Ping just won't stop!

[LordZeppelin]

Okay...so I've noticed that I've been slowing down lately (not my net connection, but my PC in general). So I CTRL-ALT-DEL to see what I have running, and there are about 7-10 instances of Ping open- then my Zonelabs firewall kicks in and tells me it's trying to access my subscriber (att broadband cable). Even after closing the program through the CLose program panel, it opens up another one to replace it. So now I'm constantly getting pinged, and it's killing me.

So what the hell is going on here? I did a full virus scan, ran an anti-spyware program, and even checked the registry, but it keeps popping up, and has 7 or more open all the time. Anyone have any ideas on what I should do? I searched to try to find out if there's some sort of hidden program that is opening these all, and to no avail. Is it possible the ping.exe program itself is crrupted and won't shut down?

 

[LordZeppelin]

SO I guess no one has any idea?

 

[DaiShan]

did you upgrade your virus definitions? also maybe zone alarm has a problem with it, have you tried taking it out of the startup, and seeing if that helps? also can we get your OS and the specs of your system? I'm sure someone here can answer this!

 

[BreakApart]

What OS is that machine using? Do you have IIS installed?

Sounds like someone is using you in a "ping flood"= denial of service attack.

 

[DaiShan]

yah I didn't think of that, that is a very good possibility since he is using cable, I would like to retract my previous advice in that case and don't disable your firewall.

 

[LordZeppelin]

Here's my specs...

Win ME, P3 550, 512Mb Ram, Norton Antivirus, ZoneLabs Firewall, ATT Broadband Cable Modem.

I too think that someone is trying to pull some crap, as the Zonelabs firewall has been stopping a bunch of transmissions from some random brazillian website. I've tried running both the Virus Scan (norton) and anti-spyware(spy-blocker and adaware) to no avail, as both have come up empty.


by the way...maybe I'm missing something, but for the life of me I can't figure out what IIS is, so I can't answer that.

 

[GregANDTCH]

Why not unplug your cable modem & see if the
"ping" instance's stop?

 

[BreakApart]

Another thing you could try... using a boot disk or other clean boot option so the pinging doesn't start, rename ping.exe to something else like- spring.exe This way whatever is causing the pinging shouldn't be able to find the ping program, but you'll still be able to use it if you need.

This should at least buy you some more time to find whatever is loading ping.exe so you can delete it.

 

[FPSguy]

It sounds like the old Ping virus. Are you sure your virus definitions are up to date?

 

[LordZeppelin]

Yes, my virus defs are from 02.07.02. I think I'm going to try the renaming strategy, as it is one that I had not thought of thus far...

Anyone have any anti-spyware reccommendations?

 

[WarCon]

I use ad-aware and really like it.

 

[n0cmonkey]

netstat -an

That should show the ips and ports that you are connected to (and are connected to you ). Look for anything suspiscious. Its best to do this after a reboot when you arent doing anything on the machine, and then again later without a reboot when you arent doing anything on the machine.

 

[LordZeppelin]

<< netstat -an

That should show the ips and ports that you are connected to (and are connected to you ). Look for anything suspiscious. Its best to do this after a reboot when you arent doing anything on the machine, and then again later without a reboot when you arent doing anything on the machine. >>



Gracias! I'll be trying that this evening. Hope I figure it the hell out...