I have this problem, like many others here, with an application that wants to connect to the internet for no reason (other then possibly spy on me and phone home to the maker). In my case it’s ccc.exe (Catalyst Control Center). Here’s the log that shows what happend:
Date/Time :2007-06-14 18:59:00
Severity :High
Reporter :Application Behavior Analysis
Description: Suspicious Behaviour (svchost.exe)
Application: C:\WINDOWS\system32\svchost.exe
Parent: C:\WINDOWS\system32\services.exe
Protocol: UDP In
Destination: My.IP.Address.Here::dhcp(68)
Details: P:\ATI Technologies\ATI.ACE\Core-Static\CCC.exe has tried to use C:\WINDOWS\system32\svchost.exe through OLE Automation, which can be used to hijack other applications.
What happens when I block this is that it prevents my internet connection to get refreshed every half an hour, and will therefor kill it. It’s not so much problem if it is just this program that causes this. I don’t have to keep it running, but what of other programs? I will either have to keep quitting my firewall and refresh IP manually or not use the program. I tried to add a rule manually to block ccc.exe, but that didn’t help. Also I’m not sure exactly which is the parent and child, ccc.exe or svchost.exe?
I’m just wondering if you’re looking in to it and there will be an update soon that fixes it, so I can block specific applications from reaching out to the internet rather than cutting the cable, sort of. :THNK