I am having a 'slight' problem with my computer being constantly sent requests whilst logged onto the internet. I recently installed Windows XP, in favour of Windows ME, and stupidly have been running without a firewall for a few months (aside from the default firewall supplied with XP). I had recently noticed that it was taking my internet connection a lot longer than usual to open websites when initially logging on to the net. I figured this may be due to the fact that i had recently installed Kazaa Lite.
Yesterday i finally got around to installing a firewall, Zonealarm, and in the 36 hours since then i have had around 2 thousand intrusions blocked by Zonealarm. It seems that there are two files that attempt to communicate over the internet when i am logged on, both of these being Generic Host Processes for Win32 Services, or svchost.exe for short.
I also discovered, yesterday that we had a pesky critter, namely Trojan.Qhosts, on the PC. Via Symantec, i aqcuired a removal tool, so that problem has been sorted. However, both svchost.exe files are still attempting to communicate via the internet, some of the requests i receive from outside addresses even ask to use these files as a server program.
Via the command line, i ran a tasklist check, to see what services are running in each svchost group. Here is what i found:
Image Name PID Service
svchost.exe 684 RpcSs
svchost.exe 728 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem,
FastUserSwitchingCompatibility, lanmanworkstation
Messenger, Netman, Nla, Rasman, Schedule,
seclogon, SENS, SharedAccess, ShellHWDetection,
TapiSrv, TermService, Themes, TrkWks,
uploadmgr, W32Time, winmgt, WmdmPmSp,
wuauserv, WZCSVC
svchost.exe 796 Dnscache
svchost.exe 816 LmHosts, RemoteRegistry, SSDPSRV, WebClient
svchost.exe 1216 stisvc
Any idea what is going on?? And what has happened to my poor PC whilst not having a firewall?
