Topic 'persistent connection to qw-in-f113.1e100.net on boot' in forum 'Security' - dslreports.com

Re: persistent connection to qw-in-f113.1e100.net on boot

Mon, 22 Mar 2010 21:37:50 EDT

jarrycanada posted : gogregor6, have you cleared all your cookies from this computer that has these remote connections your talking about? If you disconnect your internet and reboot and use TCPview do you see these connections on start up with no internet access?

just on a side note, I could not help but notice you still use spybot, I would recommend you upgrade to something more modern like SUPERAntiSpyware and Malwarebytes Anti-Malware, anyone here will agree that spybot's time has sorta come and gone. still a useful tool to have mind you, but it's the last one scan with anymore.

Re: persistent connection to qw-in-f113.1e100.net on boot

Mon, 22 Mar 2010 17:44:29 EDT

NetFixer posted :

said by GeekGirl1:

Google is everywhere...

That about sums it up. Google is the new Akamai.

The 1e100 pandemic will soon take control of the internet (if not the globe). ;)
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Mon, 22 Mar 2010 17:29:46 EDT

GeekGirl1 posted : This persistent connection was driving me crazy. Online Armour (firewall) reported the persistent connections as coming from Avast! (antivirus). However, the source was from Firefox. I guess since the antivirus is hooked into the http traffic, that's how it goes out.

ashWebSv.exe/TCP to qw-in-f113.1e100.net:http. I also see qw-in-f102.1e100.net:http, iad04s01-in-f147.1e100.net:http.

I did some quick research and found that this persistent connection is from Firefox's safe browsing feature. The Mysterious 1e100.net

I unchecked the "Block reported attack sites" and "Block reported web forgeries" choices in the Security tab and most of the persistent connections went away.

In Firefox, do about:config and filter on safebrowsing to see how what Firefox is doing.

Interesting that Thunderbird also connects to 1e100.net when it checks for new mail from my gmail account (Google, smtp.gmail.com is what I entered):

Thunderbird.exe/TCP to qy-in-f109.1e100.net:pop3s

Google is everywhere. Typing text in the search engine box (Google is default) fires up those persistent connections. httpFox showed queries to suggestqueries.google.com.

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 16:11:39 EDT

NetFixer posted : To continue in the same vein as the last few posts in this thread, there is also a leloo.net (el ee el oh oh dot net) domain:


Domain name: leloo.net
Administrative Contact:
   Inside Internet
   Novi Kod (domene@inside.hr)
   +385.12341433
   Fax: +385.12341434
   Cretski Odvojak, 1
   Zagreb,  10000
   HR

However, for anyone wishing to register it for the purpose of masquerading as Google (and/or blackmailing them to purchase the domain name from you), the domain lel00.net (el ee el zero zero dot net) is currently available.

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 14:29:21 EDT

AVD posted : nevermind

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 13:06:51 EDT

Archivis posted : stop pinging me :(

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 13:05:15 EDT

NetFixer posted :

said by Archivis:

I guess it isn't really going anywhere if the domain doesn't work.

Oh Oh, I'll bet you didn't know that you had your own subdomain and host name did you?


C:\>/nslookup Archivis.1e1oo.net
Server:  dcs-srv.dcs-net
Address:  192.168.10.2
 
Non-authoritative answer:
Name:    Archivis.1e1oo.net
Address:  208.73.210.27
 
C:\>ping Archivis.1e1oo.net
 
Pinging Archivis.1e1oo.net [208.73.210.27] with 32 bytes of data:
 
Reply from 208.73.210.27: bytes=32 time=66ms TTL=236
Reply from 208.73.210.27: bytes=32 time=68ms TTL=239
Reply from 208.73.210.27: bytes=32 time=66ms TTL=236
Reply from 208.73.210.27: bytes=32 time=69ms TTL=239
 
Ping statistics for 208.73.210.27:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 66ms, Maximum = 69ms, Average = 67ms

And, that one does seem to go somewhere.

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:59:56 EDT

Archivis posted : I guess it isn't really going anywhere if the domain doesn't work.

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:59:29 EDT

Archivis posted : You're right. I had to check again. My own computer now is connected to 1e100.

vw-in-f100.1e100.net

My bad. It's definitely zeros, not "oh's"
--
'A government big enough to give you everything you want, is strong enough to take everything you have.' -Thomas Jefferson -

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:56:57 EDT

NetFixer posted :

said by Archivis:

qw-in-f113.1e1oo.net resolves to 208.73.210.27.

