?
Solved

"Internet Information Services" alerts from ZoneAlarm Pro

Posted on 2005-05-12
22
Medium Priority
?
1,742 Views
Last Modified: 2013-12-04
I am trying to find out more about the "Internet Information Services" alerts I get from ZoneAlarm Pro (Win XP SP2) ... what do I need to know to safely respond to the following prompts without crippling something I might need?:

1) "Internet Informations Services is trying to access the Internet"
2) "Internet Informations Services is trying to act as a server"
3) "Internet Informations Services is trying to accept connections from the Trusted Zone"

If it is relevant, I am running a home network with a laptop and a desktop sharing (via a router) an Internet connection, printer and some shared folders between the 2 PC's (both running Win XP SP2).

Thanks for anyone's help!

Jeff
0
Comment
Question by:jeffreywsmith
  • 10
  • 8
  • 4
22 Comments
 
LVL 32

Expert Comment

by:r-k
ID: 13993562
Certainly strange. Are you running any kind of server on your machine that you know of?

Also, which machine is showing this message, the laptop or the desktop?

Can you open a command window (Start -> Run -> cmd) and type:

> tasklist /svc > list.txt

This saves a list of running tasks in a file named list.txt. Open list.txt with Notepad or other editor and cut and paste the contents here.

Thanks.
0
 
LVL 33

Accepted Solution

by:
humeniuk earned 1000 total points
ID: 13995896
IIS is the Windows web server.  If you are not trying to run a web server, you can uninstall IIS by going to Add/Remove Programs -> Add/Remove Windows Components.  If you are trying to run a web server, you need to allow 2 & 3 in order to have the web server be accessible on your home network.  If you want your web server to be available on the internet as well, you have to allow 1 as well.
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 13996821
Hi all and thanks for your suggestions.  

r-k:
- I am not knowingly running any web server on my PC's (that's not to say that I might not have selected that option somewhere along the line with the idea that I might need it someday, but haven't so far and probably won't).
- The messages are on my Desktop
- I tried running  tasklist /svc > list.txt  and it opens the Command window, but it disappears so fast that I can't see what it says but I did make out the word "invalid" in the message before the window closed. After it finished, I searched my hard drives for list.txt but the file was not found.  Not sure what is up with that ...

humeniuk:
- I am not sure what your 1, 2 & 3 refer to ... but uninstalling IIS may be the thing to do here ... especially if I am running any security risks by having it installed ... Are there any security concerns associated with IIS?  
- Any other apps I might have that might depend upon IIS being installed?  The only possibly-related technology I can think of that I might have a use for is SharePoint, but I expect that is a horse of a different color ...

Jeff
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LVL 33

Expert Comment

by:humeniuk
ID: 13997661
1, 2, & 3 refer to your questions above :)

Specifically:
1) "Internet Informations Services is trying to access the Internet"
2) "Internet Informations Services is trying to act as a server"
3) "Internet Informations Services is trying to accept connections from the Trusted Zone"

#1 & #2 together mean your computer has an open port and is listening for incoming traffic on that port, so it relevant to your security.  However, if you have a router with a firewall on your network, you have a certain level of protection.
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 13997954
I am using a Router and ZoneAlarm Pro for my firewall.  That said, are there any security concerns associated with IIS I should be worried about?  And perhaps, more importantly, are there any other apps I might have that might depend upon IIS being installed? (If the latter answer is no, then Uninstalling it may be the best solution for me in my current configuration).

Jeff
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 13998073
It's hard to say what other applications might depend on it without knowing what other applications you have installed.  There certainly aren't many that would be IIS-dependent.  You mentioned Sharepoint, though, which is one that might.  I'm not a Sharepoint expert, but if you're using your computer as as Sharepoint server, it is likely dependent on IIS.  If you're computer is just a Sharepoint client, it's not an issue.

Also, what router are you using?  Most include some sort of firewall protection.
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 13998855
The router is a LinkSys Fast Ethernet Cable/DSL that also serves as a firewall.  I am not presently hosting any Sharepoint portals (just have used SP as a client so far).

Beginning to look like uninstalling is the way to go here ... until such a time as I might need to activate it for something I need it for ...

I'll leave this open a little bit longer to see if anyone else has any insights ... otherwise, I'll come back and close this out.

Thanks!

Jeff
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 13998896
I'm glad to hear about the router firewall - good to have the extra protection.  And I agree, it looks like uninstalling IIS is a good choice.
0
 
LVL 32

Assisted Solution

by:r-k
r-k earned 1000 total points
ID: 13999257
Jeffrey,

Here is how you can get tasklist to work:

 Start -> All Programs -> Accessories -> Command WIndow

this open a Dos style black window. Type:

 > tasklist /svc

(should show you a list on the screen). then,

 > tasklist /svc > list.txt

will save the same list to a file. Open that file file with notepad and you can cut and paste the contents here. May give us some insight into why IIS should be running.

