svchost (Network Service) connecting to Akamai address

Topic

New Reply

Hello. I caught svchost.exe (Network Service) on briefly connecting to a104-81-60-35.deploy.static.akamaitechnologies.com whenever onscreen keyboard is opened for first time after boot (actually two connections, the first one has “30” instead of 35 in address). What’s going on? The pc was fully scanned on boot with AV in maxed settings, no results. sfc /scannow didn’t find integrity violations either.

Reply | Quote

Replies

Those could probably be telemetry connections, Microsoft uses Akamai for certain services.

1 user thanked author for this post.

Microfix

Reply | Quote

I don’t think this is anything to be concerned about, your system is working as it should.

What OS are you on?

You could try spybot anti-beacon to avoid telemetry (but not all)

Edit: Have you disabled the “Diagnostic Tracking Service”.
This service is ON by default.

Open an elevated command prompt (right click shortcut and run as administrator) and run the following command:

sc stop Diagtrack

 

Windows - commercial by definition and now function...

Reply | Quote

Thank you. I’m on Win7 Ultimate x64. I have opted out of CEIP in Control panel years ago and logs confirm that most of its components still don’t do anything. But I’ll look into disabling Diagtrack as well, if it won’t break anything. So there’s no need to fear about keystrokes being logged and transmitted away?

Reply | Quote

Not at all, it won’t break anything in W7 or W8.1

What I did notice from your OP was that you have run sfc /scannow. The ‘Diagnostic Tracking Service’ is re-enabled by default after running the sfc command/ switch. It needs to be turned off manually if you wish to avoid further telemetry.

Windows - commercial by definition and now function...

2 users thanked author for this post.

Elly, HiFlyer

Reply | Quote

@Microfix –

The name of the server makes me think that it might be used to pump interest-based display ads to the user, due to the “deploy.static” part of its name. After all, MS isn’t the only user of Akamai’s services/bandwidth. I’ve seen many an ad come from their servers over the years.

Whaddya think??

Reply | Quote

Can it be a different domain on the same ip? Some time ago I’ve seen Paint.NET updater connecting to syzygyevents.com, but after looking it up I noticed that it indeed shares the host with PDN. Resource monitor could’ve just displayed the domain different from the one Paint.NET actually requested.

Reply | Quote

(About PDN, seems that it’s different addresses now, apologies)

Reply | Quote

@Bob99 That sounds totally logical which unfortunately may be true to an extent.

Secure advertising..ha!

Windows - commercial by definition and now function...

Reply | Quote

Microfix wrote:

Not at all, it won’t break anything in W7 or W8.1 What I did notice from your OP was that you have run sfc /scannow. The ‘Diagnostic Tracking Service’ is re-enabled by default after running the sfc command/ switch. It needs to be turned off manually if you wish to avoid further telemetry.

@microfix

Thanks for the info on Diagtrack  automatically starting after sfc /scannow.  Are there more of these “gotchas” you might share?

HF

Reply | Quote

@HiFlyer, Not that I can recall but, it’s just one of those querky things to remember once hit.

Happened to me a couple of months ago and credit goes to @abbodi86 who highlighted it.

un-intentional by MS, of course..

For W7 & 8.1 why not have a look at AKB Section some have been updated by contributors.

Windows - commercial by definition and now function...

1 user thanked author for this post.

HiFlyer

Reply | Quote

Microfix wrote:

Not at all, it won’t break anything in W7 or W8.1

… The ‘Diagnostic Tracking Service’ is re-enabled by default after running the sfc command/ switch. It needs to be turned off manually …

Hello Microfix, I want to fine tune my understanding, and ask if I have it correct. When executing even the lower level /verifyonly, the Diagnostic Tracking Service is the tool that performs the check. This function is also the preliminary task in the higher level /scannow, which will attempt repair of any faults found in that check. And that the service lacks any timeout function, so it remains active until manually stopped. Also it will be persistent through the next boot cycle.

Am I assuming too much from my observations?

Reply | Quote