two questions

1- i notice in the connections tab that svchost keeps connecting to ip address what is this ip and is this normal?
2-under blocked intrusions I keep getting c:programfiles/ Synaptics/SYNTp/SYNtpEnh/.exe being blocked from accessing memory with target of program files, comodocomodo internetsecurity.lcis.exe

In answer to your first question, the IP address looks similar to the Comodo Secure DNS Server IP address, although as far as I know the IP address should be (or secondary address). Is the IP address definitely, not

@2. You are witnessing the protection of Protected Files and Folders at work. It shows CIS, among others, is protected from memory access. It is how CIS protects its self.