Re: svchost making connection to internet

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

"Denzuku" <Denzuku@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D98798B2-5B5C-46EB-B1F7-99427A01D6BE@xxxxxxxxxxxxxxxx
> Hi,
>
> I have a few Win2003 servers. I noticed that periodically the servers will
> attempt to connect to some random sites website thru http. The connection
> seems to be cause by svchost, which I presume could be due to automatic
> update. However, I have already disable automatic update on the servers, but
> the connection always appear every few hours.
>
> Is this problem cause by automatic update?


Does your OS have the new netstat options which show the PID
and module names? E.g. on XP I would answer this question with

netstat -abov

then if the task's executable turns out to be svchost.exe as you suspect
use tasklist /svc referring to that task's PID. E.g.

tasklist /svc /fi "PID eq xxxx"

(where xxxx is whatever PID (decimal number) shows in the netstat output.

Or just keep it simple and list them all to see the one that matches
the netstat output:

tasklist /svc /fi "Imagename eq svchost.exe"


If that turned out to be a svchost.exe which hosted several services
I don't know how you could differentiate which one was using the link.
Hopefully the additional information provided by the netstat -v switch
(above) would help clarify that.


Good luck

Robert Aldwinckle
---



.

Relevant Pages

  • RE: host-based ids evaluation
    ... But for servers, many people don't like using features like autoblocking or ... host-based firewalls because it could cause additional performance ... Static Firewall rules do not prevent binding of programs to certain ports ... but I am not sure if some processes could be hidden from netstat. ...
    (Focus-IDS)
  • Re: Help! Ad-aware found: Registry--> Possible Browser Hijack attempt
    ... >> (e.g. that would show "listening" PID so then you would match up the PID ... >> XP's netstat can give you even more detail about the process involved ... >> another diagnostic I would use is RegMon with an input filter of Proxy ... >> Robert Aldwinckle ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Unknown service sending UDP traffic to a Microsoft IP address
    ... Use "netstat - ano" to map the port usage to a PID and then find the PID in ... task manager to map to a process. ... Here's the netstat. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Help! Ad-aware found: Registry--> Possible Browser Hijack attempt
    ... Robert, both current versions of Ad-aware and Spybot are identifying this ... > (e.g. that would show "listening" PID so then you would match up the PID ... > XP's netstat can give you even more detail about the process involved ... > another diagnostic I would use is RegMon with an input filter of Proxy ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Maintaining a local yum repository
    ... Craig White escribió: ... the servers to do an automatic update at say 02:00 - and do not delete ... I mean, just download what you're installing or updating to get cached in disk, not the whole repo. ...
    (Fedora)