Forum Home
Press F1
 
Thread ID: 53042 2005-01-06 04:30:00 Welchia_ICMP_Scan Mike (15) Press F1
Post ID Timestamp Content User
311098 2005-01-06 04:30:00 Norton Internet Security keeps giving me "High Risk" Security Alerts about attempted "Welchia_ICMP_Scan" intrusions in my PC.

However the intruder is my computer (it shows my computer name, with my local IP address in brackets).

Various scans (spy/ad/virus etc.) show nothing. Is this just an incorrectly identified activity, or is there something on my PC doing something nasty?

XP Pro SP2 (fresh install last week, and fully updated)
NIS 2003 fully updated
NAV 2003 fully updated

Mike.
Mike (15)
311099 2005-01-06 04:37:00 Sit back make a coffee or what ever and Have a look thru this lot to see if you can find a fix

www.google.com
hth
johnboy (217)
311100 2005-01-06 04:44:00 Just turn the alerts off. ninja (1671)
311101 2005-01-06 04:48:00 Just turn the alerts off.
Why would I want to do that? Then I won't know if something actually needs to be looked at. If this is nothing, then I can adjust it, but if it is something that needs fixing, then I want to know what and how.

Mike.
Mike (15)
311102 2005-01-06 05:06:00 The first result in a Google search for your problem has a couple of users who say the problem started after an update was installed through Live Update.

They say it's the "Keep Connection Alive" setting, sending pings out to websites that they had bookmarked in order to keep the internet connection established.

It also says to try using Symantec's Welchia removal tool.
agent (30)
311103 2005-01-06 05:07:00 Interesting. I read some of the results from Johnboy's google search, and found a common link - Yahoo Messenger. It appears Yahoo Messenger likes to phone home... a lot... I've just recently started using Yahoo Messenger, and the alerts have only recently started.

I think I might stop using Yahoo Messenger :)

Mike.
Mike (15)
311104 2005-03-06 20:22:00 It does appear that YM! likes to phone home more than most apps. I'm going through the same problem with my NIS, so I am going to try Trillian to see if I keep getting the same message. Might be a bug in the YM engine :badpc: EvilHomerGD (6794)
1