Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Svchost.exe Help / Question


  • Please log in to reply
4 replies to this topic

#1 abyss56

abyss56

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:59 AM

Posted 05 July 2007 - 06:41 PM

Ok so I use my laptop for work and I move around alot. Recently, I went into my routers config page and under 'virtual servers' (port forwarding and stuff) it lists this entry:

Svchost.exe(192.168.1.3:xxxx) and some random port numbers

192.168.1.3 is my IP
Is this normal? I figure there might be a virus or something of the like...
I'd post a pic if I could - I will get a screenshot if need be.

Moderator Edit: Moved topic to the more appropriate forum. ~ Animal

Edited by Animal, 05 July 2007 - 09:25 PM.


BC AdBot (Login to Remove)

 


m

#2 Monty007

Monty007

  • Members
  • 1,151 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Australia
  • Local time:03:29 PM

Posted 07 July 2007 - 02:56 AM

Now I have never heard of that (Svchost.exe) in open ports. Have you run a full virus/ spyware scan? Does it appear in your firewall excptions? I would not let it open any ports in my router!
MCP
MSDST

#3 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:11:59 PM

Posted 07 July 2007 - 08:14 AM

I am not sure about a LAN but when an internet IP address cannot access port 80 (HTTP) that is how you redirect it to another port. :80 is the default. Some ISPs block port 80, 21, 25 to limit their members from running servers from residential broadband (Cable, DSL, ISDN,..).
If I were to guess it could very well be a virus has redirected your computer to circumvent your security. If I were you, I would post a HJT log and have a BC expert evaluate it.
"2007 & 2008 Windows Shell/User Award"

#4 abyss56

abyss56
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:12:59 AM

Posted 07 July 2007 - 02:15 PM

Ok so how would I upload things? I have a .jpg of the entry in my router and an HJT log also. And no, its not an exception to windows firewall.

#5 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:11:59 PM

Posted 08 July 2007 - 12:41 AM

Post your HJT Log in this forum. http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/
Please be patient and wait for a HJT Team Member to respond to your HJT Log.
"2007 & 2008 Windows Shell/User Award"




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users