cds17.ams9.llnw.net and a###.a###.akamaitechnologies.com

[Tom.K]

"svchost.exe:892 TCP (noname):1233 cds17.ams9.llnw.net:http ESTABLISHED"
I'm getting scared what the hell this is sending!
Before 2-3 mins, it was here.
Right now while i'm writing, it's not here.
The same thing is happening with a###.a###.akamaitechnologies.com (# are numbers, can't remember which).
Can someone explain how this thing is here and how to get rid of it?

Both WOT results say dangerous:
http://www.mywot.com/en/scorecard/llnw.net
http://www.mywot.com/en/scorecard/akamaitechnologies.com

What to do?

 

[shelf life]

svchost exe, PID 892 remote? port 1233 est. connection to some server.
Maybe you have something checking for updates? akamaitechnologies is a huge provider of web based content and media. when you view a web page some of the content may actually be pulled off servers in many different locations, different ip's etc.

 

[Tom.K]

I'm not using any automatic updates. However, there are some exceptions: Google Updater, Flash and Shockwave. There is no option to disable Google Updater, Flash updates itself, notifies me at startup (i'm at that time disconnected) and Shockwave updates when some Shockwave object is active and it runs PostUpdate.exe (it's in RunOnce startup, but it runs like Run startup, PostUpdate is already disabled).

when you view a web page some of the content may actually be pulled off servers in many different locations, different ip's etc.

But it's active even if my connection is idle and no browser is running. Should I show a list of services?

 

[shelf life]

heres the domain lookup to get the ip

http://ip-lookup.net/domain.php

ip resolves to:
65.54.89.20

Host : cds17.ams9.llnw.net OK
Country : United States

OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: US

NetRange: 65.52.0.0 - 65.55.255.255
CIDR: 65.52.0.0/14
NetName: MICROSOFT-1BLK
NetHandle: NET-65-52-0-0-1
Parent: NET-65-0-0-0-0
NetType: Direct Assignment
NameServer: NS1.MSFT.NET
NameServer: NS5.MSFT.NET

 

[Tom.K]

If it's Microsoft related, then no problems. I was too much in panic due to weird host address. Thanks for info and make me less in panic.