svchost making connection to internet

Hi,

I have a few Win2003 servers. I noticed that periodically the servers will
attempt to connect to some random sites website thru http. The connection
seems to be cause by svchost, which I presume could be due to automatic
update. However, I have already disable automatic update on the servers, but
the connection always appear every few hours.

Is this problem cause by automatic update?

"Denzuku" <> wrote in message
news98798B2-5B5C-46EB-B1F7-...
> Hi,
>
> I have a few Win2003 servers. I noticed that periodically the servers will
> attempt to connect to some random sites website thru http. The connection
> seems to be cause by svchost, which I presume could be due to automatic
> update. However, I have already disable automatic update on the servers, but
> the connection always appear every few hours.
>
> Is this problem cause by automatic update?


Does your OS have the new netstat options which show the PID
and module names? E.g. on XP I would answer this question with

netstat -abov

then if the task's executable turns out to be svchost.exe as you suspect
use tasklist /svc referring to that task's PID. E.g.

tasklist /svc /fi "PID eq xxxx"

(where xxxx is whatever PID (decimal number) shows in the netstat output.

Or just keep it simple and list them all to see the one that matches
the netstat output:

tasklist /svc /fi "Imagename eq svchost.exe"


If that turned out to be a svchost.exe which hosted several services
I don't know how you could differentiate which one was using the link.
Hopefully the additional information provided by the netstat -v switch
(above) would help clarify that.


Good luck

Robert Aldwinckle
---