That is because the domain 1e1oo.net uses a wild card DNS as shown below. It is also totally irrelevant since the domain 1e1oo.net has absolutely nothing to do with the Google owned 1e100.net.


C:\>nslookup 1e1oo.net
Server:  dcs-srv.dcs-net
Address:  192.168.10.2
 
Non-authoritative answer:
Name:    1e1oo.net
Address:  208.73.210.27
 
C:\>nslookup qw-in-f113.1e1oo.net
Server:  dcs-srv.dcs-net
Address:  192.168.10.2
 
Non-authoritative answer:
Name:    qw-in-f113.1e1oo.net
Address:  208.73.210.27
 
C:\>nslookup stuff.it.where.the.sun.does.not.shine.1e1oo.net
Server:  dcs-srv.dcs-net
Address:  192.168.10.2
 
Non-authoritative answer:
Name:    stuff.it.where.the.sun.does.not.shine.1e1oo.net
Address:  208.73.210.27

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:50:37 EDT

Archivis posted : qw-in-f113.1e1oo.net resolves to 208.73.210.27.

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:50:02 EDT

AVD posted : oh oh

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:49:42 EDT

Archivis posted : Maybe you should try using the letter O instead of zeros (0).

one e one o o dot net

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:47:02 EDT

NetFixer posted : I am not sure exactly what you are trying to do, so I am not able to provide any advice.

I think, however, that you may not understand the difference between a domain name and a host name. A domain name is the registered name for a domain, and a domain may contain many subdomains and host names. The domain name itself does not have to have any specific host associated with it, nor is there any requirement for any domain or host to be pingable.

Examples:


C:\>ping 1e100.net
Ping request could not find host 1e100.net. Please check the name and try again.
 
C:\>ping qw-in-f113.1e100.net
 
Pinging qw-in-f113.1e100.net [74.125.93.113] with 32 bytes of data:
 
Reply from 74.125.93.113: bytes=32 time=48ms TTL=44
Reply from 74.125.93.113: bytes=32 time=52ms TTL=47
Reply from 74.125.93.113: bytes=32 time=48ms TTL=44
Reply from 74.125.93.113: bytes=32 time=50ms TTL=47
 
Ping statistics for 74.125.93.113:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 48ms, Maximum = 52ms, Average = 49ms
 
C:\>nslookup 1e100.net
Server:  dcs-srv.dcs-net
Address:  192.168.10.2
 
Name:    1e100.net
 
C:\>nslookup qw-in-f113.1e100.net
Server:  dcs-srv.dcs-net
Address:  192.168.10.2
 
Non-authoritative answer:
Name:    qw-in-f113.1e100.net
Address:  74.125.93.113
 
C:\>ping 1e1oo.net
 
Pinging 1e1oo.net [208.73.210.27] with 32 bytes of data:
 
Reply from 208.73.210.27: bytes=32 time=66ms TTL=236
Reply from 208.73.210.27: bytes=32 time=68ms TTL=239
Reply from 208.73.210.27: bytes=32 time=65ms TTL=236
Reply from 208.73.210.27: bytes=32 time=68ms TTL=239
 
Ping statistics for 208.73.210.27:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 65ms, Maximum = 68ms, Average = 66ms
 
C:\>nslookup 1e1oo.net
Server:  dcs-srv.dcs-net
Address:  192.168.10.2
 
Non-authoritative answer:
Name:    1e1oo.net
Address:  208.73.210.27

You will note that the domain/host name 1e100.net does not have a DNS record that defines an IP address. The host name qw-in-f113.1e100.net does have an IP address defined in DNS.

OTOH, the domain name 1e1oo.net also has a host name with an IP address defined in DNS. However, that domain is totally unrelated to the Google owned 1e100.net (as I thought I made clear in my previous post).

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 12:12:38 EDT

sbkansas posted : I beleive you are correct, i've been spending some time trying to find out what to block (Blackhole DNS). If I ping 1e100, i get 'Ping request could not find host 1e100.net', if I ping 1e1oo.net the result is 208.73.210.27 - Oversee.net, not matching your results?