However,  
If you installed Sharepoint Services on your desktop then that is why IIS got installed. Are you using it access your desktop from your laptop?
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 13999288
FWIW - I agree with r-k that this is worth a look before you go ahead and uninstall.
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 13999330
Ok, here is the tasklist print (BTW, It's been a while since I've accessed SharePoint Services and the only time I used it was to set up a test SP site on a Shared Host (hosted by a SP Portal company - I was just a client):

Jeff


Image Name                   PID Services                                    
========================= ====== =============================================
System Idle Process            0 N/A                                          
System                         4 N/A                                          
smss.exe                     304 N/A                                          
csrss.exe                    364 N/A                                          
winlogon.exe                 388 N/A                                          
services.exe                 432 Eventlog, PlugPlay                          
lsass.exe                    444 PolicyAgent, ProtectedStorage, SamSs        
svchost.exe                  592 DcomLaunch, TermService                      
svchost.exe                  648 RpcSs                                        
svchost.exe                  712 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
                                 ERSvc, EventSystem,                          
                                 FastUserSwitchingCompatibility, helpsvc,    
                                 Iprip, lanmanserver, lanmanworkstation,      
                                 Netman, Nla, NtmsSvc, RasMan, Schedule,      
                                 seclogon, SENS, SharedAccess,                
                                 ShellHWDetection, srservice, TapiSrv,        
                                 Themes, TrkWks, W32Time, winmgmt, wscsvc,    
                                 wuauserv                                    
svchost.exe                  792 Dnscache                                    
svchost.exe                  844 LmHosts, RemoteRegistry, SSDPSRV, WebClient  
spoolsv.exe                  892 Spooler                                      
CCSETMGR.EXE                1004 ccSetMgr                                    
cisvc.exe                   1020 cisvc                                        
inetinfo.exe                1052 IISADMIN, MSFTPSVC, SMTPSVC, W3SVC          
navapsvc.exe                1112 navapsvc                                    
NPFMntor.exe                1288 NPFMntor                                    
NPROTECT.EXE                1316 NProtectService                              
tcpsvcs.exe                 1436 SimpTcp                                      
SNDSrvc.exe                 1496 SNDSrvc                                      
snmp.exe                    1508 SNMP                                        
SPBBCSvc.exe                1528 SPBBCSvc                                    
NOPDB.EXE                   1612 Speed Disk service                          
symlcsvc.exe                1664 Symantec Core LC                            
wdfmgr.exe                  1700 UMWdf                                        
vsmon.exe                   1752 vsmon                                        
CCEVTMGR.EXE                 184 ccEvtMgr                                    
explorer.exe                 276 N/A                                          
SymTray.exe                  624 N/A                                          
SOUNDMAN.EXE                1736 N/A                                          
S3apphk.exe                 1660 N/A                                          
CCAPP.EXE                   1792 N/A                                          
ViewMgr.exe                 1980 N/A                                          
zlclient.exe                2220 N/A                                          
ForbesAlerts.exe            2324 N/A                                          
ForbesMarketsAlerts.exe     2332 N/A                                          
GoogleDesktop.exe           2340 N/A                                          
RoboTaskBarIcon.exe         2352 N/A                                          
Dripline.exe                2420 N/A                                          
FreeWheel.exe               2476 N/A                                          
HprSnap5.exe                2484 N/A                                          
GoogleDesktopIndex.exe      2932 N/A                                          
GoogleDesktopCrawl.exe      3028 N/A                                          
alg.exe                     3804 ALG                                          
Maxthon.exe                 3680 N/A                                          
cidaemon.exe                4084 N/A                                          
cidaemon.exe                 908 N/A                                          
AcroRd32.exe                2896 N/A                                          
OUTLOOK.EXE                  840 N/A                                          
YPager.exe                   348 N/A                                          
DropletClient.exe            272 N/A                                          
agentsvr.exe                2140 N/A                                          
EXCEL.EXE                    904 N/A                                          
OPScan.exe                  2232 N/A                                          
ntvdm.exe                   3876 N/A                                          
msmsgs.exe                  2736 N/A                                          
wmiprvse.exe                1996 N/A                                          
cmd.exe                     3988 N/A                                          
tasklist.exe                2156 N/A              
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 13999352
"BTW, It's been a while since I've accessed SharePoint Services and the only time I used it was to set up a test SP site on a Shared Host"

. . . which would explain why IIS got installed (as r-k suggested).  If you're not using SPS anymore, you can install that along with IIS.
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 13999705
humeniuk - I am sure you meant UNinstall SPS along with IIS ...

However, I don't see either SPS or IIS listed in Add/Remove Programs ... and like I said, it's been a while since I've come this way ... are these services installed as a component of Win XP?  (And will I need to load my Win XP CD and remove them that way?)

