Tracing SVCHOST Hijack

How can I trace which process is suddenly using SVCHOST.EXE to call out to wwwimages.adobe.com and edge.quantserve.com?

There does not seem to be any visible service, process nor product running that would be related to Adobe.

 

The SVCHOST TCP OUts have been traced to Dreamweaver. No Problem. The firewall log was not in time sequence.

 

There is a problem!

My firewall logs are showing for svchost.exe
OUT REFUSED TCP edge.quantserve.com HTTP
OUT REFUSED TCP us.js2.yimg.com HTTP

How to discover what is "hijacking" svchost.exe ?

 

This won't help your specific sleuth-work, but ...

Because so many things, good and bad, can use Svchost, it was recommended to me that I not tick the "always remember" when permitting firewall access, so it has to ask each time.

So far, the only time it asks is when connecting to MS Update. I know it's needed to complete my dialup connection too, but that specific function must already be OK'd behind the scenes, so to speak.

 

To see the list of services hosted by each instance of svchost.exe, you may use the Tasklist.exe console utility available in Windows XP Professional Edition.

Click Start, Run and type CMD.EXE

Type tasklist /svc >c:\taskList.txt

 

you can also use Process explorer which does the same it is free. It will show you the files under svchost.exe aand several other things.

http://www.sysinternals.com/Utilities/ProcessExplorer.html