View Full Version : Welchia_ICMP_Scan

06-01-2005, 05:30 PM
Norton Internet Security keeps giving me "High Risk" Security Alerts about attempted "Welchia_ICMP_Scan" intrusions in my PC.

However the intruder is my computer (it shows my computer name, with my local IP address in brackets).

Various scans (spy/ad/virus etc.) show nothing. Is this just an incorrectly identified activity, or is there something on my PC doing something nasty?

XP Pro SP2 (fresh install last week, and fully updated)
NIS 2003 fully updated
NAV 2003 fully updated


06-01-2005, 05:37 PM
Sit back make a coffee or what ever and Have a look thru this lot to see if you can find a fix


06-01-2005, 05:44 PM
Just turn the alerts off.

06-01-2005, 05:48 PM
Just turn the alerts off.
Why would I want to do that? Then I won't know if something actually needs to be looked at. If this is nothing, then I can adjust it, but if it is something that needs fixing, then I want to know what and how.


06-01-2005, 06:06 PM
The first result in a Google search for your problem has a couple of users who say the problem started after an update was installed through Live Update.

They say it's the "Keep Connection Alive" setting, sending pings out to websites that they had bookmarked in order to keep the internet connection established.

It also says to try using Symantec's Welchia removal tool.

06-01-2005, 06:07 PM
Interesting. I read some of the results from Johnboy's google search, and found a common link - Yahoo Messenger. It appears Yahoo Messenger likes to phone home... a lot... I've just recently started using Yahoo Messenger, and the alerts have only recently started.

I think I might stop using Yahoo Messenger :)


07-03-2005, 09:22 AM
It does appear that YM! likes to phone home more than most apps. I'm going through the same problem with my NIS, so I am going to try Trillian to see if I keep getting the same message. Might be a bug in the YM engine :badpc: