svchost.exe keeps trying to get out...

[ADSL with Norton Internet Security, Win2000 fully patched; no peer-peer
services enabled]

Something odd has started happening the last couple of days - and I don't
know whether it is due to some update to NIS or irregular activity on my PC.

No weird programs running on my PC (as far as I know) but as soon as I
enable ADSL connection, I get repeated messages about svchost.exe trying to
access internet (to different IP addresses) e.g.:

"Program c:\winnt\system32\svchost.exe

Protocol: TCP Outbound

'Microsoft Generic Host Process for Win32 Services is attempting to access
the internet'

207.46.73.143 (Microsoft)

remote http (port 80)"

immediately followed by, say, attempt on 193.80.200.137 (Akamai /
Abuse@EUnet-AG)

They seem to come in pairs, e.g. 213.229.162.89 (Akamai / colt-telecom.es)
then 213.229.162.83 (Akamai/colt-telecom.es)

NIS says I should just 'auto configure' svchost.exe (and Msoft and Akamai
are obviously ok suppliers) BUT I'd like to know why something on my PC
would be desperately trying to get hold of e.g. Akamai (which I thought just
did streaming ents)

Setting this to automatic is OK as the rules are quite sensible. If you are
worried about svchost.exe connecting to Microsoft, just create a system wide
block rule with the following subnets:

207.46.0.0 mask 255.255.0.0
207.68.0.0 mask 255.255.0.0
65.52.0.0 mask 255.252.0.0

This will prevent any software including the OS from connecting to
Microsoft.

--

Regards,
Mark

PLEASE DO NOT REPLY TO THE EMAIL ADDRESS DIRECTLY AS IT IS A SPAM TRAP.
REPLY TO GROUP.
--



"jann" <(E-Mail Removed)> wrote in message
news:3f227217$0$961$(E-Mail Removed).. .
> [ADSL with Norton Internet Security, Win2000 fully patched; no peer-peer
> services enabled]
>
> Something odd has started happening the last couple of days - and I don't
> know whether it is due to some update to NIS or irregular activity on my
PC.
>
> No weird programs running on my PC (as far as I know) but as soon as I
> enable ADSL connection, I get repeated messages about svchost.exe trying
to
> access internet (to different IP addresses) e.g.:
>
> "Program c:\winnt\system32\svchost.exe
>
> Protocol: TCP Outbound
>
> 'Microsoft Generic Host Process for Win32 Services is attempting to access
> the internet'
>
> 207.46.73.143 (Microsoft)
>
> remote http (port 80)"
>
> immediately followed by, say, attempt on 193.80.200.137 (Akamai /
> Abuse@EUnet-AG)
>
> They seem to come in pairs, e.g. 213.229.162.89 (Akamai / colt-telecom.es)
> then 213.229.162.83 (Akamai/colt-telecom.es)
>
> NIS says I should just 'auto configure' svchost.exe (and Msoft and Akamai
> are obviously ok suppliers) BUT I'd like to know why something on my PC
> would be desperately trying to get hold of e.g. Akamai (which I thought
just
> did streaming ents)
>
>

Thanks - by the way, I believe the app involved was either the new MSN
Messenger (despite Messenger being closed on my PC) and/or my Maxtor
S.M.A.R.T software (c:\sysagent)

Thanks for the explanation.

In that case - given the firepower of modern PCs - I think that Msoft should
provide a little accessory prog which allowed users to EASILY see what
In/Out activity there was via TCP/IP.

It could keep a cache of names and then just pop up a message 'PC now
sending x bytes to microsoft.com' blah-de-blah

At the moment, Norton Internet Security does half the job - I have to rush
off to Whois to look up the IP info having spotted the IP number flash up.

I've got a feeling that we are running before we can walk with permanent
ADSL connections - the security thing feels out of control to me (or I could
be paranoid....:O)

"jann" <(E-Mail Removed)> wrote in message
news:3f24fcdb$0$18488$(E-Mail Removed) ...
> Thanks for the explanation.
>
> In that case - given the firepower of modern PCs - I think that Msoft
should
> provide a little accessory prog which allowed users to EASILY see what
> In/Out activity there was via TCP/IP.
>
> It could keep a cache of names and then just pop up a message 'PC now
> sending x bytes to microsoft.com' blah-de-blah
>
> At the moment, Norton Internet Security does half the job - I have to rush
> off to Whois to look up the IP info having spotted the IP number flash up.
>
> I've got a feeling that we are running before we can walk with permanent
> ADSL connections - the security thing feels out of control to me (or I
could
> be paranoid....:O)
>
>

I use a program caclled Tesseract for displaying routes and traffic. A quick
google should find it.

Cheers

Nick