The ghost SVCHOST

[Guest]

Anyone could help me about which ports handle the usual services hosted by the proccess SVCHOST? I can see what it seems a dynamic asignation of ports in the range 1026-1040.

Thanks,

 

[Guest]

Of course I don't refer to RPC (port 135). It is a well-known service in SVCHOST.

Thanks.

 

[Guest]

An example. What the hells are doing a service in SVCHOST transmiting UDP in my port 1067?

 

[Guest]

I don't refer also to port 123 and 1026. It is a well-known service. Time synchronizing service and perhaps Quality of Service (QoS).

 

[Guest]

You do know that fake SVCHOSTS are a product of a number of different viruses?

 

[frodo]

for a detailed diag tool, go to sysinternal's site and get their Process
Explorer. It can tell you what DLLs a process is using, and what ports it
has open, along w/ just about everything else about a process. It's usful
in figuring out what each instance of srvchost is doing, and if it might
be a virus/trojan masqurader (sp?).