svchost question

After installing comodo 3.10, svchost opens 15-100 connections to the ADSL modem when i open firefox (192.168.. → 192.168..) Is this normal?

PS. I have seen 15 connections also earlier, so it isnt a problem but 100 connections is kinda annoying.

Anybody? Now i cant system restore. When i try to system restore, it just restarts my computer.

Hmm that many Svhosts sounds suspicous. Is there any blocked attempts in the firewall logs?

Nothing in the log. I have runned malwarebytes, a-squared, rootkitrevealer, avira, hijackthis and nothing came up. Well, if this was caused by CIS, i hope they release a bug fixed version. This isnt dangerous, it is just annoying.

Try setting the firewall to Tranning mode, and see if the Svhosts lower in numbers, also you should delete the rules for Svhost in the firewall.

Tried, didn’t work. The problem is not in the rules, it is somewhere else. Before installing 3.10 svchost didn’t act like that. When installed and rebooted those connections just growed.

Whats your FW and D+ settings. Are you using the default global rules?

Svchost.exe is set to outgoing only and i am not using default global rules. im using “block all incoming connections” since there isn’t anything important for me in incoming connections.

Do you have any applications that run in the backround that call to the web? i.e. iTunes and so on

Can you try switching to a configuration you havent used and see if the problem is still there?

No, there isnt. I tried internet security and firewall security and still svchost act like in previous configuration. I saw that there is .530 released, i try that and then post what is happening.

After installing .530, svchost is acting same as before.

Did you install Secure DNS? Is svhost market as a trusted Application?

Seems your not the only one:
https://forums.comodo.com/empty-t42021.0.html

Well, i updated from 3.9 to 3.10 with automatic updater, and im not using comodo secure dns. CIS maybe have it enabled somehow but im still using that “Obtain an dns server automatically” (ISP DNS server). Svchost is set to outgoing only as i said in previous posts.

Ok im out of ideas, let me PM a mod.

It seams your not the only one with this problem.

Do you know what type of requests SVCHOST is sending to the ADSL modem? What’s the port & protocol? They could be DNS lookup requests (UDP/TCP port 53), some applications use this method.

Protocol: UDP
Port Range: 50000-70000 → 53

Example: 192.168..:(50000-70000) → 192.168..:53

So it seems to be a DNS request, but it is caused by Comodo.

Im also seeing ridiculous amounts of DNS requests :-TD I did start off using Comodos DNS servers but have now gone back to openDNS and the problem is still the same!

Matt

Do these requests occur when the system is idle or only when you make a connection via an application?

After reboot i opened firefox and then those connections started. They mostly occur when using browser, and some times with messenger programs (WLM). And yesterday i noticed that firefox’s connections have also grown up.

So, after you launch an application you see a number of DNS queries. Does the number of queries reduce after a short period of time?