cidaemon.exe is trying to send a packet

Discussion in 'Computer Support' started by zaax, Dec 9, 2004.

  1. zaax

    zaax Guest

    Why is Indexing Service filter daemon wishing to access the internet /
    network and who or what is at ff.ff.ff.ff.ff.ff


    Parent Process :
    C:\WINDOWS\system32\cisvc.exe
    Parent Version : 5.1.2600.2180
    Parent Description : Content Index service
    Parent Process ID : 0x9C (Heximal) 156 (Decimal)


    File Version : 5.1.2600.0
    File Description : Indexing Service filter daemon (cidaemon.exe)
    File Path : C:\WINDOWS\system32\cidaemon.exe
    Process ID : 0x994 (Heximal) 2452 (Decimal)

    Connection origin : local initiated
    Protocol : Raw Ethernet
    Local Address : 0.0.0.0
    Local Port : 0
    Remote Name :
    Remote Address : 0.0.0.0
    Remote Port : 0

    Ethernet packet details:
    Ethernet II (Packet Length: 56)
    Destination: ff-ff-ff-ff-ff-ff
    Source: 00-26-54-10-da-49
    Type: ARP (0x0806)
    Address Resolution Protocol (ARP)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: Request
    Sender hardware address: 00-26-54-10-da-49
    Sender IP address: 192.168.0.2
    Target hardware address: 00-00-00-00-00-00
    Target IP address: 192.168.0.3

    Binary dump of the packet:
    0000: FF FF FF FF FF FF 00 26 : 54 10 DA 49 08 06 00 01 |
    ........&T..I....
    0010: 08 00 06 04 00 01 00 26 : 54 10 DA 49 C0 A8 00 02 |
    ........&T..I....
    0020: 00 00 00 00 00 00 C0 A8 : 00 03 F3 5F 60 D4 A0 10 |
    ............_`...
    0030: FF FF E6 5F 00 00 01 01 : | ..._....
    Parent Process :
    --
    Zaax
    http://www.ukgatsos.com
     
    zaax, Dec 9, 2004
    #1
    1. Advertising

  2. zaax

    Richard Guest

    zaax wrote:

    > Why is Indexing Service filter daemon wishing to access the internet /
    > network and who or what is at ff.ff.ff.ff.ff.ff


    The file itself is a valid windows file intended on making file searching
    faster.
    However, some viruses have found ways to utilize it.
    You may want to scan your machine for a virus.
     
    Richard, Dec 9, 2004
    #2
    1. Advertising

  3. zaax

    Guest

    On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:

    |> Why is Indexing Service filter daemon wishing to access the internet /
    |> network and who or what is at ff.ff.ff.ff.ff.ff

    |> Sender hardware address: 00-26-54-10-da-49
    |> Sender IP address: 192.168.0.2
    |> Target hardware address: 00-00-00-00-00-00
    |> Target IP address: 192.168.0.3

    You got two computers set-up here?


    --
     
    , Dec 9, 2004
    #3
  4. zaax

    zaax Guest

    In article <>,
    writes
    >On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:
    >
    >|> Why is Indexing Service filter daemon wishing to access the internet /
    >|> network and who or what is at ff.ff.ff.ff.ff.ff
    >
    >|> Sender hardware address: 00-26-54-10-da-49
    >|> Sender IP address: 192.168.0.2
    >|> Target hardware address: 00-00-00-00-00-00
    >|> Target IP address: 192.168.0.3
    >
    >You got two computers set-up here?

