Yogesh,
Since multiple instances of Svchost.exe can run at the same time and
each Svchost.exe session can contain a grouping of services, we can
try to remove the reg key that is associated with that particular
service.
SVCHOST processes are identified at the following reg key:
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost
You can also download process explorer and suspend that service.
http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx
-Shariff
On 18 Dec 2006 08:33:41 -0000, yogeshpanwar@gmail.com
<yogeshpanwar@gmail.com> wrote:
Hi,
I have seen one intresting incident where in my laptop svchost.exe TCP 892 is
making connection to outside IP 213.200.109.17 port 80
which belongs to Akmai Technologies even is i have not opened Internet
explorer. it remain connected for long and after sometime IP address gets
changed eg 213.200.109.18, 213.200.109.19 also all belongs to Akamai
Technologies.
I know Akmai Technologies provides web caching services but when i am not even
opened my browser then it why it is still connected.
Does anybody know why its making connection? what is the significance of this
or whether their system is compromised.
What to do? I do not have any clue. please help
Thanks in advance.
Yogesh Panwar
---------------------------------------------------------------------------
This list is sponsored by: ByteCrusher
Detect Malicious Web Content and Exploits in Real-Time.
Anti-Virus engines can't detect unknown or new threats.
LinkScanner can. Web surfing just became a whole lot safer.
http://www.explabs.com/staging/promotions/xern_lspro.asp?loc=sfmaildetect
---------------------------------------------------------------------------
--
"Only two things are infinite; the universe and human stupidity, and
I'm not sure about the former."
-Albert Einstein
