Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

First off - I usually target my questions to StackOverflow since they're programming related, and I usually login with my work account - so this will be my first post from this account, as well as my first post to this site - so I apologize if this question belongs elsewhere.

I have Eset installed on my Windows 7 machine, and only recently decided to tighten security. So I set Eset to inform me anytime there is attempted inbound and outbound traffic. I've been getting this message:

**Inbound Traffic
A remote computer is attempting to communicate with an application running on this computer. Do you wish to allow this communication?
Application: Host Process for Windows Services (svchost.exe)
Publisher: Microsoft Windows
Remote Computer: nuq04s19-in-f5.1e100.net (74.125.239.37)
Local Port: 64820**

When I swung around to my Debian machine, I plugged the IP into a whois query, and discovered that this is within an IP block owned by google. So, my question is this - why? I mean, I have Chrome installed, and thereby I also have related Google processes running. So - first question is: if Google wanted to update, or otherwise connect with some of my running Google programs for whatever reason, why aren't they just knocking on those doors instead of svchost.exe? Second question: if anything at all, shouldn't svchost be what is attempting to contact Google instead of the other way around?

share|improve this question

3 Answers 3

Try the following to identify what is communicating with Google:

  1. Since you have the local port and destination run netstat -ao or netstat -nao to get the PID.
  2. Now that you have the PID run Sysinternals Process Explorer with elevated/administrator permission.
  3. Find the svchost with the corresponding PID.
  4. Hover your mouse cursor over the process. The tooltip will inform you of the different services running under that svchost.

Now that you've identified the right svchost, its a matter of figuring out which service within the process would be contacting Google. Often they're unique enough where this can be easily determined at a glance.

share|improve this answer
    
thanks - I'll give this a shot. I'll report back if I figure anything out :) –  CreationTribe Dec 28 '13 at 0:23

It's too bad that message doesn't show you the PID of the svchost it's trying to hit. (Sooooo many instances of svchost.exe running all the time.)

What, if any, Google applications to you have installed on the machine? There's probably one that has a service component and the inbound traffic you're seeing could potentially be part of a push service associated with that.

If you're still not sure, you should be able to find the PID with TCPView and then track down the service further with ProcessExplorer

share|improve this answer
    
the only google app, as I posted below, is chrome. I did, at one point, have sketchup installed, but that's it. –  CreationTribe Dec 28 '13 at 0:22
    
My next best guess would be the chrome updater then. Were you able to track it down with ProcessExplorer? –  ThatMichaelGuy Dec 30 '13 at 19:35

SvcHost is the process that wraps background "service" processes that run on your machine. This includes any third party services that might be responsible for (for example) file sharing.

Do you happen to have Google Drive on your box? If that is the case, there is nothing suspicious about this at all.

share|improve this answer
    
yeah, no google drive. Chrome is the only G-app I have –  CreationTribe Dec 28 '13 at 0:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.