Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

svchost.exe


  • Please log in to reply
7 replies to this topic

#1 AviraHelp

AviraHelp

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:07:12 AM

Posted 26 April 2010 - 05:25 PM

When i boot up into windows 7 i notice svchost.exe making several connections to the internet

c:\windows\system32\svchost.exe
udp out 65.55.158.118:3544
udp out 8.8.8.8:53
tcp out 64.4.18.90:80

one of the connections i know is to my dns server
the other 2 i am not sure about, one seems to be a microsoft ip and the other is a hotmail ip
is it normal for svchost to connect to those ips?

i thought it might have to do with microsoft updates, but i turned it off, to never check for updates, but it still connects to those ips.

BC AdBot (Login to Remove)

 


#2 computerxpds

computerxpds

    Bleepin' Comp


  • Moderator
  • 4,457 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:07:12 AM

Posted 26 April 2010 - 05:42 PM

what anti virus do you have (if any)?

sigcomp.png 
If I have replied to a topic and you reply and I haven't gotten back to you within 48 hours (2 days) then send me a P.M.
Some important links: BC Forum Rules | Misplaced Malware Logs | BC Tutorials | BC Downloads |
Follow BleepingComputer on: Facebook! | Twitter! | Google+| Come join us on the BleepingComputer Live Chat too! |


#3 AviraHelp

AviraHelp
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:07:12 AM

Posted 26 April 2010 - 05:51 PM

using avira antvir and threatfire
ondemand i have hitman pro, malwarebytes, asquare free, and windows defender

#4 computerxpds

computerxpds

    Bleepin' Comp


  • Moderator
  • 4,457 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:07:12 AM

Posted 26 April 2010 - 05:54 PM

ok well if they are not detecting anything then i would not worry about it very much, svchost.exe is one of those vital windows programs that are important but runs and does different things on every system. I think you should be ok. if you are worried then I would post in the Am I Infected. section but i think your fine. :huh:

sigcomp.png 
If I have replied to a topic and you reply and I haven't gotten back to you within 48 hours (2 days) then send me a P.M.
Some important links: BC Forum Rules | Misplaced Malware Logs | BC Tutorials | BC Downloads |
Follow BleepingComputer on: Facebook! | Twitter! | Google+| Come join us on the BleepingComputer Live Chat too! |


#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:04:12 AM

Posted 26 April 2010 - 05:55 PM

65.55.158.118 - Microsoft
8.8.8.8 - Google
65.55.158.118 - Hotmail

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#6 AviraHelp

AviraHelp
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:07:12 AM

Posted 26 April 2010 - 06:06 PM

the only connection i am kinda worried about is the connection to hotmail ip

why would svchost.exe need to connect to a hotmail ip???

#7 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,613 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:04:12 AM

Posted 26 April 2010 - 06:10 PM

I'm not sure. If you're worrying about your computer security, you can always start new topic at "Am I Infected?" forum :huh:

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#8 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:12 AM

Posted 27 April 2010 - 02:38 PM

When i boot up into windows 7 i notice svchost.exe making several connections to the internet

c:\windows\system32\svchost.exe
udp out 65.55.158.118:3544
udp out 8.8.8.8:53
tcp out 64.4.18.90:80

one of the connections i know is to my dns server
the other 2 i am not sure about, one seems to be a microsoft ip and the other is a hotmail ip
is it normal for svchost to connect to those ips?

i thought it might have to do with microsoft updates, but i turned it off, to never check for updates, but it still connects to those ips.



The UDP to Google is a Name Server Query

The TCP to Hotmail on port 80 is a web activty.

I would run http://www.malwarebytes.org/mbam.php and http://www.superantispyware.com and post the results here or if you have already in your Am I Infected thread.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users