of service) attack. A simple fix would be to change your NIC, as your IP address is assigned to you MAC address, and your ISP will give you a differnet IP address and your DoS will stop.

Joeteck

somehow I don't think that's the case in that depending on ISP, ur most likely going to have a dynamic IP. That IP won't stick very long. The only thing that really sticks is the MAC. Getting a new NIC would be a waste of $$.

As for my take on things, the only thing I can think of is a virus. Last time I saw that kind of behavior was one of those viruses, one of the bigger ones that swept the globe in recent history. Your antivirus has probably been already fried if it still hasn't detected the bug by now. Try formatting and install ur antivirus (as well as update it) before u do anything else. Then see what happens.

Sieb
12-21-2003, 09:20 AM
Open a command prompt and type "netstat" (without quotes) and it will show you what ports are curerntly open and to where. Do this right after you boot up and make sure aim or kazaa and stuff isn't running. If you see any odd ports open (1024+) reference them here: http://www.iana.org/assignments/port-numbers. If you have odd stuff going on and you cant issolate it, whipe your system. I don't take kindly to such threats if they happen, its best to whipe clean, if it is bad, who knows whats its done or shared so far.

Keep in mind that your computer and apps on it will regularly ping your loopback which is normal.

grubGrob
12-21-2003, 11:26 AM
I managed to fix my problem...

c:windows/system32/wins/

files in here need to be checked regularly as i font a exe script here called "DLLHOST.exe"

basicly i found this little thing acting like a virus or a spoofing nature... just sending out a lot of pings and chasing its own responces with another ping request and so son..... I found that a neat little program like TCPVIEW could show me what was on its way out ..on ots way in .. and OR being waited for a reply..

its a bit weird for all of a sudden about 100 pings to just go out and then it waits for the reponces... and when it get one it chases out another 100 pings...

So i guess it acted like a virus.
I do not uses peer to peer software and so, have definately not used KAZAA or supernova or any other of the like programs.

I do have TASKINFO that told me that the exe in question is loaded on start up... but not from a line from configsys... so with those 2 programs I could find the little nasty.

I did change the name of the dllhost.exe to somthing very rude and the start up obviously cant find it. So basicly ive fixed it. (but where did it come from?)

THANK YOU FOR ALL YOUR COMMENTS AND HELP.

Mind you I think the isp idea and the DOS idea dont mean much cause ive noticed that I often have a different IP... but it was a nice idea if I had a static IP and I was being FLOODED from outside... but i was flooding myself from the inside.

Cant say I really know what it all means BUT IM LEARNING.

Thank you.:bowdown:

grubGrob

grubGrob
12-21-2003, 11:50 AM
ok i found the official fix

I felt it had to to with PRC

this is the solution but look at both URLS

http://www.microsoft.com/downloads/details.aspx?FamilyID=2354406c-c5b6-44ac-9532-3de40f69c074&displaylang=en


As per usual microsoft dont say SQUAT about what it is or how to fix it manaully cause you know..its microsoft...

But I also found this too .. and its symptoms where infact exactly like this explains...
http://www.pchell.com/virus/welchia.shtml

its a blaster type... oh well... norton can bugger off too... as it did not find it...norton.huh...i should have not installed that anyway... i reckon NOD23 is better and i used to like AVP but I hate the new interface.

Thanks again

GrubGrob

Sieb
12-21-2003, 06:18 PM
Nothing beats an up2date NortonAV as a frontline defence..

CGTalk Moderation
01-17-2006, 12:00 AM
This thread has been automatically closed as it remained inactive for 12 months. If you wish to continue the discussion, please create a new thread in the appropriate forum.