Svchost - weird outgoing connections
Posted: Fri Feb 25, 2005 2:54 amFirst I want to say that I've scanned my computer with my antivirus software and used two online virus scanners and my computer is clean. I've also scanned it with spyware/adware programs such as Ad-Aware and a few online spyware scanners and my computer is clean. I have a firewall properly installed/configured and have had no security problems at all recently. I'm running XP Home and I'm on dialup.
The problem started around Feb. 10 when I discovered that svchost.exe tries to make outgoing connections to download.microsoft.co (64.215.169.168) every 10 minutes on TCP port 80. I've had svchost blocked by firewall for the past three years and I've never had any problems doing that until Feb. 10. I have Automatic Windows Updates set to disabled/manual as I like to install the updates myself so I know exactly what's going on. In those cases I allow svchost to connect to Microsoft. It appears that the IP address belongs to Global Crossing and not Microsoft which makes me very suspicious. Svchost also tried to make outgoing connections to c7.zedo.com (65.161.97.145).
I can't figure out why all of a sudden svchost is trying to make this connection and if it's legitimate. It may be no big deal but I'd still like to know what's going on. Does anyone have any ideas?
Last year around this time, svchost was trying to make connections to time.windows.com but the IP address did not belong to Microsoft.
The problem started around Feb. 10 when I discovered that svchost.exe tries to make outgoing connections to download.microsoft.co (64.215.169.168) every 10 minutes on TCP port 80. I've had svchost blocked by firewall for the past three years and I've never had any problems doing that until Feb. 10. I have Automatic Windows Updates set to disabled/manual as I like to install the updates myself so I know exactly what's going on. In those cases I allow svchost to connect to Microsoft. It appears that the IP address belongs to Global Crossing and not Microsoft which makes me very suspicious. Svchost also tried to make outgoing connections to c7.zedo.com (65.161.97.145).
I can't figure out why all of a sudden svchost is trying to make this connection and if it's legitimate. It may be no big deal but I'd still like to know what's going on. Does anyone have any ideas?
Last year around this time, svchost was trying to make connections to time.windows.com but the IP address did not belong to Microsoft.