Firewall message - Wudfhost.exe attempting outbound traffic - to IP 67.135.105.130...

F-Secure Security suite prompted me whether I wanted to allow
Wudfhost.exe to send outbound traffic to IP 67.135.105.130 - after I
inserted my 16GB Corsair USB drive. Is this normal or is there something
viral on it? It's been a long time since I inserted a thumb/USB drive
into this Vista Ultimate system I was running AVG AV before so I've no
way of knowing if this is normal for Vista.

I'm scanning it now as this seems Viral. System begun to act strangly
mouse pointer flickering with Circle for system working/ IE searching
for about 10 minutes. [Although Vista has always had stalls and studders
so it's hard for me to tell if this is abnormal (viral/trojan
horse\malware) or not. It's stopped flickering now but the scan is
taking some time.

IP Lookup provided this information:
Qwest Communications Corporation QWEST-INET-11 (NET-67-128-0-0-1)
67.128.0.0 - 67.135.255.255AKAMAI TECHNOLOGIES INC Q1020-67-135-105-0
(NET-67-135-105-0-1) 67.135.105.0 - 67.135.105.255 # ARIN WHOIS
database, last updated 2009-05-14 19:10# Enter ? for additional hints on
searching ARIN's WHOIS database.


=(Just an FYI this is NOT my IP address). I plugged the IP address into
google and then into my browser but it gets a page not found error...idk
if this b/c it's running stealth behind a firewall or what?

=Wudfhost.exe is NOT running in task manager. It wasn't after I clicked
deny and then thought to check that fast (albeit after I already denied
it's access).
Oh, mouse is flickering again occassionally...maybe b/c of the scanning
in the background. IDK....


--
DA1745

Have you tried pasting Wudfhost.exe in google search? I just did.

That is the very first thing you should do if you have a question about a
particular file.

Can anyone tell me is it normal for Wudfhost to do this?

I've done scans of the Thumb drive and the entire system, no Viruses
etc Detected.

I had already searched for what / why Wudfhost might be making that
traffic but never found any answers or found out if that IP is to some
well known site ? or what...since it didn't answer my ping and no
website opened it doesn't look like it is.

Google WUDFHOST and you will get MORE than enough hits that will calm
your fears.

[slaingod]

Not if your 'fears' are wanting to avoid having your computer contact other computers with unknown information for no obvious reason without your knowledge.

I recently plugged in a Sony Reader and was annoyed to see this process try and make an outbound connection to a website. Mine was attempting to contact an RCN netblock address on port 80...RCN is my ISP and I can't think of any good reason this would happen simply by plugging in a device.