1

I'm having a problem where I have a local server machine that shouldn't have anything to do with our local web server, but yet the web server's Symantec Endpoint protection is showing the local server (IP) is constantly hitting the web server and being blocked. The application is showing as svchost.exe. Getting a new log entry ever few seconds.

DemiSheep
  • 151
  • 1
  • 1
  • 6
  • 1
    Why don't you investigate it to find out? Run "netstat -ano" from an elevated command prompt on the server in question and see which process is attempting to connect to the web server. – joeqwerty Apr 11 '18 at 14:29
  • 1
    @joeqwerty Thats exactly the kind of thing I was trying to figure out - how to investigate, thanks! – DemiSheep Apr 11 '18 at 18:05

0 Answers0