Eset service, heavy network usage?

Discussion in 'ESET NOD32 Antivirus' started by dclark61, Jul 24, 2008.

Thread Status:
Not open for further replies.
  1. dclark61

    dclark61 Registered Member

    Joined:
    Jul 11, 2008
    Posts:
    7
    My ZoneAlarm icon has been showing a lot of network activity today. Opened up ZoneAlarm, and it indicates that the network usage is primarily the Eset service on port 30606. Is this expected behavior?

    ESET NOD32 Antivirus 3.0.669.0 running on Windows XP Home.

    Virus signature database: 3295 (20080724)
    Update module: 1024 (20080514)
    Antivirus and antispyware scanner module: 1132 (20080723)
    Advanced heuristics module: 1071 (20080509)
    Archive support module: 1079 (20080509)
    Cleaner module: 1032 (20080724)
    Anti-Stealth support module: 1002 (20080723)
     
  2. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,376
    By default, all http/pop3 communication is routed via ekrn which acts as a local proxy. If an application communicates via http/pop3 and is not excluded from scanning, you'll see the communication as initiated by ekrn.exe in 3rd party firewalls.
     
  3. dclark61

    dclark61 Registered Member

    Joined:
    Jul 11, 2008
    Posts:
    7
    Thanks for your reply.

    I have only one http/pop3 application of which I'm aware, MS Outlook. The Eset service network usage continues not only when Outlook is not actively sending/retrieving, but even when Outlook is not running.
     
  4. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    The http part also includes browsers or any program that uses the default HTTP protocol ports of 80, 8080, 3128.
     
  5. dclark61

    dclark61 Registered Member

    Joined:
    Jul 11, 2008
    Posts:
    7
    Wow, I saw "pop3" and immediately my mind substituted "smtp" for "http". Sorry.

    It turns out to have been the Last.fm app streaming audio. Not sure why Last.fm is hitting http so hard in the process, but that's a topic for a different forum ....

    Thanks to all.
     
Thread Status:
Not open for further replies.