[Essexboy]

It was actually a fairly clean system to start with, all I did was tidy up some orphan entries and remove the comodo update temp file to see if that was a blockage.

Emptying the temporary files may have speeded up the browsing a bit. But, as I say it looks good

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware



Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe

[Advertisements]

Hmm, the issue of having countless of outbound connections from svchost hasn't gone away. It happened again last night. They all seem to be connecting to my router so at least the destination isn't worrysome, but why would my system be establishing dozens, if not hundreds, of connections to my router using different ports?

 

Another thing I'm noticing is that I am now frequently getting inbound connections from System (the IP is, again, from my router). I'm not particularly worried about that (should I?), but I never used to get those, and now after running the fix with FRST it is happening frequently. Could the network reset have something to do with this? Is it possible it might have meddled with some firewall settings and removed a rule regarding inbound connections?

Edited by jn1000, 16 December 2014 - 05:09 AM.

[jn1000]

Hmm, the issue of having countless of outbound connections from svchost hasn't gone away. It happened again last night. They all seem to be connecting to my router so at least the destination isn't worrysome, but why would my system be establishing dozens, if not hundreds, of connections to my router using different ports?

 

Another thing I'm noticing is that I am now frequently getting inbound connections from System (the IP is, again, from my router). I'm not particularly worried about that (should I?), but I never used to get those, and now after running the fix with FRST it is happening frequently. Could the network reset have something to do with this? Is it possible it might have meddled with some firewall settings and removed a rule regarding inbound connections?

Edited by jn1000, 16 December 2014 - 05:09 AM.

[Essexboy]

The IGMP packets, most probably, are sent out by the router trying to discover other PCs on your network. This is legitimate traffic and whether you block or not is up to you and depends on how your network works. If blocking causes no problems, particularly if you only have one PC, then go ahead and do it.

The way to stop this is to disable the following two services (set them to disabled) :

Universal Plug and Play Device Host
SSDP Discovery Service

Go to Control Panel > Administrative Tools > Services
Locate the two services listed above
Right click the service and select Properties
In the drop down set to Disabled
Apply and OK out
Repeat for the second service



Reboot the computer

[jn1000]

Thanks for the tip, I followed the instructions. However, the connections that I spoke of in my previous post were not IGMP. They were TCP OUT (for svchost) and TCP IN (for System). Does that make any difference?

 

Also, explorer.exe forms several outbound TCP connections. But if all of this is normal, then I guess that wraps things up.

Edited by jn1000, 16 December 2014 - 11:30 AM.

[Essexboy]

These are my connections using Svchost and explorer. Although I never keep track of them





How is the computer behaving otherwise ?

[jn1000]

The computer is working fine otherwise, thanks. My svchost connections look very different from yours... Mind if I PM you a screenshot of my connections as one last step before closing the topic?

Edited by jn1000, 17 December 2014 - 06:53 PM.

[Essexboy]

Sure feel free

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

[jn1000]

It's probably nothing to worry about since it's all going to the router, but if you could confirm whether that's normal activity, I'd appreciate it. Thanks.

 

And to clarify, that only shows a portion of the connections from svchost. There were dozens more that time and sometimes there are literally hundreds.

 

Edit: I attached the screenshot to a private message.

Edited by jn1000, 23 December 2014 - 07:31 PM.

[Essexboy]

Hi the screenshot is missing could you attach it here ?

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.