I installed comodo firewall and svchost.exe has some strange outbound tcp connections. I have turned off the p2p windows update in advanced update settings. Ip lookup shows connections are to Bangladesh, Mexico, Indonesia, India and one to Hurricane Inc, USA. Now I know for a fact that hurricane inc,fremont is a proxy server. Is my computer infected or is this normal behaviour ?

screenshots of ip lookup :- https://i.stack.imgur.com/D6ZDm.jpg

  • 2
    It's hard to say since you may have plenty of software which can do that. SVCHOST is generic name for service so it's hard to say which software is it.
    – Aria
    Feb 6, 2018 at 12:39
  • One option is to pcap that traffic and verify with an NIDS for example. May be is legitimate traffic or not...
    – camp0
    Feb 6, 2018 at 13:03
  • In Windows 10 svchost is widely used compared to previous Windows versions. There's nothing strange from the information you provided if you're using W10.
    – Overmind
    Mar 13, 2019 at 11:19

1 Answer 1


I had the same issue after installing Comodo firewall; svchost.exe was establishing multiple outbound connections to the internet.

I tried to block the process, but since it's a system process, I ended up losing the internet.

The solution was to allow UDP and block TCP for the svchost process.

P.S. running Windows 10 64bit

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .