I'm using Windows 7 and Firefox 22, connecting through a regular residential wifi router.
In the last month, I've noticed that when I connect to the internet once in a while my firewall indicates that lsass wants to connect to different IPs. example:
C:\WINDOWS\SYSTEM32\LSASS.EXE Local Security Authority Process Remote IP: 126.96.36.199 Remote Port: 80
I'm not sure if the following is related but since the same time ago, when I connect to the internet, svhost tries to connect to port 80 to multiple certificate website like DigiCert etc.
After trying to search on Google I couldn't find a reason why is connecting to any IP and if that could be something to worry about and investigate a bit more. I haven't found anything about the second situation for this same context (pc, I am not using remote desktop neither I have the functionality enabled, it happens or just after connecting or surfing the web, this is a NEW behavior. I have two wifi to connect. One is shared with 2 more persons but none of the pcs are sharing or in a family group, the other wifi is used only by me and still, the same firewall messages show up). My first guess is that a Windows update for increased security for ipv6 (compared to the one I had) was installed?
Is this clear indication of a spyware or trojan horse or is just the usual behavior of these processes?