svchost connecting to the internet

for me to be able to surf the net i have to allow svchost.exe access to the internet through zone alarm, the file sits in windows/system32 folder, msn messenger works without the connection but not iexplorer v6.0, is this normal and does anyone else have to give this program access to the internet to use ie, i run windows xp

 

While I don't run XP here is what MS has to say.

http://support.microsoft.com/default.aspx?scid=kb;en-us;314056

It depends upon what service is using the svchost connection. But it does sound, at least at this point, fairly innocuous.

 

thanks for your help

 

I have seen on some message boards and @ MS wherein they discuss the application tlist.exe (in the Supporttools CAB)that details the children of each svchost.exe instance...I can't find it on the win2k cd however, and tlist from older versions doesn't work.

any thoughts?

 

You shouldn't need to give 'server' rights to it. In a rules based FW this would be handled by rules for localhost(loopback). IOW it should not need to connect outside the sys or LAN.

BTW The same is true for other NTkernnal processes too. (with certain exceptions such as; DCOM which most folks have no use for anyway)

 

I think the last poster,mViOkPe, misunderstood me. I am referring to a program supplied by MS (tlist.exe-) that allows admins to review the actuall dll processes/services grouped under each instance of svchost.exe.

we are seeing a particular machine spuriously access the internet, and we are worried about some devious "infection". we want to troubleshoot the child processes, to see what is what.

the user says at some point, he received messages about win2kpro OS files being overwritten, while accessing the internet...

thanks in advance

 

Sorry ITarch, but I wasn't replying to you. I was peplying to the original poster. I didn't realize that this was an older thread revisited.