Any one else have this running?

[Adhmuz]

Svchost.exe (NetworkService) and its uploading to landauer.arvixededicated.com

To check this go to your resource monitor under the network tab.

If you go to the site it's something to do with Microsoft Internet Information Services 8.0 and then links to a Web development page.

Now what concerns me is that my PC has been uploading to this site for the last 2 hours while I was afk, even now it's uploading on and off. I'm going to have to block the address if it persists, but would like to know if any one can explain whats happening here, or if they also have this mystery windows network service uploading randomly.

And for the record I do no web development and I'm not hosting any files.

 

[GhostRyder]

I have that on all my machines, its always running in the background uploading stuff to microsoft. I believe that it has to do with the whole "Usage" information that gets sent to them so they can see whats being used by windows users and what services are currently in use.

Im pretty sure every windows machine has it running in the background.

 

[cliffordcooley]

I'm not sure if I have this resource (Win7) usage. The reverse lookup for "landauer.arvixededicated.com" is "96.127.159.154".

 

[Adhmuz]

I blocked access to landauer.arvixededicated.com and about 1 hour later it appears to be back at it, but this time with an IP I can trace, 96.53.85.130 which is an IP out of Chilliwack BC. Also another related IP pops up 173.77.159.235 out of Kings Park NY. Should I start to be concerned with this activity? Or just keep blocking it.

 

[Cobalt006]

Not to sure about this. But a while back I seen something about that site on another forum. From what I gather. It your ISP. They use it to monitor IP address .

 

[DelJo63]

Hmm; I'm on Win/7 Pro and while SVCHOSTS is running, I see no such uploading . . .

 

[Cobalt006]

Like I said I seen it on another forum. Have no ideal weather its true or not. No I have no uploading from my SVCHOSTS , Neither. But that was what was posted.

 

[DelJo63]

Using CurrPorts from www.nirsoft.net, you can monitor the program (svchosts) local and remote IP and Ports for activity

 

[St1ckM4n]

I too have the 224.0.0.254 IP, along with three others that are on my network. I wouldn't worry about it.

 

[Adhmuz]

It's been a couple days since I've blocked the IP with peer block. And so far the IP has been port scanning me every couple of hours for an hour in 3 minute intervals. Nothing has shown an error and I've got no issues to report besides.

 

[Cobalt006]

Use the tool Joebeard. Post in 8# .

 

[DelJo63]

I too have the 224.0.0.254 IP, along with three others that are on my network. I wouldn't worry about it.

That's the IPv4 Multicasting address - - we should ALL have it.
http://www.networksorcery.com/enp/protocol/ip/multicast.htm

 

[DelJo63]

OOPS - - I may have spoken too soon.
224.0.0.0/24 is the Unicast IP range.
224.0.0.254 is a special 'experimental' IP.

Media Player server can be implimented on UniCAST or MultiCAST and here's the Microsofts description.

Personally, this thread prompted me to

• deny 224.0.0.254 from any for Public & Private profiles (ie left alone for Work/Domain).