Windows xp, Svchost.exe connecting to different ips, remote port 445

C

coll911

Joined
Mar 23, 2012
Messages
4
Reaction score
0
hello,

Im using Windows Xp professional Sp2

Whenever i start my windows, svchost.exe starts connecting to all the possible ips on lan like from 192.168.1.2 to 192.168.1.200 The local port ranges from 1000-1099 and the remote port being 445.

After its done with the local ips, it starts connecting to other random ips.

I tried blocking connections to the port 445 using the local security polices but it didn't work

Is there any possible way i could prevent svchost from connecting to these ips without involving any firewall installed ? since my pc slows down due to the load

I'd be thankful for any advices
 
coll911 said:
hello,

Im using Windows Xp professional Sp2

Whenever i start my windows, svchost.exe starts connecting to all the possible ips on lan like from 192.168.1.2 to 192.168.1.200 The local port ranges from 1000-1099 and the remote port being 445.

After its done with the local ips, it starts connecting to other random ips.

I tried blocking connections to the port 445 using the local security polices but it didn't work

Is there any possible way i could prevent svchost from connecting to these ips without involving any firewall installed ? since my pc slows down due to the load

I'd be thankful for any advices
Click to expand...


Ok, i scanned my pc with malware bytes and found out it was infected with a worm, it's deleted now but still svchost is connecting to the ips.

i also found out that in my windows firewall settings, under internet control message protocol (ICMP) theres a tick on "allow incoming echo request"(usually disabled) which is locked and i cant disable it, Its description is
as follows

Messages sent to this computer will be repeated back to the sender. This is used for trouble shooting for e.g to ping a machine. Requests of this type are automatically allowed if tcp port 445 is enabled

Any solutions ? i cant bear going with the re installing windows phase again
 
Also try MS malicious software removal tool.
Make sure you run it in safe mode as all the other things too.
Disconnect from net while doing it and turn off system restore until all is clear

That's what I do anyhow ;)
 
Thanks for the answers,i just formatted and re installed windows,

its working fine now, cant afford to install an antivirus, my pc is already slow
 
coll911 said:
Thanks for the answers,i just formatted and re installed windows,

its working fine now, cant afford to install an antivirus, my pc is already slow
Click to expand...


What are your PC specs ? I use AVAST free and that only uses 2,765K of RAM, I think MSE uses less RAM. If your system is that slow you can't run an AV then you will continue to be infested :D
 
Microsoft Security Essentials.

Even on a crappy machine, it does not slow things down like the others can. works for me just fine.
 
EvanDavis said:
What are your PC specs ? I use AVAST free and that only uses 2,765K of RAM, I think MSE uses less RAM. If your system is that slow you can't run an AV then you will continue to be infested :D
Click to expand...

Im using p4 1.8ghz, 256 ram, 16 mb video card

Installing any antivirus slows pc down, web browser runs more slower, so does the games
 
coll911 said:
Im using p4 1.8ghz, 256 ram, 16 mb video card

Installing any antivirus slows pc down, web browser runs more slower, so does the games
Click to expand...


What software do you have installed ? Yur system although low in spec should run say Aast or MSE without a problem of slowing your machine down.
 
If your machine is slowed down because of MSE, then you need one of the two: 1)buy a new PC or 2) operate without protection.

Being on the internet with no AV software isn't that scarey. I used to do it all the time. It's just when a breach occurs, now you have to play cleanup or be prepared to reformat.
 
Back
Top