Sign in with
Sign up | Sign in
Your question

Windows Xp, svchost.exe connecting to random ips with remote port 445

Tags:
  • Security
  • Svchost.Exe
  • Windows XP
Last response: in Windows XP
Share
March 23, 2012 2:47:31 PM

Hello,
Im using Windows Xp professional Sp2

Whenever i start my windows, svchost.exe starts connecting to all the possible ips on lan like from 192.168.1.2 to 192.168.1.200 The local port ranges from 1000-1099 and the remote port being 445.

After its done with the local ips, it starts connecting to other random ips.

I tried blocking connections to the port 445 using the local security polices but it didn't work

Is there any possible way i could prevent svchost from connecting to these ips without involving any firewall installed ? since my pc slows down due to the load

I'd be thankful for any advices

More about : windows svchost exe connecting random ips remote port 445

a b 8 Security
March 23, 2012 6:07:39 PM


Hello and welcome to Tom's Hardware Forums.

There are a number of instances of SvcHost running at any one time and you need to find out which one is phoning home - or trying to. Download HijackThis from http://www.trendmicro.com and run a scan, concentrating on the entries in the 023 section. If in doubt, clipboard just those entries and post them back here and then tick to prevent any you don't recognise from running and click on Fix Selected then restart after it completes.

m
0
l
March 24, 2012 10:18:01 PM

I used malwarebytes to clean the virus, it was infected with the worm.

i also used hijack this afterwords, it came clean, nothing looked suspicious.

Although the worm was removed, It was still connecting to the different ips, so i formatted and re installed windows, its working fine now.

Thanks for the answers
m
0
l
!