svchost connecting to the internet

[ukboy]

for me to be able to surf the net i have to allow svchost.exe access to the internet through zone alarm, the file sits in windows/system32 folder, msn messenger works without the connection but not iexplorer v6.0, is this normal and does anyone else have to give this program access to the internet to use ie, i run windows xp

 

[Firejay]

While I don't run XP here is what MS has to say.

http://support.microsoft.com/default.aspx?scid=kb;en-us;314056

It depends upon what service is using the svchost connection. But it does sound, at least at this point, fairly innocuous.

 

[dvk01]

Yes you do have to allow it access to the internet.

svchost is the basic service that Xp uses to control most aspects of XP.

without it XP doesn't run and blocking it blocks essential inrernet services, like tcp/ip ip look up numbers and all the other internat access methods.

the problem with ZA as a firewall is it isn't sophisticated enough to allow some parts of svchost to access the internet and block others that you might not need.

You can get a much better firewall than ZA and configure it to only allow the services you want to work.

 

[ukboy]

thanks for your help

 

[ITarch]

I have seen on some message boards and @ MS wherein they discuss the application tlist.exe (in the Supporttools CAB)that details the children of each svchost.exe instance...I can't find it on the win2k cd however, and tlist from older versions doesn't work.

any thoughts?

 

[mViOkPe]

You shouldn't need to give 'server' rights to it. In a rules based FW this would be handled by rules for localhost(loopback). IOW it should not need to connect outside the sys or LAN.

BTW The same is true for other NTkernnal processes too. (with certain exceptions such as; DCOM which most folks have no use for anyway)

 

[ITarch]

I think the last poster,mViOkPe, misunderstood me. I am referring to a program supplied by MS (tlist.exe-) that allows admins to review the actuall dll processes/services grouped under each instance of svchost.exe.

we are seeing a particular machine spuriously access the internet, and we are worried about some devious "infection". we want to troubleshoot the child processes, to see what is what.

the user says at some point, he received messages about win2kpro OS files being overwritten, while accessing the internet...

thanks in advance

 

[mViOkPe]

Sorry ITarch, but I wasn't replying to you. I was peplying to the original poster. I didn't realize that this was an older thread revisited.