|
| |
Strange seceurity warning from firewall - should I be worried?
View related threads:
(in this forum
| in all forums)
|
Logged in as: Guest
|
|
|
womble
Posts: 5461
Joined: 3/14/2005
From: Living on the edge
Status: offline
 |
Strange seceurity warning from firewall - should I be w... - 1/23/2007 17:04:03
I'm getting some strange error messages from my newly installed firewall, ZoneAlarm (BidDefender got ditched for hogging system resources and generally slowing things down). It's only been installed about a week so it's still asking me constantly what's allowed to access the internet etc., but it's generally very well behaved.
I keep getting Security Alert messages (about 20 this evening) from it though that read:
quote:
The firewall has blocked Internet access to your computer (ICMP Unreachable) from xxx.xxx.x.x
Program: Generic Host Process for Win32 Services
(xxx.xxx.x.x is the IP address of my router)
This is what the ZoneAlarm site has to say about it when I click the "more info" button.
Anyone any ideas what this means in plain English and is it something I should be worried about?
I've scanned with AVG Anti-Spyware, Spybot S&D, NoAdware and done an In-Depth scan with NOD32, and they're all coming back clear.
The router btw is a Netgear, and I've got the wireless network set up with WEP-PSK.
Any ideas?
_____________________________
~~ "A cruel god ain't no god at all" ~~
|
|
|
|
ou812
Posts: 1538
Joined: 1/5/2002
From: San Diego
Status: offline
|
RE: Strange seceurity warning from firewall - should I ... - 1/23/2007 19:38:33
I believe if you go into ZA you should find that "Generic Host Process for Win32 Services" points to a program called svchost.exe This is used by other programs on your system, and if it can't access the Internet then they won't be able either.
An older article here, but I believe it still pertains: http://www.pcworld.com/article/id,103781-page,1/article.html?tk=wb110402x
Oh, and I let svchost.exe have access too.
_____________________________
-brian
EnterpriseDB: Enterprise-class relational database management system
PostgreSQL: The world's most advanced open source database
| |
|
|
|
ou812
Posts: 1538
Joined: 1/5/2002
From: San Diego
Status: offline
|
RE: Strange seceurity warning from firewall - should I ... - 1/24/2007 0:25:40
Good point, bobby. I didn't notice it said inbound from the router to the computer. If so, then yes I would at the very least make it ask me for permission!
_____________________________
-brian
EnterpriseDB: Enterprise-class relational database management system
PostgreSQL: The world's most advanced open source database
| |
|
|
|
BobbyDouglas
Posts: 5432
Joined: 5/15/2003
From: Arizona
Status: offline
|
RE: Strange seceurity warning from firewall - should I ... - 1/24/2007 2:57:11
ZA does this kind of stuff all the time. You can pretty much ignore the popups.
_____________________________
Arizona Web Design - Mr Bobs Web Design in Arizona
The Arizona Web Hosting Challenge
| |
|
|
|
BobbyDouglas
Posts: 5432
Joined: 5/15/2003
From: Arizona
Status: offline
|
RE: Strange seceurity warning from firewall - should I ... - 1/24/2007 13:52:06
I thought svchost.exe was required for startup...
_____________________________
Arizona Web Design - Mr Bobs Web Design in Arizona
The Arizona Web Hosting Challenge
| |
|
|
|
rdouglass
Posts: 9167
From: Biddeford, ME USA
Status: offline
|
RE: Strange seceurity warning from firewall - should I ... - 1/24/2007 21:01:56
quote:
svchost.exe
My $.02 on the matter paraphrasing a lot:
Svchost.exe is a 'generic' application on Win32 OS's that many .DLL's require to operate. Many systems will run more than 1 instance of svchost.exe; in fact, my PC has 4 instances running right at this moment and I'm 99.999% confident my system is 'clean' from malware and virii.
Just because svchost.exe is running doesn't mean you have a problem. The reason that you see ZA report it is that outside processes are trying to talk *to* svchost.exe. That is a common place that many malware and virii can be accessed by others to 'advertize' themselves and their capabilities. And because of that, some people think that if svchost.exe is running, you have a virus.
Not true. Frequently the case due to the nature of virii and malware but not 'prima facie' evidence to that fact.
I am by no means an expert on it but I do know that just because it's running, really is no proof that there is foul play. And as others have indicated, ZA is doing exactly what it's supposed to do.
_____________________________
Don't take you're eye off your final destination.
ASP Checkbox Function Tutorial.
| |
|
|
|
TJolly
Posts: 92
Joined: 10/12/2006
From: Cheshire, UK
Status: offline
|
RE: Strange seceurity warning from firewall - should I ... - 1/25/2007 7:00:36
Svchost.exe is part of the windows operating system and should be found in C:\WINDOWS\System32 folder.
However, it has also been identified as a backdoor vulnerability if running elsewhere on a system.
Svchost.exe
| |
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts
|
|
|
Printable Version 
In addition to my desktop, I've disabled two companion laptops in the same fashion for the wireless printserv function. The fix was sourced from the MS KB, not from Belkin, not from HP.
