Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Host Process for Windows Services

  1. #1
    Join Date
    Jun 2007
    Posts
    49

    Default Host Process for Windows Services

    I've been using ZASS 8.0.059 for about a month, first in learning mode. Now I'm getting lots of Security Alerts -- "SERVER PROGRAM | Host Process for Windows Services is trying to act as a server". The application is svchost.exe. Every time I deny it it tries to come in on another port. Then after a while I get the same type of alert except it's "Host Process for Windows Services wants to accept connections from the Internet."

    What should I do? What is SVCHOST.EXE? Thanks much for any help.

    Operating System:Windows Vista Home Premium
    Software Version:8.0
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    zaswing Guest

    Default Re: Host Process for Windows Services

    Generic Host Process for Windows Services - click on it and see svchost.exe at the bottom.
    What do the alerts say really? You haven't quoted enough to see if there's a problem.

    You need to give svchost 3 checks from the left. Just don't permit internet server and mail.

    "Host Process..." - are you sure it's not "Generic Host process...."

  3. #3
    ccarter Guest

    Default Re: Host Process for Windows Services

    I am seeing a similar Zone Alarm security alert and I can't seem to get it to stop no matter what I do.

    Generic Host Process for Win32 Services is trying to act as a server.
    identification: None
    application:svchost.exe
    source IP: 0.0.0.0:Port 135

    I've tried to allow and remember setting, and deny remember setting but the alert continues to come up every minute or so.

    This start occuring after I installed the latest iTunes 8.02.

    I've shutdown iTunes but the security alert continues to pop up.

    Any help would be appreciated.

  4. #4
    mdbilski Guest

    Default Re: Host Process for Windows Services

    I just downloaded MS Updates a few moments ago and now Access Alerts for iexplorer are continually popping up.
    Error reporting windows are also popping up and kicking off line.
    I purposely changed the MS Update to manual in Windows Firewall.
    My machine has XP Pro at least SP2

  5. #5
    zaswing Guest

    Default Re: Host Process for Windows Services

    All it needs is proper configuration -
    Have you tried the SEARCH button for "0.0.0.0 port 135" here by any chance?
    If not read this among many others that Search reveals
    http://forums.zonealarm.com/zonelabs...ssage.id=53032
    and/or
    http://forums.zonealarm.com/zonelabs...ssage.id=52914

  6. #6
    Join Date
    Jun 2007
    Posts
    49

    Default Re: Host Process for Windows Services

    Hi thanks -- no, it's just "Host Process for Windows Services is trying to act as a server" (not Generic). Here's the alert:

    ZoneAlarm Security Alert
    SERVER PROGRAM
    Host Process for Windows Services is trying to act as a server.
    Identification: None
    Application: svchost.exe
    Source IP: nnn.nnn.n.101 Port 68 (or whatever)

    OK, I just realized that the IP address is the address of my wireless router. Oh brother, I forgot about that, and the new ZASS version must have re-initialized my saved settings. Knowing that it's my own router, am I ok in letting it in? I seem to get the alert several times when the computer wakes up from a sleep, or after a reboot. It's funny, because when I Deny, everything seems to be ok, but...

  7. #7
    zaswing Guest

    Default Re: Host Process for Windows Services

    Hmmm, so ZA drops "Generic" in version 8?
    Let's hope the path is ok, is it c:\windows\system32\svchost.exe?

    Source IP: nnn.nnn.n.101 Port 68 (or whatever)

    something like 192.168.1.101 port 68 to router's port 67?
    SVCHOST runs DHCP service which gives you your IP address.
    Block it, you won't have IP and no internet, but not always, Windows may restore the connection anyway.

    So, you have to permit it in the trusted zone and you have to permit svchost to ask the router for IP address.
    Do this:
    Start > Run > type cmd
    type ipconfig /all
    you'll see your IP x.x.x.101
    you'll see DHCP server which is your router, likely 192.168.1.1
    you might see the same address for DNS servers, if not you'll see your ISP's servers.
    Enter 192.168.1.1 into the zones tab as trusted that's your router
    Enter both DNS servers into the zones tab as trusted
    Add localhost 127.0.0.1 as trusted.
    On the programs, give svchost.exe 3 checks from the left - no internet server.

