Full Disclosure mailing list archives
RE: svchost.exe try to send http outside
From: howard.lee () guoco com
Date: Wed, 17 Aug 2005 19:01:31 +0800
The svchost.exe will stop to run when I stop the automatic update. But I'm sure the IP tried to connect by the svchost is NOT MS related site. 218.213.255.29 80.15.249.167 Regards, Howard "Mike" <mjcarter () ihug co To: <howard.lee () guoco com>, .nz> <full-disclosure () lists grok org uk> cc: 17/08/2005 18:46 Subject: RE: [Full-disclosure] svchost.exe try to send http outside Hi Howard, Very hard to say without having a sample or knowing what service your server performs. svchost.exe is a valid Windows process and also commonly used by/with many many malware. Regards Mike www.infosec.co.nz -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of howard.lee () guoco com Sent: Wednesday, August 17, 2005 10:12 PM To: full-disclosure () lists grok org uk Subject: [Full-disclosure] svchost.exe try to send http outside Dear all, I discovered that an "svchost.exe" start when the server start. This svchost.exe try to sync_sent to random http host when I view from netstat, active port, and pviewer. However, does anyone know which worms/torjon/normal process causes the svchost do such job? and how to stop this? Is this a normal prcoess? My Server is a fully patched windows 2003 server. net. The svchost.exe is microsoft verifid and located at c:\windows\system32 Regards, Howard This e-mail (and any attachment (s)) is confidential and for use only by intended recipient (s). Access by others is unauthorised. Its content should not be relied upon and no liability or responsibility is accepted by us, without our subsequent written confirmation of its content. If you are not an intended recipient, please notify us promptly and delete all copies and note that any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on the information it contains is prohibited and may be unlawful. Further information on Guoco Group is available from http://www.guoco.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ This e-mail (and any attachment (s)) is confidential and for use only by intended recipient (s). Access by others is unauthorised. Its content should not be relied upon and no liability or responsibility is accepted by us, without our subsequent written confirmation of its content. If you are not an intended recipient, please notify us promptly and delete all copies and note that any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on the information it contains is prohibited and may be unlawful. Further information on Guoco Group is available from http://www.guoco.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- svchost.exe try to send http outside howard . lee (Aug 17)
- Re: svchost.exe try to send http outside Josh Zlatin-Amishav (Aug 17)
- Re: svchost.exe try to send http outside Dave Korn (Aug 17)
- RE: svchost.exe try to send http outside Mike (Aug 17)
- RE: svchost.exe try to send http outside Aditya Deshmukh (Aug 17)
- Re: svchost.exe try to send http outside Paul Schmehl (Aug 17)
- RE: svchost.exe try to send http outside CIRT.DK Mailinglists (Aug 17)
- <Possible follow-ups>
- RE: svchost.exe try to send http outside howard . lee (Aug 17)
- Re: svchost.exe try to send http outside Mark (Aug 17)
- Re: svchost.exe try to send http outside Simon Richter (Aug 17)
- RE: svchost.exe try to send http outside howard . lee (Aug 17)
- Re: svchost.exe try to send http outside Josh Zlatin-Amishav (Aug 17)