full-disclosure - svchost.exe try to send http outside

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed Aug 17 12:46:46 2005
From: fd at mchsi.com (Mark)
Subject: svchost.exe try to send http outside

howard.lee@...co.com wrote:
> The svchost.exe will stop to run when I stop the automatic update.
> 
> But I'm sure the IP tried to connect by the svchost is NOT MS related site.
> 
> 218.213.255.29
> 80.15.249.167
> 
> Regards,
> Howard
> 
Well, the first one, probably not.

inetnum:      218.213.0.0 - 218.213.255.255
netname:      HKNET-HK
descr:        HKNet Company Limited
descr:        15/F, Tower 2, Ever Gain Plaza,
descr:        88 Container Port Road, Kwai Chung, N.T.
country:      HK

But the second address we can't be so sure, I've heard that Microsoft
uses Akamai for Windows Update.

inetnum:      80.15.249.0 - 80.15.249.239
netname:      AKAMAI-FT-US
descr:        Akamai Technologies - US machines connected to FT AS5511

--
Mark