I thought Blackhole DNS would work with 1e100.net, but it wasn't working so that's when I thought it was with the O's (still didn't work)

any advice?
--
"You will find that the mere resolve not to be useless, and the honest desire to help other people, will, in the quickest and delicatest ways, improve yourself" -
John Ruskin

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 11:58:15 EDT

NetFixer posted : You are correct that there is a 1e1oo.net.


Domain Name: 1E1OO.NET
Registrar: MONIKER
Registrant [1530176]:
        Xander Jeduyu info@ALGEBRALIVE.COM
        ALGEBRALIVE
        P.O. Box 523
        7480 Praesent Ave
        Praesent Ave
        BE
        1154AU
        BE

However, that is not the domain being discussed in this thread.


Registrant:
        DNS Admin
        Google Inc.
        1600 Amphitheatre Parkway
         Mountain View CA 94043
        US
        dns-admin@google.com +1.6502530000 Fax: +1.6506188571
    Domain Name: 1e100.net
        Registrar Name: Markmonitor.com
        Registrar Whois: whois.markmonitor.com
        Registrar Homepage: »www.markmonitor.com

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 10:41:47 EDT

sbkansas posted : Just a little FYI for those that don't know, that is 1e1OO.net , ( one e one oh oh dot net , not one e one hundred dot net )

Ignore this info, I have been corrected

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 09:21:43 EDT

Dude111 posted :

said by dsilvers :
Add five spaces between 127.0.0.1 and the URL.

Not needed,i have mine as 127.0.0.1 xxxxxx and it is fine... (1 space is all thats required)

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 07:14:15 EDT

AVD posted :

said by cyb3rl0g :

We started noticing this too early 10/1/09 and starting calling it "Big G, Phone Home". Around the same time, we learned that Google (Big G) was buying up enormous amounts of bandwidth on a global scale. This transmission capacity they were buying we figured was Big G building their own seperate 'Internet'. We dubbed the new capacity as 'GooglePlanet'. ...

I like to use the terms GoogleGod and TheGoogleMatrix..
--
standard disclaimers apply.

Re: persistent connection to qw-in-f113.1e100.net on boot

Fri, 12 Feb 2010 05:55:04 EDT

anon posted : We started noticing this too early 10/1/09 and starting calling it "Big G, Phone Home". Around the same time, we learned that Google (Big G) was buying up enormous amounts of bandwidth on a global scale. This transmission capacity they were buying we figured was Big G building their own seperate 'Internet'. We dubbed the new capacity as 'GooglePlanet'. We put MAC's PC's, couple of cell phones, into a controlled test environment and in every single case, each electronic device "AT BOOT" phones home to Big G. We then separated all the devices to different locations and the same result - all devices phoned home to Big G. We concluded that our suspicions that Big G Phone home was indeed establishing a new world 'Google Planet' where everything is run by, connected to, and dependent on Google. Since we're FOSS folks, and we recognize that Google runs on Linux, we didn't see this as necessarily bad. We were happy to see that an open source planet is coming into a new dawn. We did, however, sell all our Microsoft stock shortly thereafter even though WindowsXP still has 70% of the world's installed user base. If Big G is making a move to build their own internet, we suspect that soon thereafter, their internet will become THE internet. What if all 'Big G Phone Home Machines' decide they no longer want to talk to Microsoft powered devices? 1e100.net came from out of nowhere to land on the list of the top traffic domains in the country in a few months. Next it could be their OS, or anything else. I would conclude that at the least, Big G is getting to KNOW YOU, getting to know all about you.

Re: persistent connection to qw-in-f113.1e100.net on boot

Mon, 08 Feb 2010 14:34:02 EDT

Archivis posted : Thanks for the info. Stumbled upon this thread. Was curious myself when I saw these addresses, but never cared to research it.
--
'A government big enough to give you everything you want, is strong enough to take everything you have.' -Thomas Jefferson -

Re: persistent connection to qw-in-f113.1e100.net on boot

Mon, 08 Feb 2010 02:28:13 EDT

Martinus posted : This thread shows up as a link in an article at The Register .

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 19 Nov 2009 16:49:00 EDT

jester121 posted : Ran into this today, and traced the PID to GoogleToolbarNotifyer.exe.

For some unknown reason, it was using a full T1's worth of bandwidth for the entire day, connecting to ".1e100.net".

It's back to normal so far, I'll do some more monitoring in MRTG and see what happens tomorrow.

