0

I installed comodo firewall and svchost.exe has some strange outbound tcp connections. I have turned off the p2p windows update in advanced update settings. Ip lookup shows connections are to Bangladesh, Mexico, Indonesia, India and one to Hurricane Inc, USA. Now I know for a fact that hurricane inc,fremont is a proxy server. Is my computer infected or is this normal behaviour ?

screenshots of ip lookup :- https://imgur.com/a/u5qbW

  • 1
    It's hard to say since you may have plenty of software which can do that. SVCHOST is generic name for service so it's hard to say which software is it. – Aria Feb 6 '18 at 12:39
  • One option is to pcap that traffic and verify with an NIDS for example. May be is legitimate traffic or not... – camp0 Feb 6 '18 at 13:03
0

I had the same issue after installing Comodo firewall; svchost.exe was establishing multiple outbound connections to the internet.

I tried to block the process, but since it's a system process, I ended up losing the internet.

The solution was to allow UDP and block TCP for the svchost process.

P.S. running Windows 10 64bit

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.