What do or don't I block?

P

pbXassassinX1524

[H]ard|Gawd
Joined
Nov 24, 2003
Messages
1,295
okay, I finally got a firewall, and I keep getting incoming things like this, last one was asking for svchost.exe and I permitted that one, and now I'm getting an incoming connection like this its happened twice now:

Someone from sx-34-19.skylands.net [216.182.34.19], port 2781 wants to connect to port 445 owned by 'SYSTEM' on your computer

(skylands is my ISP)

Are these just regular system processes at work? If they are why are they both incoming connections?

thanks!
 
Its very likely that it just happens that you allow access for svchost.exe and those two incoming connections. Just a coincidence.

It fairly common to see incoming request on a public line. I see it all the time on all my firewalls.

The question now is... if you JUST got your firewall, how long has your machine been exposed to the internet??
 
It's been online for about 2 months. Keep in mind though that it is dial-up.

I get a bunch of incoming things from different places, normally I just deny them if I don't know what they are.

As far as I know I do not have any viruses, spyware etc. I scan frequently with up to date AVG (I think it scans once a day actually) and spybot and adaware.

Also, I might add, I have been using mozilla and firefox to browse all the time, keep all windows updates recient, don't use any p2p programs(never even had any installed), don't go to any shady sites for warez. This system I try and keep as clean as possible.
 
So what do I do with all those svchost connections (both outgoing and incoming), should I just block everything on that list accept the ones that I know what they actually are, or are some necessary to windows operating?
 
What firewall did you buy? (my guess is ZoneAlarm)

It seems like it has a built in application control.

My firewall has a built in application control, but for the most part it just gets in the way. I have the application control turned off, but the firewall on its highest level so that way it automatically blocks all "bad" inbound traffic.

If your pretty sure you don't have any trojens, hacks, viruses, or spyware... then you could just turn off application controle if it keeps getting in your way (unless you WANT it).

Now, for your question... yea svchost.exe is a windows service that does "something"(im not sure what yet).

Port 2781 is used for "whosells", and port 445 is used for Microsoft-DS.... so that sounds a little fishy.
If a program you know, or a windows service tries to connect to the internet.... i would let it. But if someone wants to try and connect to your computer on some random port... someone you don't know... then i would just block it. I also don't think its your ISP doing a random probe into your computer... but rather just another person who has the same ISP.

P.s., im glad to see at least one person "TRIES" to keep their computer free of bad things. ^_^
 
okay, cool. Thats what I've been trying to do, but its kind of hard deciphering what is happening legit and what isn't. The firewall I use is Kerio 2.1.5, super simple and I really like it because its so simple. It's in umm, you-chose-what-you-want-when-it-prompts-you mode.:p

anyway, I think I'm going to leave the outgoing connections from SVC host alone, but I just don't like the incoming ones. Almost all of these are going to "system" or svchost. Which isnt really too descriptive as I'm sure you know.

thanks!
 
I would accept svchost.exe ........ its a windows service that just tells the computer information about what other services need to run (from what i know).

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can run, depending on how and where Svchost.exe is started. This allows for better control and easier debugging.
Click to expand...

Also, just so you know. svchost is run on startup by the "system". This program was not run by a user but by windows itself... so don't worry when you see "system" associated with svchost.exe ^_^
 
arg... this is so confusing to me. :( , I got rid of all the rules I had previously so I could just start on a new slate, but, now I'm getting totally different processes on here, like dhcp kernel driver (I got that twice) and then 2 more SVC hosts. I think I'm just going to uninstall and start all over again. I know it had some default rules in there some where before you even start anything.

should I allow EVERYTHING for svchost? Incoming, outgoing, the whole deal? Because sometimes I remember getting totally random incoming connections to svchost, I had like 10 boxes up the morning after the night I installed kerio.
 
From the looks of it, your not doing anything wrong.

And its very hard for me to tell you what to allow and what to block without being their first hand. It sounds like this is causing more problems then its fixing...

Perhaps you might want to consider a firewall that allows you to disable application control.... (assuming that your's can not turn off your application monitering).

Off the top of my head though i don't know of any good programs that are free... sorry ~_~
 
okay, now I'm not getting any arror just blocking all the svchost deals.... some come by default to be allowed, so probably the ones that are actually needed for XP are running fine.

I don't exactly what what application control is, but I can set it to 3 different things pretty much. Nothing gets through thats not added manually to the list, it won't prompt me. It will prompt me every time somethgin trys to access and I can set up a rule for that file, or just, everything allowed. right now I have it set to tell me whenever it sees something new.
 
wow, I got like 30 incoming requests for svchost today on all different ports.... crazy. This all happend during the time that I was at school.
 
You must log in or register to reply here.
Back
Top