Huge ICMP Traffic from W2K server

[Copierbw]

I have realized that our server are sending out a huge amount of ICMP traffic onto the network.
Can anyone please tell me what might caused this ICMP traffic and how to stop it. I have run numerous Trojan detectors, virus etc and none come up with anything... Help appreciated..

You don't need eyes to see just the vision because there are always more ways and different answers to what we are used to...

 

[Srkey]

I had same problem with DOS attacks. Someone was endlessly pinging ISPs router from my clients NIC.Enhanced ICMP traffic could also be 'caused by low-quality connection apropos large number of droped or faulty packets.

 

[CasDeTroy]

I dont know if you realise that was the main intent of the Msblaster worm.

Can you disble ICMP on your core switches and router?

Make sure the server is patched up real good with all the MS security updtes and running the latest DAT file for your AVSW.

Ö¿Ö

 

[alfalfa6945]

Try downloading a tool called fixwelch.exe from symantec.
It certainly sounds like the welchia virus, and yes it is a variant of the blaster.

 

[oldcoach]

I think the patches will prevent infection but not clean it up. Look in your C:\WINNT\system32\wins folder. The virus drops some .exe's DLLHOST and SVCHOST. These are probably the problem. Here is some more info...

http://vil.nai.com/vil/content/v_100559.htm