Why is ASC sending pings?

[sellerthorpe]

I've noticed some strange network traffic as of late, and I've traced it back to Advanced SystemCare. What happens, is that while ASC is running, there is a background echo request(ICMP type 8) being sent to Google's DNS server (8.8.8.8). Closing ASC down stops this behavior, as does uninstalling it. If ASC is running in the tray however, it does this continuous ping on your network.

 

I've noted this in out firewall logs and in network snoops. I can reproduce this at any time by simply running ASC and pulling system logs from the network.

 

What purpose is this serving other than to bog down the network link? Has anyone else seen this behavior?

[solbjerg]

Hi sellerthorpe

My guess is that you have chosen to automatically check for definition updates in the settings. You could try to choose the setting where it checks for updates when you start the program.

See if this exhibits the same behaviour.

Cheers

solbjerg

 

 

I've noticed some strange network traffic as of late, and I've traced it back to Advanced SystemCare. What happens, is that while ASC is running, there is a background echo request(ICMP type 8) being sent to Google's DNS server (8.8.8.8). Closing ASC down stops this behavior, as does uninstalling it. If ASC is running in the tray however, it does this continuous ping on your network.

 

I've noted this in out firewall logs and in network snoops. I can reproduce this at any time by simply running ASC and pulling system logs from the network.

 

What purpose is this serving other than to bog down the network link? Has anyone else seen this behavior?

[Toppack]

My guess is that it is the 'Vulnerability Fix' utility,

which accesses a Server somewhere, but I assumed it was at Microsoft, not Google?

(I don't think Google has the DNS server though, so I don't see how Google is involved?)

 

You could disable that utility, by removing check-mark, and see if it changed.

[sellerthorpe]

I have tried disabling all automatic updates, and also the "vulnerability fix". No luck. Every 10 seconds, the software sends a ping out.

 

I can see it doing actual DNS queries for these updates, but constant pings?

[lenny10]

I have noticed the same behavior. Even if I turn off the ASC5 auto-updates it still does a ping constantly. My guess is that ASC5 is connecting to the Iobit validation server to validate the Pro license. However it seems to do this even with the Free version. Big question is what other information from the user's computer gets sent out to Iobit? Does ASC5 act as a snooper program and sends information to Google or other entity to be used as targeted advertising or simply just sends personal information for some other use? Only way to find out is to use WireShark and examine the ASC5 packets going out. The only one that knows about this is Iobit and I assume that it is a secretive issue that will be denied and never revealed to the general public. However to make clients feel safe I would recommend that Iobit removes this in the next versions before someone finds out something bad which will negatively affect IoBit's business. As they say 'all things come to light in due time'. Lets stay tuned.

[Toppack]

I can not think of any reason for it to happen every 10 seconds??? :shock: :!:

But my guess is that ASC process is just checking to see if there is still a connection to the Internet?

[Lyon275]

Hi, ASC 5 Has a new Cloud Tehnology so its always connected to the cloud servers . Cloud server gives latest rules and database for ASC 5 so my guess its pinging because of that :mrgreen:

When you open ASC 5 you can see in the left bottom corner "Cloud Online"

[Toppack]

But is Every 10 seconds Normal :?:

I could understand it if it was Full Security software,

but updating once a day, or so, and at start-up, seems sufficient for the utilities in ASC?

[lenny10]

Just to add to my previous message. Not only ASC5 is pinging every 10 seconds but it bypasses your firewall and is communicating with the Iobit IP through several ports. I won't mention here which ones - but Iobit is probably smiling at this message ;)

Soon enough clients will sniff the packets out with several available tools and it will not end well if the information passed to Iobit is not supposed to be.

Please respect the client privacy Iobit. This is very important to every client using your products.

[Melvin_Deal]

Hi lenny10!

 

I am most curious about this behaviour! Is there software you might suggest for me also to monitor and observe... then post back. (I am ignorant of how to monitor connections... though I know the importance)

 

Sincerely,

-Mel

Live long and prosper

[Sarakael]

@sellerthorpe

 

Thanks for let us know !

I just blocked the outgoing pings (I hope).

