• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

lsass.exe svchost.exe preparing to access the internet? virus?

In my Norton firewall log it says.

An Instance of "C:\Windows\system32\svchost.exe" is preparing to access the internet.

Few minutes later -  Rule "Default Block Windows File Sharing" blocked communication. Process name is "System".

An instance of "C:\Windows\system32\lsass.exe" is preparing to access the internet.

Could this be linked to all day yesterday, I was getting this message spammed in my Norton firewall log:

Unused port blocking has blocked communications. Inbound TCP connection.

It was at least over 50 IP's trying to access my port 3724, should I be worried?

The order of events goes from bottom to top, this is the first day both of those system32 files have tried to access the internet and first day for the unused port blocking communications. inbound TCP connection as well. Can anyone confirm why they may be doing this?

Replies

Kudos0

Re: lsass.exe svchost.exe preparing to access the internet? virus?

anyone out there please?
Kudos0

Re: lsass.exe svchost.exe preparing to access the internet? virus?

To give these fine folks a head start, would you please provide them your OS and what version of NIS you are using.  There seems to be a lot of problems out there lately, that they are working on, but they will get to you.. 
Kudos0

Re: lsass.exe svchost.exe preparing to access the internet? virus?

Hi zogululz,

Svchost.exe and lsass.exe routinely access the internet.  If you seach these terms in Norton's Full History Log I think you'll see that this is a normal, everyday occurrence.

These are therefore probably not related to the activity you were seeing on port 3724.  For what it's worth SANS is showing a lot of recent activity on this port with the number of sources per day peaking dramatically a few days ago.  These types of intrusion attempts are part of the normal internet background and this is the reason firewalls are so important.  These port scans are automated so hackers can sweep a block of IP addresses hoping to find an unprotected system.  You were not being individually attacked.  Norton's log is reporting that your firewall did it's job in blocking these, so you do not need to be concerned.  Just curious:  Are you now showing that activity on this port on your PC has slowed or stopped?

Message Edited by SendOfJive on 07-25-2009 01:01 PMMessage Edited by SendOfJive on 07-25-2009 01:05 PM
Kudos0

Re: lsass.exe svchost.exe preparing to access the internet? virus?

It has stopped completely.Message Edited by zogululz on 07-25-2009 02:07 PM

This thread is closed from further comment. Please visit the forum to start a new thread.