question about svchost traffic

Hello to lockergnome,

Since booting up this morning, I have had ~250 attempted outbound connections from svchost.

svchost.exe port 427 to 92.242.144.50 port 427 UDP
svchost.exe port 1648 to 92.242.144.50 port 139 TCP

My understanding of svchost is that it does nothing on its own but is tasked by some service or app. My basic question is what would be attempting to make such a connection and why have I never seen it before today. Svchost sometimes does local multicast to look for my HP printer (224.0.1.60), and to UPnP(239.255.255.250), and also sometimes to DNS. Those are pretty innocuous, thought I don't always understand what their purpose is.

This is new, and since one is port 139, that is a bit more concerning. These have come regularly all day, so I'm not sure what is prompting them.

Here is my Tasklist output for svchost,

Code:

Image Name:   svchost.exe PID:          1292 Services:     DcomLaunch               TermService Image Name:   svchost.exe PID:          1360 Services:     RpcSs Image Name:   svchost.exe PID:          1540 Services:     AudioSrv               Browser               CryptSvc               Dhcp               EventSystem               LanmanServer               lanmanworkstation               Netman               Nla               Schedule               SENS               SharedAccess               ShellHWDetection               Themes               W32Time               winmgmt Image Name:   svchost.exe PID:          1936 Services:     hpqcxs08               hpqddsvc Image Name:   svchost.exe PID:          1948 Services:     HPSLPSVC Image Name:   svchost.exe PID:          2020 Services:     Net Driver HPZ12 Image Name:   svchost.exe PID:          1496 Services:     Pml Driver HPZ12 Image Name:   svchost.exe PID:          1612 Services:     stisvc Image Name:   svchost.exe PID:          1440 Services:     SSDPSRV

I am interested in some general information about what is going on under the hood here. Can anyone provide any insight as to why svchost is trying to connect the the WAN and what app or service may be prompting it. My comodo logs don't say which instance of svchost is trying to connect, unless I'm not reading them right.

I wish that winodws would require programs that want to connect to the internet to make a direct connection. It is much harder to keep track of everything with all of this sideways traffic.

This is XP sp3 in case that matters.

Thanks for any advice you can give.

LMHmedchem

Hello,

Do you have device drivers for printer by Hewlett Packard installed on the computer, by any chance?

Regards,

Aryeh Goretsky