To me it looks like a Syn flooding attack.  Svchost is used to run services..
Check what exactly is running under that svschost

in command prompt ---Tasklist /SVC

you can also use ProcesExp from Sysinternals to know what is hooked to that svchost and it is running from %SystemRoot%\System32
 or i it running from some temp location..
Normally if there is a virus or some threat  it will hook its DLL to svchost.exe.

Make sure you install all the features of Symantec Endpoint Protection Mainly the network threat Protection with updated IPS signatures.

You can also check this article if it helps.
https://www-secure.symantec.com/connect/articles/how-find-suspected-threats-your-computer

I created packet include Antivirus and Antispyware Protection and Network Threat Protection.
And updated all content.

As image I think all svchost.exe are running on "C:\Windows\System32\svchost.exe".

In the Network Threat Protection log of SEP have the status block inbound packets.
But firewall is deny packet from this computer again.

Thank you.
wirawat

Can you check what is running under the svchost.exe process that is sending these Syn packets

Use Processexp to check what is running under these svchost.exe

After I try to do that.
I will response to you.

Thank you.
wirawat.

Dear Vikram,

I'm not sure that's a virus.

Please look in text file.

http://www.yousendit.com/download/Y1RyZm1iTERFc0pFQlE9PQ

I will get more information from customer.

Thank you.
wirawat.

Still not sure what is running under svchost and rundll32

Run process explorer hover your mouse over each svchost.exe and check what services are running under it and also check ofr rundll32 and what dll is running under it.

http://www.megaupload.com/?d=4CTO79I2

Run "netstat -nb" and find out which file is associated with the traffic.
U can download tcpview from sysintenals to find out the program initiating the traffic.
http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

Find out the wan ip address and search  in Google. you may get some information about the program's(Virus) which may cause this kind of traffic
 

owadays threat either attach to svchost.exe to run as a service..so that users cannot identify them and it will be automatically on all the time.
Or the DLL's use the rundll32.exe to run the DLl as a EXE file Downadup used to run all its files under rundll32 to create and run the Scheduled Tasks. It also created its service under svchost so that it doesn't look suspicious.

SO if you are infected with downadup...the taskmanager will look pretty normal just you will se few svchosts running and bunch of rundll32 .

Vikram is correct, so the best thing to do is to run Loadpoint Diagnostic Tool on the PC. pls post the logs here or you can check it manually. on the logs provided, look for the .exe you are looking for then inspect the dlls loaded with that exe. Make sure you inspect the correct svchost.exe.

download the utility here: http://service1.symantec.com/SUPPORT/ent-security....

If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.

tasklist /SVC

I havebeen through the logs nad the snapshot submitted and it is very tough to advice you the exact proble because the svchost.exe seems tro be fine.
As well said by Paul and Vikram, u should run the Loadpoint utility and upload the log here and let the expertise analyse the log. Hope we can make some way out.

Ajit

if this running process is causing your network very slow try to enable the firewall then allow all the ports that SEP utilizing to isolate the problem. try also to use network sniffer or packet monitor to identified what application of file causing this problem.

I will try follow your advice.
But may be I response to slow because the user so busy difficult to check.

Thank you.
wirawat.

If you have sep installed then why "klnagent.exe 196   Kaspersky Lab" this process is running.

close all HP services. and check.

I'm not sure.
I think the customer installed kasperkey before install sep and forgot to uninstall.
May be the customer is comparing between sep and kasperky for purchase the product because Trend Micro will exprie.