Potential problem

[Guest]

[Thudson]

Hi guys,

I downloaded 2 things from a source which is fairly trustworthy, but you never know with the internet and computers. Anyway those two files I downloaded were saved to one folder, and then moved to another folder.

I've had a few problems with svchost.exe and my comodo firewall previously but, no warning like this before. After I downloaded those files, a few minutes later I got a warning saying "svchost is trying to connect to the internet" (inbound connection, not outgoing). I blocked it because I didn't know what it was and ignored it. (Note: I have my firewall settings on high alert so I do get a lot of alerts, however this one was new, and I'd never seen it before, hence me mentioning it)

I've just opened Internet Explorer (which I never use, I only use Firefox) and those two folders the files I downloaded were placed in are listed in the address bar history. I've never seen local folders in the address bar before which makes me think something about those files could be dodgey.

I've scanned both the files with AVG and Ad-Aware (before and after the comodo alert) and they've both said the files are clean, but thought I'd ask on here anyway.

Anyone got any ideas about this?

ty


Edit:  The IP address which I blocked from coming in via svchost.exe I saw on my rules list. I blocked it both coming in and out because I thought I might as well. When I did that I couldn't connect to the internet via a browser. I went back and changed the rule to only block incoming, and it's back working again. Don't know if that helps anyone with diagnosing my problem but thought I'd mention is anyway.

[EricJH]

You can upload the two files to Virus Total to see what other scanners think about them.

Are these files digitally signed? Check to see if their signatures are valid. When they are valid that means they were not tempered with after they were made.

What IP address was trying to connect to svchost.exe? Are you behind a router or is your computer directly connected to the modem?

[Thudson]

Behind a router.

Do you think these files could be dangerous then?

[Chiron]

Do you think these files could be dangerous then?

It's always worth checking.

[EricJH]

In case of doubt it never hurts to check. Please upload the files to Virus Total to let other scanners take a look at them.

What was the IP address that was trying to connect to svchost.exe? Check the Firewall logs under View Firewall Events.

[Thudson]

Both the source IP and the destination IP start with 192.168.X.XX, and the last numbers are very similar with only one digit different.

Sorry, not sure I want to be putting IP address' out there in the public domain. hehe.

[EricJH]

Both the source IP and the destination IP start with 192.168.X.XX, and the last numbers are very similar with only one digit different.

Sorry, not sure I want to be putting IP address' out there in the public domain. hehe.

Those are local addresses of computer's on your LAN; they are not public addresses. That's normal traffic and as such nothing to worry about.

Can you post the scan reports of the files uploaded to Virus Total?

Are the files digitally signed?

[Thudson]

ah that's good news then. This svchost.exe is so annoying. Seems to pop up all the time and whenever I look into it it's always a safe process.

Total Virus said they were ok files.

I don't know what you mean by "signed", sorry?

[Tags:]