Nosey Windows Programs

Anyone else had stuff like this? Sometimes I get an alert that some windows utility or program is trying to send something through TCP/IP, and it just doesn't make any sense for the program to do so. For instance...

Outgoing ICMP type 8 (ping) from xxx.xxx.xxx.90 to xxx.xxx.xxx.91 (my computer is xxx.xxx.xxx.90)... but guess what program! Disk Defragmenter! (c:\windows\defrag.exe). Now why would microsoft make a disk defragmentation program that pings the next address after your own?

Anyone else have examples to post? I had a few other weird ones, but I don't think I kept the particulars.

I had the same thing happen with defrag...at the time I just ignored it assuming it was just some random bug in my firewall, but if its happened to others too maybe not....

Just a thought... Windows always wants to know which items you've got under 'My Computer' (local disks, my favourite network places, ...)

Could defrag be checking if any of those are online?

Yes ive had something similar happen (i cant remember what it was, but it makes you think why they need to access the net)

..Just curious..i got win2k the other week and My services and controller applications (C:WINNT\system32\services) likes to go net bound, whats is this proggie for exactly...n why does it need to go net bound ?

anyone

Quote:

---

Originally posted by Terr
Anyone else had stuff like this? Sometimes I get an alert that some windows utility or program is trying to send something through TCP/IP, and it just doesn't make any sense for the program to do so. For instance...

Outgoing ICMP type 8 (ping) from xxx.xxx.xxx.90 to xxx.xxx.xxx.91 (my computer is xxx.xxx.xxx.90)... but guess what program! Disk Defragmenter! (c:\windows\defrag.exe). Now why would microsoft make a disk defragmentation program that pings the next address after your own?

Anyone else have examples to post? I had a few other weird ones, but I don't think I kept the particulars.

---

Well weird, have you scanned the file for virii? (no offence) but it could be a malicious program thats replaced disk defrag. alternatively it could be checking your network neighbourhood?/network places, was the other ip local?

What type of ISP do you have somtimes it's the ISP making sure that you are still connected, they have two options one is to ping you another is to have you ping them. It happens to my mom alot because she uses AOL so it's kind of ****ed up. Anyway that might me it. If you type in netstat and you see a whole bunch of
time_wait's then that might be what it's doing. It's a connection thing.

But it could be viruses, a hacker, trojan, anything it just sounded familiar and thought I would provide some glass is half empty insight.

i too think its a trojan under the name defrag

Terr,

Yeah I've had some pretty strange stuff happen too, here is a few that I've had happen to me:

1. When I used to run Tiny, I had something similiar to what you are describing happen, but off hand I don't remeber what it was...

2. When running ZA and I started IE I would get an alert that asked if I would allow "Distributed COM Services".
This turned out to be RPCSS.exe which is installed with M$ Visual Studio! (If anyone had this problem and was wondering why, I have a few great sources on RPCSS for those who are interested.)

3. When running ZA and starting IE for the FIRST time after a reboot, I would do a netstat -a and find an entry that said the following:
TCP SimonTempler:1027 localhost.UU.NET:1027

Haven't researched into that one yet...

Just some of the few nosey windows programs I have encountered :)

Just to clarify, I was actually RUNNING defrag at the time, and if it *is* a trojan, it certainly does a pretty decent job of defragmenting my system and integrating itself with windows, while replacing the original (and valid) c:\windows\defrag.exe...

Oh, and it looks exactly the same too, and it was last-modified sometime in 1998. :D

No, I don't think it is a trojan.

*Maybe* the defrag is trying to ping out to see if there are any drives mapped on a network and tries to remotely execute a defrag on another PC (i.e. if you have it in scheduled tasks). Just a thought though.

If you are using defrag for windows 2000, you have to remember that you can defrag remote partitions over network. I don't know why it would ping another computer, but I'm positive it has some network code in it for remote administration of this type. I've never tried it myself, but I do remember it being there in the manager menu to defrag remote computers from a server.

Hope that helps :)

Ok, just checked it's part of the "Microsoft Management Console" to defrag over computers over the network. Hmm, this may make my job easier will give this a try at work :D

I always find refences to windowsupdate in squid (my web cache), and i'm damn sure i hadn't used windows update in a while, or at all for that matter as windows update is always a week behind with essential patches, but i digress - windows does seem to "phoning home" from time to time - not sure why.

Quote:

---

Originally posted by petemcevoy
I always find refences to windowsupdate in squid <snip> windows does seem to "phoning home" from time to time - not sure why.

---

Uninstall the Windows Critical Update Notification I had the same thing (before I used squid) and only found it with tcpdump.

J.

Thanks for the tip jcdux, but it doesn't seem to be installed - maybe its my defragger ;-)

Well, I never did install that critical update doodad for precisely that reason... I don't trust them, I'll patch it all when I'm good and ready! :D Well, This is in Windows 98... At any rate, I just found it an odd thing for them to think of. As for Microsoft Management Console, Is that for 9x or NT/2000? The originating program was the actual defrag.exe program... (Unless someone is using an extremely creative and foolish implementation of TooLeaky or something :D )