full-disclosure - svchost.exe try to send http outside

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <43032429.5030809@hogyros.de>
Date: Wed Aug 17 12:49:18 2005
From: Simon.Richter at hogyros.de (Simon Richter)
Subject: svchost.exe try to send http outside

Hi,

howard.lee@...co.com wrote:

> The svchost.exe will stop to run when I stop the automatic update.

> But I'm sure the IP tried to connect by the svchost is NOT MS related site.

> 218.213.255.29
> 80.15.249.167

I believe this to be automatic update. The second IP address is listed
for Akamai, which Microsoft uses as a hoster for their update sites. The
first one belongs to an ISP, and it is not unusual for Akamai to have
small numbers of machines as mirrors on ISP networks. You should perhaps
inquire with HKnet, who owns the IP block, whether the IP in question is
a server operated by Akamai.

   Simon