Suspicious ICMP Traffic

[leonard leffand]

We have several Windows 2000 workstaitons across our
enterprise that are putting out heavy ICMP traffic. They
are all patched with SP4 and the latest hot fixes for
Blaster and for Nachi. McAfee reports no viruses on these
machines. Yet they are continuiously pinging a random
series of addresses.

Also when we turn off the DHCP Client Service on the
affected workstations, the problem goes away. Is this a
Windows bug? A new virus?

Any ideas?


Please reply directly to (e-mail address removed)

Thank You.

Lenny Leffand

 

[Ricardo M. Urbano - W2K/NT4 MVP]

Sure sounds like Blaster or Welchia. Are you certain the 823980 hotfix
is installed? Also, have you run the Blaster and Welchia cleaning utils