I'm having a problem where I have a local server machine that shouldn't have anything to do with our local web server, but yet the web server's Symantec Endpoint protection is showing the local server (IP) is constantly hitting the web server and being blocked. The application is showing as svchost.exe. Getting a new log entry ever few seconds.

  • 1
    Why don't you investigate it to find out? Run "netstat -ano" from an elevated command prompt on the server in question and see which process is attempting to connect to the web server. – joeqwerty Apr 11 '18 at 14:29
  • 1
    @joeqwerty Thats exactly the kind of thing I was trying to figure out - how to investigate, thanks! – DemiSheep Apr 11 '18 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.