Re: persistent connection to qw-in-f113.1e100.net on boot

Sat, 24 Oct 2009 16:25:15 EDT

anon posted : 1E100 is exponent notation for one googol. Hope that helps explain the url.

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 21:59:55 EDT

NetFixer posted :

said by dsilvers:

@netfixer

You are right. I had not noticed that before. Any ideas on how to catch it short of a firewall. I am out of aces.

I already suggested Process Explorer. It sees all and tells all.

[att=1]

If you walk the process trees, you can find out about all active processes including any network sessions.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 21:58:14 EDT

anon posted : its google notifier most likely

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 21:50:58 EDT

dsilvers posted :
@netfixer

You are right. I had not noticed that before. Any ideas on how to catch it short of a firewall. I am out of aces.

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 21:22:26 EDT

NetFixer posted :

said by dsilvers:

OK, I just started the latest version 2.54, right clicked on a closed wait and it gave me the path and command line. I am unsure what is happening but your experience is not the usual behavior.

That depends on from what process you are attempting to obtain the properties.

A normal application will show its properties, but TCPView will not show the properties for a System process:

[att=1]

[att=2]
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 20:12:35 EDT

dsilvers posted : Netfixer is correct.

OK, I just started the latest version 2.54, right clicked on a closed wait and it gave me the path and command line. I am unsure what is happening but your experience is not the usual behavior.

I am living in the dark ages, still running XP. If it's Vista it may need administrator rights. I don't have access to a Vista box right now. I do know that on the Vista box process explorer needs administrative rights to reveal any meaningful information. Try run as administrator, not from a shortcut, right click the actual file > run as. UAC drives me up the wall.

Currports at: »www.nirsoft.net/utils/cports.html is often recommended but I have never used it.

You stated, "Also - no third party firewall??? What is the indication for that??" Normally when something calls home the first indication is a firewall alert. Rereading your post I see you stumbled into it with a netstat. My bad. Installing a third party firewall would catch it but they frequently don't clean uninstall.

If it's Vista try run as administrator and see if that works. I don't think this is malacious but it is a good mystery.

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 19:46:36 EDT

NetFixer posted : If Google Earth is truly the only Google app that is running on your PC, then Google Earth is a likely source of the connection to qw-in-f113.1e100.net.

That connection is certainly to a Google server as verified by nslookup, whois and by simply putting http://qw-in-f113.1e100.net into a browser address bar.

[att=1]

Since you have already used TCPView, you might also want to try Process Explorer to be absolutely sure that there are no other Google processes running on your PC.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants.
-- Thomas Jefferson

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 17:13:51 EDT

gogregor6 posted : First of all - thank you for a very complete reply! And all the help. I've run both the GUI and command line of tcpview, and from several locations. I've watched the connection go from WAIT to ESTABLISHED, then dissappear, then return later. When I right click on the connection in tcpview I always get an error that states it cannot query PROC ID 0. The only Google app I have installed (that I'm aware of) is Google Earth, and that was installed about 3 years ago - this is a relatively new issue. I have some technical background - and this one has me stumped right now. Also - no third party firewall??? What is the indication for that??

thanks again!
greg

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 16:53:51 EDT

dsilvers posted : Tcpvcon.exe is the command line version of the utiility. It looks like you running it from my documents. Tcpview does connect to the internet and is not a problem. Try running the GUI version which is TCPview.exe. Consider running it from somewhere on your root drive, perhaps C:\program files\sysinternals. You can run it from anywhere so if you are comfortable running an execute from my documents by all means do so.

Anything that appears as time wait has been closed but because it takes time to properly close the connection Tcpview indicates it is handed off to system 0. That is not exactly correct but as long as you understand the connection is closed and waiting to finish you should still be able to right click the connection > properties > and get the path to the executable if you do it before it completely closes out. Sometimes there will be more than one time wait and it will be a WAG to determine the correct one. Click on view > update speed > 5 seconds. This gives you five seconds to find the correct closed wait. The default is one second.

If your connection happens really early in the boot sequence it may not be possible to capture the path because it may already be completely closed out. If that is happening you might try putting Tcpview in your start up folder so it comes up with your boot.

You appear to be using a third party firewall. Are there any logs that might help explain what is using this connection? Some firewalls allow you to establish different levels of logging. Is that an option for you? What is the exact name of the google service you have installed? Have you tried setting the service to disable, not manual but disable? Are there any other google applications installed?

