Inbound connection from 94.245.115.189 (UDP) to svchost.exe

Comodo Internet Security - CIS Firewall Help - CIS
#1

Hello!

My pc established an (allowed) outbound UDP-connection to the server 94.245.115.188:3544. Then Comodo firewall asked me whether I wanted to allow an inbound UDP-connection from 94.245.115.189 to svchost.exe on Port 1060. The servers seem to belong to Microsoft.
Do you know which Microsoft service tries to connect to my pc? Is this service necessary?

#2

Hi,

Microsoft update; a useful one !!
:o

#3

UDP Port 3544 is IPv6 teredo tunnelling. Are you using Vista or Win 7?

#4

Hi gillou78, it isn’t so easy. I’ve deactivated Windows Update (for testing purposes). But the connections remain: a constant outbound UDP-connection to 94.245.115.188:3544 and the try of the server 94.245.115.189 to establish a connection to my svchost.exe.

There aren’t threatcast statistics regarding this issue.

I’m using Win XP Home SP3. TCP/IP V6 is installed. Is it the reason? It was installed by the OS. Necessary?

#5
I'm using Win XP Home SP3. TCP/IP V6 is installed. Is it the reason? It was installed by the OS. Necessary?

That’s the reason. if you don’t need IPv6 remove it.

To uninstall IPv6:-

Start, point to All Programs, point to Accessories, and then click Command Prompt.
At the command prompt, type:netsh int ipv6 uninstall and press the Enter Key.

#6

Das,

How does one know that he does not need IPv6? Has IPv6 not gone operational?

I thought IPv6 addresses had already begun to be assigned, while the IPv4 addresses are in shorter and shorter supply. I thought that I had read that the IPv4 addresses were predicted to be all gone in the next year or two. No lese majeste intended. Please correct me if I have it wrong…

RxDdude

#7

The remainder of the IPv4 address pool is ‘currently’ scheduled to be assigned by the end of 2011. That in itself doe not mean that everyone will have to immediately switch to IPv6. It just means there will be no more blocks of IPv4 addresses available for use.

There are only a few reasons why you might need IPv6 installed and active at this time:

  1. Your ISP actively supports the transition and has an infrastructure to support that transition.
  2. You’re actively testing IPv6 either through your ISP or via a tunnel broker
  3. There are specific IPv6 resources you need to access

There are probably some others, but that’s all I can think of.

If you answered yes to any of the above, then you really need to migrate to an operating system that has inherent IPv6 support, such as Windows 7 or Linux/FreeBSD. using Ipv6 on XP is a dogs dinner.

You will also need a firewall that actively supports IPv6, which Comodo firewall does not, at least not yet. This is one of the reasons I’m not currently using the product. Granted, it’s possible to fudge limited support, by trying to persuade an IPv4 firewall to handle certain IPv6 traffic types, but it’s a kludge.

#8

Das,

Many thanks for the clarity and completeness of your IPv6 discussion on this point. I think that this last of yours ought to be posted sticky somewhere, and it doesn’t really belong in this thread where it is concealed under the original title. I think that I do not have any IPv6 capability in my WinXP system, unless Firefox v3.6.3 provides some of that. Very helpful! I have some studying to do!

FYI, I am planning to upgrade my HP a1020n (P4 [at] 3.06 GHz, 2 GB RAM) with XP Prof SP3 to Windows 7® (already have the 7 Home Premium Edition CDs still in shrinkwrap, raring to go). Am raring to go when I can get my new 500GB WD Caviar hard drive installed (Microsoft® Windows® XP Professional SP3 (x86) Explorer.exe doesn’t recognize it, not partitioned and formatted yet, and I am scratching my head over how to partition and format if I cannot see it in Explorer. The BIOS recognizes it, and Device manager shows it “working normally” (what a crock). I guess I ought to make it NTFS like the current system partition…), and a probable W32/Virut infection and maybe something else (Win32/Pdfjsc.J is being regularly quarantined nearly every scan by M$ Security Essentials, for one thing.) cleaned up. Wish I could go full time for a couple of days on that. No doubt, I will need some amount of handholding in this Forum, but that is for another day…

Thanks again!

 R+Ddude

=============================================
All I really need to know in life, I learned from
the Nike ads on TV.

“Just do it!”
– Michael
(No! not Jackson! Jordan!)
=============================================

#9

I’m glad the information was of use.

With regard to your new hard disk, XP can be a bit ‘iffy’ with larger hard disks, even though issues like that were supposed to have been resolved in SP2!

Couple of things to do:

  1. make sure you have the latest motherboard chipset drivers installed.
  2. if it’s a SATA drive, install the appropriate driver for your controller.
  3. right click on My Computer and select Manage then Disk manager. If your disk is there, you may be able to partition by right clicking on the volume.
  4. if the above fail, you can either download Partition Wizard - Home Edition (freeware) which may let you do what you need. Better still, download Parted magic http://partedmagic.com/download.html burn it to a CD or create a bootable USB. All the instructions are on the download page. The latter would be my choice.

Have fun

#10

Thank you for your answers. I don’t need IP V6. I’ve deactivated IP V6 in the configuration of the lan network interface. Then the connections with the Microsoft servers were immediately terminated.
But I can’t understand why there were such connections to Microsoft!

#11

Teredo is a transition technology, essentially, it’s provided as a means to tunnel IPv6 datagrams through an IPv4 tunnel. Microsoft will always assume you want to use the technology by default, hence the svchost connection requests.