    Yes on a network via a Router. That's a thing.
    Why is it trying to access another computer on the net work.
    BTW Norton says it's not virus infected.
    --
    Zaax
    http://www.ukgatsos.com
     
    zaax, Dec 9, 2004
    #4
  5. zaax

    Guest

    On Thu, 9 Dec 2004 19:35:20 +0000, zaax <> wrote:

    |> In article <>,
    |> writes
    |> >On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:
    |> >
    |> >|> Why is Indexing Service filter daemon wishing to access the internet /
    |> >|> network and who or what is at ff.ff.ff.ff.ff.ff
    |> >
    |> >|> Sender hardware address: 00-26-54-10-da-49
    |> >|> Sender IP address: 192.168.0.2
    |> >|> Target hardware address: 00-00-00-00-00-00
    |> >|> Target IP address: 192.168.0.3
    |> >
    |> >You got two computers set-up here?
    |> Yes on a network via a Router. That's a thing.
    |> Why is it trying to access another computer on the net work.

    Right off hand I'd say it's index'g with the other. Maybe you have it
    set up to SYNC with it, or you've got FAST FIND enable'd.


    |> http://www.ukgatsos.com

    Nice public service by the way.


    --
     
    , Dec 9, 2004
    #5
  6. zaax

    dabobman Guest

    gotta go with penny on this one:
    the ff´s are a broadcast address so if it's broadcasting on the lan side ,
    it's prolly a fast find thing in this case. lil help on the opsys, but i'm
    guessing 2k or xp, so just get into services and tweak that sucka. ergo:
    admin tools->services->indexing service-> and then stop, disable, or set to
    manual on the general tab.

    o and i ain't sure what internet slash network is supposed to mean, but if
    it means that the broadcasts are showing up at the router, it could be cause
    your arp cache aint resolving the 2nd target hw address (hence the 12
    "0's").
    arp "who-has" packets are vital to the proper functioning of a local
    area network--it's how each host finds the MAC address associated with
    each IP on the network.
    I've seen some viruses lately trying to forge their ip/mask, maybe this
    is the cause, so make sure you're clean,and then
    disabling the service should put ya back in the land of mu...


    --
    Bob Shivers, MCSE
    Boligens Bredbånd Installation (BBI)
    A Division Of
    Shivers Systems Security Corp. (3SC)
    Telefon / Fax : 35 39 35 45
    Mobile : 26 53 27 07
    CVR Nr. : 2708 4273
    www.bbi.3sc.dk/pr01.htm
    hnic@bbi.3sc.dk
    <> wrote in message
    news:...
    > On Thu, 9 Dec 2004 19:35:20 +0000, zaax <> wrote:
    >
    > |> In article <>,
    > |> writes
    > |> >On Thu, 9 Dec 2004 17:39:02 +0000, zaax <> wrote:
    > |> >
    > |> >|> Why is Indexing Service filter daemon wishing to access the

    internet /
    > |> >|> network and who or what is at ff.ff.ff.ff.ff.ff
    > |> >
    > |> >|> Sender hardware address: 00-26-54-10-da-49
    > |> >|> Sender IP address: 192.168.0.2
    > |> >|> Target hardware address: 00-00-00-00-00-00
    > |> >|> Target IP address: 192.168.0.3
    > |> >
    > |> >You got two computers set-up here?
    > |> Yes on a network via a Router. That's a thing.
    > |> Why is it trying to access another computer on the net work.
    >
    > Right off hand I'd say it's index'g with the other. Maybe you have it
    > set up to SYNC with it, or you've got FAST FIND enable'd.
    >
    >
    > |> http://www.ukgatsos.com
    >
    > Nice public service by the way.
    >
    >
    > --
     
    dabobman, Dec 10, 2004
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Yehavi Bourvine
    Replies:
    0
    Views:
    609
    Yehavi Bourvine
    Aug 1, 2004
  2. Bun Mui
    Replies:
    3
    Views:
    8,189
    Duane Arnold
    Apr 30, 2004
  3. lfnetworking
    Replies:
    3
    Views:
    5,038
    lfnetworking
    Aug 27, 2006
  4. mediumkuriboh
    Replies:
    0
    Views:
    1,606
    mediumkuriboh
    Feb 9, 2009
  5. RF
    Replies:
    6
    Views:
    1,515
Loading...

Share This Page