Constant activity my connection

Archived from groups: comp.security.firewalls (More info?)

In article <2nc44gFv2s1aU1@uni-berlin.de>, jcgc50@msn.com says...
> I am running XP home on a new computer for the last couple of months. Have a
> dial up connection and prior to a few days ago was using XP's firewall.
>
> After downloading a critical update for IE 6 this weekend I now find that
> when I am online there appears to be constant activity showing on the
> network icon in the taskbar and when checking the status there is in
> activity. Now I don't know if this is related to the download or not. By the
> way this activity is going whether I have a program accessing the internet
> or not. This is not something I have seen before.
>
> Turned off XP firewall and installed basic Zone Alarm. It reveals that the
> program accessing the internet is Generic Host Process Win32/svchost.exe.
>
> I have tried turning it off which stops your access. I have tried allowing
> access but not as a server. This seemed to work but in the end did not.
>
> Downloaded spybot and while it found a few things it was nothing serious but
> deleted what it found.
>
> Run Norton AV 04 which finds nothing.
>
> Any ideas?
>
>
>
http://www.uksecurityonline.com/hu [...] rvices.htm
http://www.theeldergeek.com/services_guide.htm

Archived from groups: comp.security.firewalls (More info?)

"Jim" <jcgc50@msn.com> wrote in news:2nc44gFv2s1aU1@uni-berlin.de:

> I am running XP home on a new computer for the last couple of months.
> Have a dial up connection and prior to a few days ago was using XP's
> firewall.
>
> After downloading a critical update for IE 6 this weekend I now find
> that when I am online there appears to be constant activity showing on
> the network icon in the taskbar and when checking the status there is
> in activity. Now I don't know if this is related to the download or
> not. By the way this activity is going whether I have a program
> accessing the internet or not. This is not something I have seen
> before.
>
> Turned off XP firewall and installed basic Zone Alarm. It reveals that
> the program accessing the internet is Generic Host Process
> Win32/svchost.exe.
>
> I have tried turning it off which stops your access. I have tried
> allowing access but not as a server. This seemed to work but in the
> end did not.
>
> Downloaded spybot and while it found a few things it was nothing
> serious but deleted what it found.
>
> Run Norton AV 04 which finds nothing.
>
> Any ideas?
>
>

Svchost.exe is just the messenger for the O/S and one of its tasks is
communications for the O/S. But also, svchost.exe can be used by malware
too. So, you need to find out if possible what is using svchost.exe

Active Ports and Process Explorer are free. You use Process Explorer to
look inside svchost.exe to see what processes/programs are using
svchost.exe.

http://www.windowsecurity.com/arti [...] Horses_and
_Rootkit_Tools_in_a_Windows_Environment.html

Duane