topic Re: ADwin configuration protocol in Tech Help - Software/Hardware etc

ADwin configuration protocol

VileReynard — Fri, 16 Oct 2015 18:24:54 GMT

Does anyone know what this is?
I've got a Windows 8.1 machine emitting one of these every 2 seconds as a broadcast to 255.255.255.255
How do I prevent Windows broadcasting ADwin messages?
I know nothing about Windows 8.

Re: ADwin configuration protocol

Oldjim — Fri, 16 Oct 2015 18:27:50 GMT

Very simple - remove Windows and install Mint or similar

Re: ADwin configuration protocol

VileReynard — Sat, 17 Oct 2015 01:24:03 GMT

It's not mine so I can't remove the malware.

Re: ADwin configuration protocol

nanotm — Sun, 18 Oct 2015 16:23:09 GMT

is it not the windows networking info pinger ?

Re: ADwin configuration protocol

VileReynard — Sun, 18 Oct 2015 22:04:13 GMT

I did a google search for "windows networking info pinger" - which sounds like baby-talk...
There seem to be a variety of things which this thing can do - but they all duplicate existing functionality.
(and sometimes interferes with the ARP protocol).
I will look into it tomorrow whilst it's normal user is out.

Re: ADwin configuration protocol

nanotm — Sun, 18 Oct 2015 23:41:07 GMT

well I know adwin configuration was required back in the pre y2k era on older generation nic's so I cant see why it should be enabled on a new pc unless for some reason its setup to run as part of an adhoc network rather than being part of a normal dhcp controlled domain ....

Re: ADwin configuration protocol

VileReynard — Mon, 19 Oct 2015 00:19:28 GMT

So I have to hack into Windows complicated internet setup.
I hate the fact it doesn't "just work".
Last time I looked it had ip addresses, DHCP, WINS etc etc

Re: ADwin configuration protocol

mossgrove — Mon, 19 Oct 2015 07:16:01 GMT

ADwin appears to be some kind of real-time engineering software see http://www.adwin.de/us/konzept/konzept.html and as such it seems reasonable that it would try to contact its host at short intervals.
Does the owner of the PC know why it is installed?

Re: ADwin configuration protocol

nanotm — Mon, 19 Oct 2015 07:18:18 GMT

ADwin seems like it can be any one of several versions a couple are innocuous though perhaps annoying and the rest are malware, try asking the user if there are any problems on their pc before you start messing with config files

Re: ADwin configuration protocol

VileReynard — Mon, 19 Oct 2015 15:09:39 GMT

I tried switching the Win 8.1 PC on - I didn't change anything - because it was so confusing!
For example I tried going to Config the Wifi - but it claimed to have downloaded about 1.5 GBytes on wifi in the 5 mins I'd had it switched on for.
I eventually managed to look at the network setup and it looked very similar to how I remember it when I used Windows 3.1 (or NT4).
It even had NetBIOS enabled!!!
The PC appears to start and shutdown remarkedly fast, considering it's Windows - so I don't think there are any wholesale virus issues.
But as I say, it all appears to be done just to confuse.

Re: ADwin configuration protocol

ejs — Mon, 19 Oct 2015 17:19:44 GMT

How did you identify it as "ADwin configuration protocol"? As in, is that how wireshark described it, or did you use something else?

Re: ADwin configuration protocol

VileReynard — Mon, 19 Oct 2015 18:14:39 GMT

Purely by what Wireshark says, together with its known ip address and packet contents as shown by Wireshark.
Have to admit it doesn't appear to continuous (i.e. its not doing it right now).

Re: ADwin configuration protocol

ejs — Mon, 19 Oct 2015 19:08:55 GMT

I was wondering if wireshark has identified it wrong - if you expand the details for the packet, you might be able to see if they look "sensible" for the adwin_config, but it's unlikely anyone would know what sensible details are since it sounds like an old and obscure protocol.

Re: ADwin configuration protocol

nanotm — Mon, 19 Oct 2015 19:12:53 GMT

Iirc it's job was similar to neighbour discovery in ipv6, but back in the day of token ring based ad hoc networks

Re: ADwin configuration protocol

VileReynard — Mon, 19 Oct 2015 20:10:18 GMT

It doesn't seem to work very well & it's not needed unless you had a local IPV6 setup.
ARP works perfectly well on a "small" network, especially if you have a single gateway.