Quoting Rudy Dominguez ([EMAIL PROTECTED]): > Anyone familer with how this file works? I just noticed this after setting > up my "personal firewall" under XP it seems that this file is trying to > access an outside machine on port 1900 under UDP.
<survey/microsoft says> Svchost.exe is a generic host process name for services that are run from dynamic-link libraries (DLLs). The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging. <survey says> Check HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost for a list of all services that use svchost to perform their work, also check HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ for the actual services in each group. This access is, btw. a printer solicitation (UDP, Port 1900, Multicast) and can be safely turned off. Unfortunately you seem to be running one of those pieces of software that neglect to tell you which IP the outgoing data is going to or give you a glance into the packet to determine yourself. Read http://www.samspade.org/d/persfire.html for more information. jonas -- Jonas M Luster -- d-fensive networks, Inc. -- http://www.d-fensive.com
