Windows 10: \windows\system32\svchost.exe using IP 93.184.221.240:80

Cisco AMP Endpoint detect the IP 93.184.221.240:80 as a malicious connection and we need to know if this is a legitimate.



Regards,

Tariq

:)

 

What does the svchost do?

Lots of Windows services are tied to the SVChost, and /or are listed as SVChost in the process list(s).

Unfortunatley with Vista, there's a lot more dependencies between the services, and thus you'll be FORCED to run more instances of SVChosts; unlike XP where things were more independent and you could disable more features resulting in less SVChost instances. That and XP and Vista are different.

Regardless of your Windows version, you can check out some service slimming guides or goto Black Viper's website and take his advice. Depending on your needs you may be able to cut down the amount of SVChost running, and save some RAM.

XP should never have an SVChost using 50mb. Vista however can.

 

Analyzing Svchost processes in Windows

Here's how to track down detailed information about any Svchost.exe process running in Windows 7/8.

a) You can use the Tasklist command-line tool to learn which services are running in a Svchost.exe. Just run cmd (command prompt) and hit

Tasklist /svc /fo list

Scroll through the list and find what you need. It's not quite intuitive so you can use third party programs with gui. See below:

b) You can use svchost viewer. Best utility. Note: to run this under XP you need .Net framework 2.0





c) Svchost Process Analyzer is another app for that.





d) And another app called Svchost lookup tool





e) And it won't hurt if you use Process Explorer and System Explorer.


It's never bad to keep your system under control, plus all these apps are portable no installation is required.

kthbai

 

RAM Died: svchost error

Isnt svchost a service related to programs tho, and not the OS itself?
Like for example, there are multiple svchosts at any one time for multiple programs.

Though i suppose that still suggests the OS is buggered at the core.