So I've already disabled SSDP Discovery in Windows Services.
I'm also not conducting any searches. I also have file indexing disabled on my system.
I noticed a number of outbound connections coming from explorer.exe, felt there was no reason for that, so I blocked all outbound connections using Comodo firewall.
Now, after a couple of hours, I did a quick check on Comodo's log and was surprised to see the effects of that block:
- ~10 attempted outbound connections are getting blocked every hour.
- These attempts happen in "blocks" (3-4 at a time)
- The attempts happen like clockwork in intervals divisible by 5 (x:46, x:16, x:31, x:46, x:51)
- EVERY outbound connection is to a unique remote IP address.
- EVERY outbound connection was through a unique source port on my system.
- The destination port for every attempt was port 80 (with one exception that was to port 443)
So maybe I'm paranoid, but this seems very, very suspicious.
I've done scans with Windows Defender+, Spybot S&D, and ClamAV and all returned a clean system.
That said, what I don't understand, can definitely hurt me.
Any thoughts on what's trying to start this connection?