 

http://www.bilderkiste.org/show/original/4132412599687/Unbenannt2.png

 

This and the annoying attempts of ASCTray.exe to create a startup entry

are not suitable to make me happy ... :-|

 

Sarakael

[Toppack]

I am most curious about this behaviour! Is there software you might suggest for me also to monitor and observe... then post back.-Mel

Live long and prosper

 

I remember a utility called MMC, that comes with Windows,

that I think has the ability to block outgoing pings.

It can be run from Command-line, (just type mmc)

I've never used it for that, and I remember it was very difficult to figure out. :sad: Without Instructions.

 

There are other software programs that monitor that but most have to be purchased.

(Some have 30-day free trial though)

[Toppack]

I found these instructions for MMC, but have not tried them yet:

http://www.petri.co.il/block_ping_traffic_with_ipsec.htm

[Toppack]

I found this Ping-monitor that might actually be free:

http://emcosoftware.com/ping-monitor

[Toppack]

I'm Not seeing those Pings, with the Emco monitor ???

???

Either it does not have the correct capability,

I'm not using it correctly

or ASC is Not Pinging.

[Toppack]

Nope, it appears that the EMCO monitor does Not monitor Outgoing pings,

evidently it only sends pings to monitor the ability to do so.

So it won't do what we need. :sad:

[Melvin_Deal]

Thank you Toppack for your efforts here. After looking at Sarakael's screen shots the pings are not at the same intervals as reported by the first poster. This could be due to the fact that she was interacting with the software and thus altered the behavior of it. Perhaps Sarakael would be so kind as to advise us of a monitoring software???

 

She appears to have discontinued the cloud service as part of her plan to stop the pings. It now seems to attempt a ping every 3-8 seconds now that she has blocked it!

 

-Mel

[Melvin_Deal]

Relevant.

 

I think this thread may be relevant to the pings.

 

http://forums.iobit.com/showthread.php?t=12070

 

-Mel

[Sarakael]

Thank you Toppack for your efforts here. After looking at Sarakael's screen shots the pings are not at the same intervals as reported by the first poster. This could be due to the fact that she was interacting with the software and thus altered the behavior of it. Perhaps Sarakael would be so kind as to advise us of a monitoring software???

 

She appears to have discontinued the cloud service as part of her plan to stop the pings. It now seems to attempt a ping every 3-8 seconds now that she has blocked it!

 

-Mel

 

Hello

 

no problem - I use COMODO Security Premium.

You can create a 'block order' in the firewall settings.

 

Please have a look to ...

 

 

http://www.bilderkiste.org/show/original/7132421153167/Unbenannt.png

 

Relevant.

I think this thread may be relevant to the pings.

 

http://forums.iobit.com/showthread.php?t=12070

I've installed the 'Important Patch' - nothing has changed for me.

I've also disabled the ASCService but ASCTray.exe still creates a startup entry at every time I open ASC.exe. :?

 

Have a nice day

Sarakael

[sellerthorpe]

I actually found this issue using our external firewall. I am not aware of any Windows software to monitor it. I attached a snip of what started me on the path to finding out why the software is doing this.

 

I am glad to see I'm not the only one experiencing this though. I will do a more thorough investigation to see what other network packets are being sent out from ASC...

[Toppack]

Apprears to be 'Google' doing it, Not ASC ?

[sellerthorpe]

Apprears to be 'Google' doing it, Not ASC ?

 

Google's DNS servers (8.8.8.8) are the destination. ASC is the process sending the pings. I only snipped the traffic data as it is what started me on the path to find out what ASC is really doing here.

[Melvin_Deal]

The pings are not there for me though by looking at my system I have completely disabled ASC.

 

I will launch ASC5, then close and see if they (the pings begin) (through Sarakaeel's advisement). (Thus allowing the background services not user selected to continue to run)

 

-Mel

[Melvin_Deal]

The pings are there. In a controlled environment. Every 2-3 seconds. Originating with ASC to a Google server.

 

-Mel

[Toppack]

Very Strange! :shock:

I can Not think of any reason ASC would need to do that? :roll: