svchost connecting to the internet

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

ukboy

Thread Starter
Joined
Nov 22, 2002
Messages
193
for me to be able to surf the net i have to allow svchost.exe access to the internet through zone alarm, the file sits in windows/system32 folder, msn messenger works without the connection but not iexplorer v6.0, is this normal and does anyone else have to give this program access to the internet to use ie, i run windows xp
 

dvk01

Derek
Retired Moderator Retired Malware Specialist
Joined
Dec 14, 2002
Messages
56,452
Yes you do have to allow it access to the internet.

svchost is the basic service that Xp uses to control most aspects of XP.

without it XP doesn't run and blocking it blocks essential inrernet services, like tcp/ip ip look up numbers and all the other internat access methods.

the problem with ZA as a firewall is it isn't sophisticated enough to allow some parts of svchost to access the internet and block others that you might not need.

You can get a much better firewall than ZA and configure it to only allow the services you want to work.
 
Joined
Feb 3, 2003
Messages
2
I have seen on some message boards and @ MS wherein they discuss the application tlist.exe (in the Supporttools CAB)that details the children of each svchost.exe instance...I can't find it on the win2k cd however, and tlist from older versions doesn't work.

any thoughts?
 
Joined
Oct 15, 2002
Messages
101
You shouldn't need to give 'server' rights to it. In a rules based FW this would be handled by rules for localhost(loopback). IOW it should not need to connect outside the sys or LAN.

BTW The same is true for other NTkernnal processes too. (with certain exceptions such as; DCOM which most folks have no use for anyway)
 
Joined
Feb 3, 2003
Messages
2
I think the last poster,mViOkPe, misunderstood me. I am referring to a program supplied by MS (tlist.exe-) that allows admins to review the actuall dll processes/services grouped under each instance of svchost.exe.

we are seeing a particular machine spuriously access the internet, and we are worried about some devious "infection". we want to troubleshoot the child processes, to see what is what.

the user says at some point, he received messages about win2kpro OS files being overwritten, while accessing the internet...

thanks in advance
 
Joined
Oct 15, 2002
Messages
101
Sorry ITarch, but I wasn't replying to you. I was peplying to the original poster. I didn't realize that this was an older thread revisited.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top