Re: svchost.exe connect port 80 and 443

From: Big Will (spamWspamispamlspamlspamBspam4spamespamvspaaaammespammityrspam_at_nidontlikespamet)
Date: 02/23/04


Date: Mon, 23 Feb 2004 07:58:15 -0800

Pedro wrote:
> Micheal Robert Zium <mrozium@XSPAMX-yahoo.com> wrote in
> news:pisi30p1r3usev3jh2adqagsr2ujpfkomv@4ax.com:
>
>
>>Pedro wrote:
>>
>>
>>>Hello.
>>>
>>>I was trying Frontpage 2003 for the first time and saved one simple
>>>htm page to my the default folder in Windows XP...My Documents\My Web
>>>Sites. Later when I opened the same with Frontpage it showed something
>>>like this in the middle:
>>>"frontpage function Homepage(){ <!-- // in real bits, urls get
>>>returned to our script like this: // res://shdocvw.dll/http_
>>>404.htm#http://www.DocURL.com/bar.htm //For testing use Do"
>>>
>>>Anyway I deleted the document, and now I opened the Sygate Personal
>>>Firewall and see something which I think wasn't there before. In
>>>Running Applications - Connection Details two of the various
>>>svchost.exe files are with the status CONNECT, one in local port:1076
>>>and remote port:80; the other in local port:1079 and remote port:443.
>>>In IP Adress I have: 0.0.0.0->207.46.245.126 (which isn't my IP
>>>adress) in both instances. Is this normal, or is it some kind of hack?
>>>
>>>Thanks for reading.
>>
>>Ummmm...it just Windows Update. Nothing to worry about, I guess.
>
>
>
> Err, you're probably right. I did a whois with that IP and it is from
> microsoft. But generally when windows update is working it pops up a small
> window telling me what updates are ready for download, etc. Maybe i'm just
> too paranoid. ;)
>
> Since i'm on it what are good websites and/or applications to check what ip
> adresses are from or where are they located?
>
>
> -Pedro Tiago
My favorite is whois.cyberabuse.org

-- 
William
If it don't work, hit it.
If it still doesn't work, kick it.
If it works after hitting it and kicking it, then it doesn't matter if 
hitting it or kicking it helped, what's important is it worked.