1

I installed comodo firewall and svchost.exe has some strange outbound tcp connections. I have turned off the p2p windows update in advanced update settings. Ip lookup shows connections are to Bangladesh, Mexico, Indonesia, India and one to Hurricane Inc, USA. Now I know for a fact that hurricane inc,fremont is a proxy server. Is my computer infected or is this normal behaviour ?

screenshots of ip lookup :- https://imgur.com/a/u5qbW

|improve this question
  • 1
    It's hard to say since you may have plenty of software which can do that. SVCHOST is generic name for service so it's hard to say which software is it. – Aria Feb 6 '18 at 12:39
  • One option is to pcap that traffic and verify with an NIDS for example. May be is legitimate traffic or not... – camp0 Feb 6 '18 at 13:03
  • In Windows 10 svchost is widely used compared to previous Windows versions. There's nothing strange from the information you provided if you're using W10. – Overmind Mar 13 at 11:19
0

I had the same issue after installing Comodo firewall; svchost.exe was establishing multiple outbound connections to the internet.

I tried to block the process, but since it's a system process, I ended up losing the internet.

The solution was to allow UDP and block TCP for the svchost process.

P.S. running Windows 10 64bit

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.