1

I'm using Windows 7 and Firefox 22, connecting through a regular residential wifi router.

In the last month, I've noticed that when I connect to the internet once in a while my firewall indicates that lsass wants to connect to different IPs. example:

C:\WINDOWS\SYSTEM32\LSASS.EXE
Local Security Authority Process
Remote IP: 72.21.91.29
Remote Port: 80

I'm not sure if the following is related but since the same time ago, when I connect to the internet, svhost tries to connect to port 80 to multiple certificate website like DigiCert etc.

After trying to search on Google I couldn't find a reason why is connecting to any IP and if that could be something to worry about and investigate a bit more. I haven't found anything about the second situation for this same context (pc, I am not using remote desktop neither I have the functionality enabled, it happens or just after connecting or surfing the web, this is a NEW behavior. I have two wifi to connect. One is shared with 2 more persons but none of the pcs are sharing or in a family group, the other wifi is used only by me and still, the same firewall messages show up). My first guess is that a Windows update for increased security for ipv6 (compared to the one I had) was installed?

Is this clear indication of a spyware or trojan horse or is just the usual behavior of these processes?

1

This is a normal part of certificate validation or revocation list update using the OCSP protocol. Enjoy reading: https://technet.microsoft.com/en-us/library/ee619730(v=ws.10).aspx https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Protocol

  • 1
    Do you mean OCSP, Online Certificate Status Protocol? OSCP, Offensive Security Certified Professional is something else. ;) – Mark Buffalo Aug 13 '17 at 3:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.