Zone Alarm blocking access to svchost.exe

Hi,

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.

You should not allow svchost to listen for incoming connection requests. You really don't know who or what is trying to connect.  unless you know what is coming in, I'd block it.
All the programs that need internet access to function properly can initiate the contact from your computer so there is really no need to allow incoming connections to be accepted.

Mkgmkg is right, check the name properly. Is it svchost or SCVHOST?
If its scvhost, then thats a worm
http://www.kephyr.com/spywarescanner/library/scvhost.worm/index.phtml
Svchost could cause this issue if your system has been affected with the blaster worm.
So update your virus definitions and run a thorough virus scan on the system.
this link gives you some information about the worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

I tried blocking it, but that blocked all traffic, so I opened it again. It still blocks those attempts, though. The two central servers are probably the ones I go through to get online, but I still don't see why it get so many hits from the other students' computers. Could it be poor network design, or is it normal that firwalls pick up traffic from other users on the same subnet?

Here's an example: "Medium rating, 2004/08/13 14:14:32+2:00 GMT, Program Access, svchost.exe, 129.240.***.***:3005 , Incoming (accept), Blocked, 1 count, bjs2-dhcp***.studby.***.no

It's not scvhost.exe. I doubt it is a virus.

I am using zonealarm and have confirmed from the programs list that
only three programs are configured to listen on Internet side ie MSn , Yahoo and generic host process.exe. Rest all programs including Svchost.exe are blocked from listening to Internet side and this configuration is working finr for me.

Hence , i will suggest you that you can try re-installing the zonealarm once again and not allow svchost.exe to laccept conccetion from internet.

This should solve the problem.

But svchost.exe IS the generic host process executable.. I contacted the network admins, and although I couldn't get any clear and consise answers, one of them was thinking it might be machines infected with the DCOM/RPC exploit probing other machines on the network, and I think he might be right. One of them even stated he didn't have much knowledge of windows systems. I think this must be a podunk university when it comes to computer science. =D

Thanks for the reply, though.