svchost has 4 ports open at the same time all listening to remote port 53

Discussion in 'Port Explorer' started by webberrussell, May 5, 2005.

Thread Status:
Not open for further replies.
  1. webberrussell

    webberrussell Registered Member

    Joined:
    May 5, 2005
    Posts:
    2
    has any one else had this experience.and all the local ports are known trojan ports.I have used several different scans to see if there is a problem but nothing is showing up.any one out there with an opinion
     
  2. ekim68

    ekim68 Registered Member

    Joined:
    Jul 14, 2004
    Posts:
    7
    Location:
    Springfield, Oregon
    Do you have a firewall? And, does it have a log? And, what do the scans say?
     
  3. webberrussell

    webberrussell Registered Member

    Joined:
    May 5, 2005
    Posts:
    2
    i have zonealarm and the action it takes is to block any incoming or out going packets from svchostwhen trying to connect to remote port 53
    all the virus scans come up clean.I use avast 4.6 spybots&d,adware se,a-squared
     
  4. S!x

    S!x Registered Member

    Joined:
    Jan 1, 2005
    Posts:
    51
    Location:
    Ohio, USA
    I don't think you have anything to worry about ... these are all UDP connections? and they are listening and not established? - these are most likely your Domain Name Servers (port 53 is for DNS) from your ISP.

    I run on Roadrunner Cable and have the same thing - right now (looking through PE) i have 6 instances of svchost all to remote port 53 - with 3 different remote addresses. But these are the 3 DNS servers used by Roadrunner so - no problems :D

    They wait until you want to visit a website, and then convert the name of the website into a number (since computers only use numbers and not names) once the conversion is done they connect you to that website.

    You can always type in an IP# of a website (if you know it) and hit enter and you will go right to that site - without using the ISP's DNS servers.
     
  5. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi there, yes i see it when collecting email. I have several accounts in my email client so one easily sees several instances open during and after such a collection and extra when opening IE etc.
     
  6. MAL1111111

    MAL1111111 Guest

    if you disabled the dns client services in windows xp svchost will take care of the dns resolving... might help close some of those ports.. I disabled that service and internet works fine just svchost does the connecting not sure if that closed any ports or not though but download a program called safexp, you can disable some unsafe settings in windows xp, that should help close some ports. All I have from svchost is DCOM port which is open all the time but not connecting to anything.
     
Thread Status:
Not open for further replies.