Unusual svchost.exe connections

Discussion in 'privacy problems' started by AviraHelp, May 3, 2010.

Thread Status:
Not open for further replies.
  1. AviraHelp
    Offline

    AviraHelp Registered Member

    When i boot up into windows 7 x64 i notice svchost.exe making several connections to the internet

    c:\windows\system32\svchost.exe
    udp out 65.55.158.118:3544
    udp out 8.8.8.8:53
    tcp out 64.4.18.90:80

    one of the connections i know is to my dns server
    the other 2 i am not sure about, one seems to be a microsoft ip and the other is a hotmail ip
    is it normal for svchost to connect to those ips?

    i thought it might have to do with microsoft updates, but i turned it off, to never check for updates, but it still connects to those ips.

    cant figure out what it might be, i ran all the usual anti-virus scans :malwarebytes, asquare free, avira 10, dr web cureit, and hitman pro, all came up clean
  2. act8192
    Offline

    act8192 Registered Member

  3. AviraHelp
    Offline

    AviraHelp Registered Member

    thanks for such a helpful response, it was driving me nuts trying to figure out what would be connecting to the hotmail ip

    all my thoughts ended up being too malicious to let me rest at night
  4. arran
    Offline

    arran Registered Member

    If you disable DNS services on your OS your browser will instead make the DNS requests. Personally I block all outbound svchost connections.
  5. AviraHelp
    Offline

    AviraHelp Registered Member

    hmm that sounds like a good idea, been doing some reading on doing exactly that.

    Thinking about disabling both outbound and inbound connections for svchost and system, i don't have anything networked together just everything attached to router.

    Will this cause any system instabilities or like windows updates to fail??
  6. arran
    Offline

    arran Registered Member

    I'm on xp SP2 and it doesn't cause system instabilities, I can't see why there would be any system instabilities on Win7. If you want to do any windows updates and you can't you can always temporary allow svchost access to net if needed.
  7. 08086
    Offline

    08086 Registered Member

    I'm on Windows 7 and svchost is constantly making connections, it loves trying to connect to 65.55.158.118.

    How are you going about blocking all activity for svchost, because I've tried that before and the internet becomes completely useless for me when I do, absolutely nothing would work. Also if I allow svchost access to things like the 65.55.158.118 and others it goes into a frenzy if I start using torrents, opening connections to tons of isp accounts.

    Also sometimes when I launch a game rundll32.exe opens and tries to access 65.55.158.118, if I block it the game refuses to run and rundll continues to open more and more connections to the IP until it slows the entire high end PC to a crawl.

    This svchost is a nightmare and if there's a way to get things working online without it or blocking that would be great, I'm using Outpost Firewall, thanks.
    Last edited: May 15, 2010
Thread Status:
Not open for further replies.