There is no boot logging associated with Tcpview so that is not an option. Process monitor does do boot logging but you really need to set a filter or you will be faced with pages and pages of logs that do not apply to this connection.

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 11:58:30 EDT

gogregor6 posted : I cannot querry this processs (PID 0 ) using tcpview, tcpvcon returns the following:

C:\Documents and Settings\Owner\My Documents\Install>tcpvcon

TCPView v2.54 - TCP/UDP endpoint viewer
Copyright (C) 1998-2009 Mark Russinovich
Sysinternals - www.sysinternals.com

[TCP] [System Process]
PID: 0
State: TIME_WAIT
Local: faith.cable.rcn.com:1032
Remote: qw-in-f139.1e100.net:http

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 11:19:18 EDT

dsilvers posted : Google analitics is everywhere. Even dslr uses it. You can safely add these to your host file and your connection will appear as local host.

127.0.0.1 google-analytics.com
127.0.0.1 ssl.google-analytics.com
127.0.0.1 googlesyndication.com
127.0.0.1 sb.google.com
127.0.0.1 pagead2.googlesyndication.com
127.0.0.1 pagead.googlesyndication.com
127.0.0.1 www.google-analytics.com/urchin.js
127.0.0.1 eh-in-f191.google.com
127.0.0.1 www.google-analytics.com
127.0.0.1 sb.google.com

Add five spaces between 127.0.0.1 and the URL. I could not get it to display correctly. There are probably others that can be added. If you are running any google applications (google toolbar, gmail, ect.) they may be taking you there at start up. Google analitics is largely harmless but the crap that tracks you today is unbelievable.

Another solution is Firefox with No Script and Add Block Plus. Highly recommended. Google analytics is a privacy issue and not a malware issue.

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 07:36:25 EDT

gogregor6 posted : Redwolf, I have an older desktop that was running very slow. Did the usual check for spyware, etc. and found nothing. Just a guess - did a netstat -a to check connections right after boot and the google addr showed up. I'm mostly just a blind chicken who finds some corn once in a while! Thanks!

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 04:54:59 EDT

redwolfe_98 posted : i think that there might be something fishy going on..

when i look up the ip address for "www.gmer.net", at "samspade", samspade shows the ip address as being "74.125.53.121", which is "google", and, further, "samspade" shows ip address 74.125.53.121 as being "pw-in-f121.1e100.net"..

if i look up the ip address for "www.gmer.net" at "hpHosts", here is what it shows:

Host: www.gmer.net ( H )
Current IP*: 74.125.77.121 ( 24 H )
IP PTR: ew-in-f121.1e100.net
ASN: 15169 74.125.76.0/23 GOOGLE - Google Inc.

when i actually go to "www.gmer.net", using my computer, the ip address that i get is "85.128.230.45".. so why does "samspade" and "hpHosts" show a different ip address for "www.gmer.net", both relating to "1e100.net", which gogregor6 mentioned in the original post?

gogregor6, how did you manage to notice that your computer was "phoning home" to "qw-in-f113.1e100.net"?

Re: persistent connection to qw-in-f113.1e100.net on boot

Thu, 22 Oct 2009 00:31:14 EDT

nonymous posted : Yes it is Google something.

Re: persistent connection to qw-in-f113.1e100.net on boot

Wed, 21 Oct 2009 20:10:30 EDT

dsilvers posted : Run TCP view to see what process (PID) has that connection open. If it is svchost.exe use process explorer, right click on the PID > Properties > TCP/IP will tell you where it's connecting and the service tab will tell you everything that svchost is running. It's probably harmless but does seem odd.

»technet.microsoft.com/en-us/sysi···027.aspx

Looks like it might pertain to google-anatalitic.com

»www.robtex.com/dns/www.google-an···com.html

persistent connection to qw-in-f113.1e100.net on boot

Wed, 21 Oct 2009 17:03:57 EDT

gogregor6 posted : I've recently noticed a TCP (port 1030-1033) connection (netstat -a) to the addr qw-in-f113.1e100.net (74.125.93.113) right after boot and before starting any applications. ARIN reports this is a google addr, and google reports this is a mail server. I've run SpyBot and AVG anti-vir apps and found nothing. I see a google update service when checking installed services, but it is not started? Any ideas?

thanx!
greg