IP Address Question

[wj777x]

Today I got about 30 consecutive requests
for Internet access from the Services.exe
program. I know it's an internal O/S program,
but I don't like connecting to sites without
knowing who or what it's for, especially when
I didn't knowingly initiate the contact,
so I clicked DENY for each request. I did
make note of the "Source IP" addresses from
each request.

I ran the program WHOIS-IP and found that all
the IP addresses were from Australia, within the
range of 71.197.0.1.DHCP to 73.202.216.1.DHCP.
WHOIS-IP does not identify who the owner of
the IP addresses is. Is there any way to find
out who the owner is, and does anyone know
why SERVICES.COM would have been trying to
give Internet permission to so many
Austrailian IP addresses? A virus or some
simpler explaination?

Thank you.

William

 

[Ace Fekay [MVP]]

In

Today I got about 30 consecutive requests
for Internet access from the Services.exe
program. I know it's an internal O/S program,
but I don't like connecting to sites without
knowing who or what it's for, especially when
I didn't knowingly initiate the contact,
so I clicked DENY for each request. I did
make note of the "Source IP" addresses from
each request.

I ran the program WHOIS-IP and found that all
the IP addresses were from Australia, within the
range of 71.197.0.1.DHCP to 73.202.216.1.DHCP.
WHOIS-IP does not identify who the owner of
the IP addresses is. Is there any way to find
out who the owner is, and does anyone know
why SERVICES.COM would have been trying to
give Internet permission to so many
Austrailian IP addresses? A virus or some
simpler explaination?

Thank you.

William

Very difficult to answer, William. Services.exe is a host for DLLs in most
cases. I'm not sure what program you are using or installed that is alerting
you of these requests, but if it is that intune with your services.exe file,
it should be able to discern or give you some sort of info about what is
asking. If not, I would highly suggest to install and run an antispyware
(Windows defender is free at www.microsoft.com/defender) and/or firewall
program (Windows has a built in firewall you can use) to determine what is
doing this and of course to clean up any unwanted rogue programs or services
that do not belong. Of course if this is a DC, I would be very very careful
on how to setup and run the Windows firewall. I cvan also suggest to run and
install DLLShow, which can tell you what exe's are running and what DLLs are
running under it.

If the problem is deeper, I would suggest a reinstall.

--
Regards,
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Infinite Diversities in Infinite Combinations

Having difficulty reading or finding responses to your post?
Instead of the website you're using, try using OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. Anonymous access. It's free - no username or password
required nor do you need a Newsgroup Usenet account with your ISP. It
connects directly to the Microsoft Public Newsgroups. OEx allows you
o easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject. It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

"Quitting smoking is easy. I've done it a thousand times." - Mark Twain