• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 594
  • Last Modified:

Zone Alarm blocking access to svchost.exe

Hello,

I get my internet from my university's network and I have just noticed that Zone Alarm keeps blocking continuous attempts to access svchost.exe from other users within my part of the network, and occasionally from network admin ips.

I'm thinking it's probably some normal function of the network, but I'm not sure. Does anyone know what it is?

Thank you :)
0
NorVegan
Asked:
NorVegan
1 Solution
 
mkgmkgCommented:
Hi,

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.

You should not allow svchost to listen for incoming connection requests. You really don't know who or what is trying to connect.  unless you know what is coming in, I'd block it.
All the programs that need internet access to function properly can initiate the contact from your computer so there is really no need to allow incoming connections to be accepted.
0
 
cooljai1Commented:
Mkgmkg is right, check the name properly. Is it svchost or SCVHOST?
If its scvhost, then thats a worm
http://www.kephyr.com/spywarescanner/library/scvhost.worm/index.phtml
Svchost could cause this issue if your system has been affected with the blaster worm.
So update your virus definitions and run a thorough virus scan on the system.
this link gives you some information about the worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html
0
 
NorVeganAuthor Commented:
I tried blocking it, but that blocked all traffic, so I opened it again. It still blocks those attempts, though. The two central servers are probably the ones I go through to get online, but I still don't see why it get so many hits from the other students' computers. Could it be poor network design, or is it normal that firwalls pick up traffic from other users on the same subnet?

Here's an example: "Medium rating, 2004/08/13 14:14:32+2:00 GMT, Program Access, svchost.exe, 129.240.***.***:3005 , Incoming (accept), Blocked, 1 count, bjs2-dhcp***.studby.***.no

It's not scvhost.exe. I doubt it is a virus.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
mkgmkgCommented:
I am using zonealarm and have confirmed from the programs list that
only three programs are configured to listen on Internet side ie MSn , Yahoo and generic host process.exe. Rest all programs including Svchost.exe are blocked from listening to Internet side and this configuration is working finr for me.

Hence , i will suggest you that you can try re-installing the zonealarm once again and not allow svchost.exe to laccept conccetion from internet.

This should solve the problem.


0
 
NorVeganAuthor Commented:
But svchost.exe IS the generic host process executable.. I contacted the network admins, and although I couldn't get any clear and consise answers, one of them was thinking it might be machines infected with the DCOM/RPC exploit probing other machines on the network, and I think he might be right. One of them even stated he didn't have much knowledge of windows systems. I think this must be a podunk university when it comes to computer science. =D

Thanks for the reply, though.
0
 
moduloCommented:
PAQed with points refunded (50)

modulo
Community Support Moderator
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now