svchost.exe

D

dd1313

Expert Member
Joined
Jul 23, 2005
Messages
1,552
Reaction score
0
Hi

My firewall shows svchost.exe trying to send to IP 239.255.255.250 on port 1900

any idea what this is please..

Thanks
DD
 
funny there are a few running in win task manager eats alot of mem bad for me pc :(
 
Just search all the suspects in windows search :)
 
To see if it isn't a virus you little piece of marshmallow.
 
piece of dust how can you see if it's a virus if your anti-virus can't even detect it?
 
No you can't, but can you think and stink for yourself :D Just google all the filenames that look suspicious, less work than windows search,

hou nou op om my vrae te vra hierso!! :mad:
 
svchost is totally normal windows service. just make shure its spelt right. The way some viruses work (mostly old ones) is to make a new proccess whihc has a very similar name to a common process and run that.

And its also normal for there to be a few of them in task manager. And they do eat alot of RAM.

However the attempt to get to some IP could be malicous.. dont really know how to check this.
 
Sounds like its trying to access windows messenger(port 1900)
 
NetRange: 224.0.0.0 - 239.255.255.255
CIDR: 224.0.0.0/4
NetName: MCAST-NET
NetHandle: NET-224-0-0-0-1
Parent:
NetType: IANA Special Use
NameServer: FLAG.EP.NET
NameServer: STRUL.STUPI.SE
NameServer: NS.ISI.EDU
NameServer: NIC.NEAR.NET
Comment: This block is reserved for special purposes.
Comment: Please see RFC 3171 for additional information.


Comment:
RegDate: 1991-05-22
Updated: 2002-09-16

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: Internet Corporation for Assigned Names and Number
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: [email protected]

OrgTechHandle: IANA-IP-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-301-5820
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2006-08-08 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

RFC3171 -IANA Guidelines said:
2. Definition of Current Assignment Practice

Unlike IPv4 unicast address assignment, where blocks of addresses are
delegated to regional registries, IPv4 multicast addresses are
assigned directly by the IANA. Current assignments appear as follows
[IANA]:

224.0.0.0 - 224.0.0.255 (224.0.0/24) Local Network Control Block
224.0.1.0 - 224.0.1.255 (224.0.1/24) Internetwork Control Block
224.0.2.0 - 224.0.255.0 AD-HOC Block
224.1.0.0 - 224.1.255.255 (224.1/16) ST Multicast Groups
224.2.0.0 - 224.2.255.255 (224.2/16) SDP/SAP Block
224.252.0.0 - 224.255.255.255 DIS Transient Block
225.0.0.0 - 231.255.255.255 RESERVED
232.0.0.0 - 232.255.255.255 (232/8) Source Specific Multicast
Block
233.0.0.0 - 233.255.255.255 (233/8) GLOP Block
234.0.0.0 - 238.255.255.255 RESERVED
239.0.0.0 - 239.255.255.255 (239/8) Administratively Scoped
Block
Click to expand...
RFC 3171 said:
9. Administratively Scoped Address Block (239/8)

Addresses in the Administratively Scoped Address block are for local
use within a domain and are described in [RFC2365].

9.1. Assignment Guidelines

Since addresses in this block are local to a domain, no IANA
assignment policy is required.
Click to expand...
shheeeesh....
RFC2365 said:
4. Definition of the Administratively Scoped IPv4 Multicast Space

The administratively scoped IPv4 multicast address space is defined
to be the range 239.0.0.0 to 239.255.255.255.

5. Discussion

In order to support administratively scoped IP multicast, a router
should support the configuration of per-interface scoped IP multicast
boundaries. Such a router, called a boundary router, does not forward
packets matching an interface's boundary definition in either
direction (the bi-directional check prevents problems with multi-
access networks). In addition, a boundary router always prunes the
boundary for dense-mode groups [PIMDM], and doesn't accept joins for
sparse-mode groups [PIMSM] in the administratively scoped range.

6. The Structure of the Administratively Scoped Multicast Space

The structure of the IP version 4 administratively scoped multicast
space is loosely based on the IP Version 6 Addressing Architecture
described in RFC 1884 [RFC1884]. This document defines two important
scopes: the IPv4 Local Scope and IPv4 Organization Local Scope. These
scopes are described below.
6.1. The IPv4 Local Scope -- 239.255.0.0/16

239.255.0.0/16 is defined to be the IPv4 Local Scope. The Local
Scope is the minimal enclosing scope, and hence is not further
divisible. Although the exact extent of a Local Scope is site
dependent, locally scoped regions must obey certain topological
constraints. In particular, a Local Scope must not span any other
scope boundary. Further, a Local Scope must be completely contained
within or equal to any larger scope. In the event that scope regions
overlap in area, the area of overlap must be in its own local scope.
This implies that any scope boundary is also a boundary for the Local
Scope. The more general topological requirements for administratively
scoped regions are discussed below.
Click to expand...

If I read this correctly, 239.255.x.x addresses are within your own network, and your router will not pass requests beyond your domain...
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X