wokkiedokkie 0 Posted December 8, 2013 Share Posted December 8, 2013 All of a sudden, ESS firewall is asking permision for the PING command. It requests access to the two DNS servers of my ISP. When I look in task manager, I see the command: c:\windows\system32\ping.exe time.windows.com /n 2 Anyone any ideas what is happening here, is it safe? Link to comment Share on other sites More sharing options...
Arakasi 549 Posted December 8, 2013 Share Posted December 8, 2013 Well dns is used for converting ip to hostname and visa versa. So if your sending out ping time.windows.com then its job is to look on the world wide web and find it, then issue back the address for you 10.x.x.x where do you see this "c:\windows\system32\ping.exe time.windows.com /n 2" in task manager ? As a process ? As a service ? Your DNS servers are not going to be harmful. You could try adding them to the exclusions list in ESS and then reproducing the connection to windows time servers by clicking "change date and time" from the clock and then selecting Internet time tab. Report back your findings please . . . Link to comment Share on other sites More sharing options...
Nizrax000 2 Posted December 11, 2013 Share Posted December 11, 2013 The only things I've saw run commands like this were script kiddie style trojan droppers. Link to comment Share on other sites More sharing options...
wokkiedokkie 0 Posted January 5, 2014 Author Share Posted January 5, 2014 Using process explorer, I found the following process tree: wininit.exe -> svchost.exe -> sdiagnhost.exe -> ping.exe Does this mean anything? Perhaps anything malicious? Link to comment Share on other sites More sharing options...
wokkiedokkie 0 Posted January 5, 2014 Author Share Posted January 5, 2014 P.S. when I change the time and then synchronize again, I do not get any requests from the ESS firewall. Link to comment Share on other sites More sharing options...
Recommended Posts