Why does Microsoft Services & Controller App want to access the net?!

[Deja Q]

Windows 2000 Pro user here.

I've got my firewall installed.

The firewall reports that "Microsoft Services and Controller Application (part of the Windows sub-system) is attempting to access the Internet.) In Details, it's a UDP inbound transmission from remote address 68.63.191.66:4177.

It then asks me what I want to do.

Naturally, I block the access. There's no reason why an operating system needs to access the internet (or vice-versa, even if it a "Low Risk") unless I, the user, want it to.

Has anybody else seen this happen? It happens to me infrequently, and I'm not sure if it's M$ trying to snoop around or if it's a hacker. Either way, both entities are the same: evil.

[Liberal Veteran]

1. Address is owned by Comcast

I did an IP lookup for you.

OrgName: Comcast Cable Communications, Inc.
OrgID: CMCS
Address: 3 Executive Campus
Address: 5th Floor
City: Cherry Hill
StateProv: NJ
PostalCode: 08002
Country: US

I suspect that someone elses computer is looking for a way in, but it ain't M$. Could be a trojan scan or blaster type virus trying to find a way in.

I wouldn't worry too much about it unless you can't block it out. When I was running a firewall, I was shocked at the amount of traffic trying to make its way into my machine.

[Deja Q]

2. Thanks!

I should reinstall my IP lookup program...

Strange that Comcast would want to access my computer... It's actually a vmware session, but I have links to my Linux profile's home directory that can be accessed from within the session...

[short bus president]

3. Is comcast your broadband provider?

And are you able to stay connected with it blocked?

[Deja Q]

4. Nope, MSN is...

until the end of this month when I switch to something less expensive. Probably Earthlink as they host my websites. (only one site technically but I will be building a second one, linked via a separate URL...)

I have no idea why Comcast wants to snoop.

Yep, when I block it I can still use the net. It makes no sense. Not yet.

[tsipple]

5. Shut Down Lots of Stuff

This web site gives some good recommendations on which services you really don't need to be running, and that will likely assist here.

By the way, address 68.63.191.66 is someone connecting via Comcast high speed Internet in Arizona. Don't know if that helps or not.

Does it say what port 68.63.191.66:4177 is trying to connect to on your PC?

Note that there's really no substitute for a hardware-based firewall. These are terribly cheap now.

[Deja Q]

6. Port

It's port 4177.

Sounds like a hacker trying to break in... :-( But they won't, so ha-ha to them! :D

Thanks for the link. I do have his link for XP, which is invaluable.