Also, would you think that I needed to have IIS installed to just use SPS as a client?  If not, I would prefer to leave SPS installed because I could have a use for that capability, even though I don't have any immediate plans for hosting an SPS site ... If I don't need IIS to run SPS as a client, I can only guess that I might have selected an option on SPS installation to also configure the install to support server-side capability and that is why IIS is there ... hope this was clear ...

Jeff
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 13999750
Ooops, right - uninstall.

Regarding uninstallation, see above - "you can uninstall IIS by going to Add/Remove Programs -> Add/Remove Windows Components"

If you'd like to keep SPS, you need to leave IIS there as well.  The SP site you created runs on top of IIS.

If you do keep both, the SPS/IIS server will be protected from the internet by your router firewall and ZoneAlarm, but will allow incoming network traffic if you do this:

1) "Internet Informations Services is trying to access the Internet"   Deny
2) "Internet Informations Services is trying to act as a server"     Allow
3) "Internet Informations Services is trying to accept connections from the Trusted Zone"     Allow
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 13999847
I am a little confused, humeniuk ...

I don't have a listing for "Add/Remove Windows Components" under Add/Remove Programs  ... although I seem to remember that there is a similarly-named function that appears when I load the WinXP CD ... is that what you mean?

Also, if my intentions are to use SPS only as a client (i.e., only to access an SPS site hosted on someone else's server), do I have to have IIS installed? If so, it would seem like I should have to:

1) "Internet Informations Services is trying to access the Internet"   Allow
     Because I would think SPS requires Internet Access to function (even though it is only as an SPS client not as a server)

2) "Internet Informations Services is trying to act as a server"     Deny
    Because I am not hosting an SPS site so why would IIS need to "act as a server"?

3) "Internet Informations Services is trying to accept connections from the Trusted Zone"     Allow

Jeff
0
 
LVL 32

Expert Comment

by:r-k
ID: 13999875
Yes, I agree with humeniuk. Leave IIS and SPS in there for now, just tell ZoneAlarm to allow (2) and (3) (and check the box that says "Remember this Answer"). You are fairly safe as long as you have that firewall plus keep applying the automatic updates from MS that come about once a month. (Actually, I would even vote for letting ZoneAlarm allow (1) as well...)
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 13999932
"Actually, I would even vote for letting ZoneAlarm allow (1) as well..."
No harm in that, really, since you're still protected anyway.

Remember, Add/Remove Windows Components is in the nav bar, not in the list of installed programs.
"How To Add or Remove a Windows Component in Windows XP"
http://support.microsoft.com/default.aspx?scid=kb;en-us;307894

"Because I am not hosting an SPS site so why would IIS need to "act as a server"?"
If you're going to leave them both installed, you shouldn't cripple them with Zone Alarm.
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 13999994
Not sure what you mean by the "nav bar", humeniuk and the link to the KB article is returning a ... Page is not available error ...

Jeff
0
 
LVL 32

Expert Comment

by:r-k
ID: 14000220
>Not sure what you mean by the "nav bar"...

When you go to Control Panel and open "Add/Remove Programs", you get a window that shows a list of all your installed programs that you can uninstall. Ignore that list. Instead, there is a wide vertical gray border along the left side of that window that has about four icons in it. One of those icons is labeled "Add/Remove Components". if you click on that you can add or remove additional MS items, such as IIS.

However, I think if you maybe someday plan to use Sharepoint you should probably not remove IIS (unless you are prepared to reinstall Sharepoint later if necessary).
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 14000286
I'm not sure why the Microsoft link doesn't work, but here's a screenshot for you:
www.humeniuk.com/images/addremove.jpg.  

Keep in mind that this is from Windows 2000, but that's close enough.

"However, I think if you maybe someday plan to use Sharepoint you should probably not remove IIS (unless you are prepared to reinstall Sharepoint later if necessary)."
I second that.
0
 
LVL 2

Author Comment

by:jeffreywsmith
ID: 14000312
Duh, thanks for explaining that r-k ... ;--)

I am ready to close this out with points split evenly as you have both helped advance my knowledge here ... Thanks to both of you!

Jeff
0
 
LVL 33

Expert Comment

by:humeniuk
ID: 14000372
Glad to be able to help, Jeff.  Thanks for the A.
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, a new law in my state forced us to get a top-to-bottom analysis of all of our contract client's networks. While we have documentation, it was spotty at best for some - and in any event it needed to be checked against reality. That was m…
Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
Is your data getting by on basic protection measures? In today’s climate of debilitating malware and ransomware—like WannaCry—that may not be enough. You need to establish more than basics, like a recovery plan that protects both data and endpoints.…
Is your OST file inaccessible, Need to transfer OST file from one computer to another? Want to convert OST file to PST? If the answer to any of the above question is yes, then look no further. With the help of Stellar OST to PST Converter, you can e…
Suggested Courses
Course of the Month16 days, 2 hours left to enroll

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question