Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of the workstations we have had it's security log full. The reason to that was constantly appearing event 861, that is Widows Firewall blocks processes svchost.exe and lsass.exe from listening to non-system over UDP. By non-system ports I mean high number ports such as 1500, 3000, 6000 (not limited to those).

Why on earth would the Services Host process would be listening to ports usually used by programs over UDP?

I scanned for infections using 3 different anti-malware tools and found nothing. This looks like an infection, but no infection is found. I am investigating which processes actually run under the process ID's that listen. I will post the services a bit later.

share|improve this question
up vote 2 down vote accepted

Have you tried running CurrPorts to see if svchost and lsass are phoning back to any external IPs? You could even use it with IP to Country lookup tables to identify the remote country/site. If indeed there is such traffic, then that would support your suspicions of an infection.

I would also run Process Explorer to see more details about the threads that are created and see if that helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.