Re: SVCHOST making connection to outside host

["Navroz Shariff" <navroz.shariff () gmail com>]

Yogesh,

Since multiple instances of Svchost.exe can run at the same time and
each Svchost.exe session can contain a grouping of services, we can
try to remove the reg key that is associated with that particular
service.

SVCHOST processes are identified at the following reg key:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost

You can also download process explorer and suspend that service.
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx

-Shariff


On 18 Dec 2006 08:33:41 -0000, yogeshpanwar () gmail com
<yogeshpanwar () gmail com> wrote:
> Hi,
>
> I have seen one intresting incident where in my laptop svchost.exe TCP 892 is making connection to outside IP 
> 213.200.109.17 port 80
> which belongs to Akmai Technologies even is i have not opened Internet explorer. it remain connected for long and after 
> sometime IP address gets changed eg 213.200.109.18, 213.200.109.19 also all belongs to Akamai Technologies.
>
> I know Akmai Technologies provides web caching services but when i am not even opened my browser then it why it is 
> still connected.
>
> Does anybody know why its making connection? what is the significance of this or whether their system is compromised.
>
> What to do? I do not have any clue. please help
>
> Thanks in advance.
>
> Yogesh Panwar
>
> ---------------------------------------------------------------------------
> This list is sponsored by: ByteCrusher
>
> Detect Malicious Web Content and Exploits in Real-Time.
> Anti-Virus engines can't detect unknown or new threats.
> LinkScanner can. Web surfing just became a whole lot safer.
>
> http://www.explabs.com/staging/promotions/xern_lspro.asp?loc=sfmaildetect
> ---------------------------------------------------------------------------


--
"Only two things are infinite; the universe and human stupidity, and
I'm not sure about the former."
-Albert Einstein