Strange behaviour

[Dumper1]

Comodo alerted me to some programs that were trying to connect to the net, some that I don’t remember trying to connect before. The strange thing is they all have ICMPV6 protocol which I haven’t seen before and I don’t know what it is. I was downloading with Utorrent at the time, so is it a possible attack or normal behaviour?

[attachment deleted by admin]

[naljubes]

I have a similar problem. I am using Win7x64

Ever since the last update, Comodo firewall has been popping up alerts that certain programs are trying to access the internet. Most of these programs have never needed internet access before or would not connect to the address:ports that comodo claimed. For example: comodo would say that csrss.exe or dwm.exe needed some internet access which has never happened before. I checked with curports and wireshark and those processes weren’t actually requesting a connection. Comodo was also saying that a certain web client was trying to connect to several different addresses, when in fact, it was not. Like the above poster, I also happen to be running uTorrent.

I have scanned the machine for viruses and malware so I assume the problem is with Comodo.

[phantom.mojo]

It is possible that this issue has already been covered by the inimitable Radaghast.

I have disabled ipv6 and have noticed no ill effects. My ISP does not support ipv6 at the moment.
You may on the other hand see some benefit to leaving it enabled, perhaps your ISP supports it and you beleive that it contributes to speedier torrent downloading.

This may be coincidental, but ever since I disabled ipv6, my downloads have been faster than my ISP’s claimed maximum speed. Of course I haven’t alerted them to that fact.
Probably coincidental right? :P0l

Related post here:
https://forums.comodo.com/firewall-help-cis/svchostexe-port-57398-whats-going-on-here-t72975.0.html

Radaghast says:

@Radaghast post:6

I had a feeling you might sat that, but I’m a little confused about the port number, as it doesn’t appear to be your uTorrent port… The iphlpsvc is a service that, amongst other things, provides support for certain types of ipv6 connectivity. As you’re running Windows 7, ipv6 is enabled by default and because you’re using the default firewall rules for svchost, you have no control over the types of outbound connections it can make.

When you use uTorrent, it will happily make use of the ipv6 transport, if available, which in your case is probably 6to4, but again, because your rules for uTorrent simply allow all outbound connections, you will not see anything to indicated this behaviour, except for the events you are now seeing and the only reason your seeing these is because the rule for svchost doesn’t allow inbound connections.

You really have two choices at this point, incidentally, this is not malicious behaviour, simply uTorrent using ipv6, You can modify your rules to correctly handle these connections, or you can disable ipv6, which should make this go away. To disable ipv6 transition technologies, open a command prompt and copy and paste the following:

netsh interface ipv6 set privacy state=disable
netsh interface ipv6 6to4 set state state=disabled
netsh interface ipv6 isatap set state state=disabled
netsh interface ipv6 set teredo disabled

Some additional information can be found here

Just a thought. Would you mind running and ipconfig /all from the command prompt and posting the results, please. Also, if you’re familiar with Wireshark you could run a capture and post that as well

[naljubes]

I should note that the addresses Comodo reports are all IPV4 and none are IPV6 or ICMPV6. Maybe my situation and the OPs are different issues, but Comodo is still erroneously reporting that things are trying to connect to the net. exporer.exe lsass.exe csrss.exe seem to be reported the most

[Citizen_K]

Naljubes. Please start your own topic for your problem. Your problem is nowhere related to the problem at hand in this topic.