TCP Packet Flooding

[Pronet]

On one of our Windows 2000 servers we are having a big problem with it sending out Thousands of TCP packets every second and flooding the network.

This server, has been running fine for about 18 mo
nths, then all of a sudden this started. Once we reboot it it will run for anywhere between 45 minutes and 8 hours before it starts again.

I have ran virus scan and it did not detect a virus. I have used TCPView and have found that the process is starting for SYSTEM:8 when I try to query the process TCPView responed "query not available".

All updates and service packs have been applied. I have checked for unusual services and checked the registry under "run" for anything that does not belong there. This flooding is shutting down our server and gateway router. The server is sending out the tcp packets to a wide range of public IP Addresses. How do I stop the server from doing this, if I do not know what the worm or trojan horse is causing this? Please Help!!

 

[netometer]

Hi!
I've had this before with a bad Network Card which was flooding the network with broadcasts.
Can you capture the packets which this server is sending and post here a couple of them? (Probably the easiest tool availbale is the Network Monitoring Tools which come with W2k or you can have a look at Ethereal)
If you have a spare Network Card you can try to disable/replace temporary the one which is broadcasting.

NetoMeter

http://www.netometer.net

 

[Pronet]

Our server is flooding our network by sending many tcp packets to public addresses . They are SYN_Sent packets that await an acknowlegment "ack". At times if you issue a netstat -an command you can see some of these IP Addresses as being established to our server. The latest IP addresses that our server is communicating with is 66.66.66.66.

 

[ricpinto]

I have this issue before with Veritas BE ver 9 and Cisco 1702 router, that's why I'm still on 8.6

 

[dholbrook]

The address in question is from roadrunner in Virginia, which has caused me much grief in the past from hijacking. It sounds like the system is a robot and is being used. I would strongly suggest you take it offline and use a different antivirus program to scan the system. WHile the net card may still be a problem, the fact that it uses a specific address smells of trojan infection or a spyware infection.

I would install and run CWShredder.exe, then SPYBOT Search and Destroy, then AdAware software, in that order, to scan your systems to see what spyware garbage is on the system. You find all these free programs using Google to find cwshredder and SpyBot S&D web sites. AdAware is available free from

http://www.lavasoft.de

(note: it is .de, NOT .com). Make sure you get the latest version of all three tools. SpyBot S&D, with the latest update finds over 15,000 items to check.

Let us know what you find.

HTH

David

 

[Pronet]

Found wintask.exe in the registry with Trojan Remover. Hope this is the problem. Will know by tommorrow. Thanks for all the help..