Newsgroup: it.comp.sicurezza.windows
Titolo: Problema con SCVHOST.EXE - Log vari.

Ho continui tentati di uscita dati da SCVHOST.EXE. 
Ho provato molti antivir e anti-spy, anche on-line. Tutti negativi.
Il problema non si pone se internet è scollegato.
Allego Log Kerio e link di HiJackThis_v2.exe.
Mi aiutate a capire cosa succede?
1,[25/May/2007 18:56:32] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1033->
64.4.21.91:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 18:56:35] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1034->
207.46.211.250:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 18:56:37] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1035->
64.4.21.91:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 18:56:39] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1036->
207.46.211.250:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 19:32:18] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1031->
207.46.18.74:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 19:32:20] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1032->
207.46.20.252:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 19:32:23] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1033->
207.46.18.74:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 19:32:25] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1034->
207.46.20.252:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 19:32:27] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1035->
207.46.18.74:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[25/May/2007 19:32:29] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1036->
207.46.20.252:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:01] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1033->
65.55.200.252:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:03] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1034->
207.46.211.250:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:05] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1035->
65.55.200.252:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:08] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1036->
207.46.211.250:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:10] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1037->
65.55.200.252:443
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:12] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1038->
207.46.211.250:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:15] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1040->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:15] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1041->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:18] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1043->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:18] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1044->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:21] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1045->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:21] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1046->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:24] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1047->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:24] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1048->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:27] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1050->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:27] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1051->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:29] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1057->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:29] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1058->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:32] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1059->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:32] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1060->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:34] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1062->
213.200.110.78:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:34] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1063->
213.200.110.80:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:36] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1067->
65.55.200.252:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:38] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1069->
65.55.200.252:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:41] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1070->
65.55.200.252:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
1,[26/May/2007 07:35:43] Rule 'Generic Host Process for Win32 Services': Blocked: Out TCP, localhost:1071->
65.55.200.252:80
, Owner: C:\WINDOWS\SYSTEM32\SVCHOST.EXE
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 7.46.24, on 26/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programmi\AOL\Active Virus Shield\avp.exe
c:\programmi\syslogd\syslogd_service.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Kerio\Personal Firewall\persfw.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\VMware\VMware Server\vmware-authd.exe
C:\Programmi\File comuni\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\bgsmsnd.exe
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\AOL\Active Virus Shield\avp.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programmi\Syslogd\Syslogd_Manager.exe
C:\Programmi\Anonymizer TNS\AnonTns.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Internet\Desktop\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
http://www.miositodiriferimento.com/homepage.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 
127.0.0.1:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\WINDOWS\system32\bgstb.dll
O3 - Toolbar: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\WINDOWS\system32\bgstb.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WellPhone DirectSync - ScheduleSync] C:\PROGRA~1\WELLPH~1\SCHEDU~1.EXE
O4 - HKLM\..\Run: [bgsmsnd.exe] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\bgsmsnd.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE2] "C:\Programmi\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [aol] "C:\Programmi\AOL\Active Virus Shield\avp.exe"
O4 - HKLM\..\RunOnce: [BCInstall0] "C:\Programmi\Pc Cleaner\pcclean.exe" /REMOVE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Syslogd_Manager.exe.lnk = C:\Programmi\Syslogd\Syslogd_Manager.exe
O4 - Startup: Start Firewall (2).lnk = C:\WINDOWS\system32\net.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digisoft AntiDialer.lnk = C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmi\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Programmi\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - 
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - 
http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - 
http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O17 - HKLM\System\CCS\Services\Tcpip\..\{5631BEB9-1F13-44C5-94FD-BB58D89E6AB8}: NameServer = 195.130.224.18,195.130.225.129
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Servizio stato di 
ASP.NET
 (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Active Virus Shield (AVP) - AOL - C:\Programmi\AOL\Active Virus Shield\avp.exe
O23 - Service: Kiwi Syslog Daemon - Kiwi Enterprises - c:\programmi\syslogd\syslogd_service.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Programmi\Kerio\Personal Firewall\persfw.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Programmi\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Programmi\File comuni\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Programmi\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
--
End of file - 7054 bytes
-- 
Questo articolo e` stato inviato dal sito web 
http://www.nonsolonews.it

 Mi aiutate a capire cosa succede?
[cut]
Cioè? Il processo svchost.exe (e non scvhost.exe) è normale che
"tenti" di uscire visto che è quello che permette al sistema operativo 
di andare in internet; gestisce gli aggiornamenti automatici, le
connessioni di rete, le condivisioni, e spesso fa da ponte a livello
kernel ad altri programmi che necessisitano di una connessione, anche
locale. Il primo log che hai postato è del firewall? Bisogna capire
perchè questo blocchi il processo verso quegli indirizzi, o gli hai
imposto tu di bloccarlo?
Ci sono virus o malware che sfruttano svchost.exe per collegarsi ma mi
sembra che il log di hijackthis non segnali niente di preoccupante e
quindi ti ripeto: qual'è il tuo problema?
Ciao.
-- 
Michele - Too far from America
MSN ID: myksto dot hotmail dot com
"It's the world we live and life in general..."

 quindi ti ripeto: qual'č il tuo problema?
Ho tolto aggiornamenti automatici. Il problema permane.
L'altro computer "gemello" non richiede queste connessioni nonostante gli
aggiornamenti automatici attivati. Da qui la stranezza e la mia
segnalazione. Altri suggerimenti?
Ciao!
--------------------------------
Inviato via 
http://arianna.libero.it/usenet/