RE: SVCHOST making connection to outside host

["Gurpreet Singh" <gurpreetsl () gmail com>]

Hi,
I have seen the site of Akmai Technologies. Let me know one thing that if u
were streaming something like audio or video? Because in case of streaming
applications if you examine such a response at the TCP/IP level, you will
notice that the connection normally remains open after all the data
associated with this header has been sent and received -- there is no
FIN/ACK coming immediately from the server after the last chunk.




-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On
Behalf Of yogeshpanwar () gmail com
Sent: Monday, December 18, 2006 2:04 PM
To: security-basics () securityfocus com
Subject: SVCHOST making connection to outside host

Hi,
 
I have seen one intresting incident where in my laptop svchost.exe TCP 892
is making connection to outside IP 213.200.109.17 port 80
which belongs to Akmai Technologies even is i have not opened Internet
explorer. it remain connected for long and after sometime IP address gets
changed eg 213.200.109.18, 213.200.109.19 also all belongs to Akamai
Technologies.
 
I know Akmai Technologies provides web caching services but when i am not
even opened my browser then it why it is still connected.
 
Does anybody know why its making connection? what is the significance of
this or whether their system is compromised.
 
What to do? I do not have any clue. please help
 
Thanks in advance.
 
Yogesh Panwar

---------------------------------------------------------------------------
This list is sponsored by: ByteCrusher

Detect Malicious Web Content and Exploits in Real-Time.
Anti-Virus engines can't detect unknown or new threats.
LinkScanner can. Web surfing just became a whole lot safer.

http://www.explabs.com/staging/promotions/xern_lspro.asp?loc=sfmaildetect
---------------------------------------------------------------------------