    Once you do all this, you can go away from the internet or do standby with no issues.

    Regarding the alert you mentioned in the first post about svchost wants to accept connection from the internet - yup. Every couple minutes or seconds everybody connected asks every other box who is who. Who has 192.168.1.101 asks the router. Who has 192.168.1.1 asks your computer. They have nothing better to do but keep checking the connections and block the packets from the other side of the router's firewall.

    Edit: If you want to see a nice description of all this, see this thread
    http://forums.zonealarm.com/zonelabs...ssage.id=19724

    Message Edited by zasuiteuser on 12-10-2008 10:06 PM

  8. #8
    Join Date
    Dec 2005
    Posts
    8,984

    Default Re: Host Process for Windows Services



    To echo that....

    </br>Click this image!



    </br>


    Best regards.
    Oldsod.

    Message Edited by Oldsod on 12-11-2008 12:19 AM
    Best regards.
    oldsod

  9. #9
    Join Date
    Dec 2005
    Posts
    8,984

    Default Re: Host Process for Windows Services

    <blockquote><hr>mdbilski wrote: I just downloaded MS Updates a few moments ago and now Access Alerts for iexplorer are continually popping up.
    Error reporting windows are also popping up and kicking off line.I purposely changed the MS Update to manual in Windows Firewall.My machine has XP Pro at least SP2<hr></blockquote>

    Not really related to this thread and it would be better to start your own thread for your own special advice, but...

    Was the Program Control slider at Medium or autolearn or at the High level?
    You may want to set the slider to the middle level before doing the window updates.
    Other than that, it could be be something wrong with your windows - especailly about the error reporting occuring (something is wrong somewhere with windows or the software).
    Checked the event viewer or the window logs to try to find out what was wrong?

    Oldsod.
    Best regards.
    oldsod

  10. #10
    Join Date
    Jun 2007
    Posts
    49

    Default Re: Host Process for Windows Services

    Thanks--yes, it was 192.168.1...at some port. I typed IPCONFIG /ALL I did see that same IP address. And yes, the path is c:\windows\system32\svchost.exe.

    Just to experiment, I decided to not yet allow SVCHOST.EXE. Later I started getting perhaps a dozen of the same alerts, this time with 0.0.0.0, port 123 alternating with port 68 six times. I did some research here and it seems many people get the alerts at 0.0.0.0.

    Still not yet allowing SVCHOST.EXE I rebooted. Then I got maybe ten more alerts on 0.0.0.0 at various ports -- 64812, 53143, 57114, etc.

    I decided to allow SVCHOST.EXE and I see ZASS did create a row for me with the first three columns checked. I assume I did the right thing (cross my fingers...)

    The weird thing is that now when I enter IPCONFIG /ALL from a command prompt the command prompt window doesn't stay open. It flashes and then immediately closes. Any thoughts about what that could be?

    Thanks for all the help.





    <blockquote><hr>zasuiteuser wrote:
    Hmmm, so ZA drops &quot;Generic&quot; in version 8?
    Let's hope the path is ok, is it c:\windows\system32\svchost.exe?

    Source IP: nnn.nnn.n.101 Port 68 (or whatever)

    something like 192.168.1.101 port 68 to router's port 67?
    SVCHOST runs DHCP service which gives you your IP address.
    Block it, you won't have IP and no internet, but not always, Windows may restore the connection anyway.

    So, you have to permit it in the trusted zone and you have to permit svchost to ask the router for IP address.
    Do this:
    Start &gt; Run &gt; type cmd
    type ipconfig /all
    you'll see your IP x.x.x.101
    you'll see DHCP server which is your router, likely 192.168.1.1
    you might see the same address for DNS servers, if not you'll see your ISP's servers.
    Enter 192.168.1.1 into the zones tab as trusted that's your router
    Enter both DNS servers into the zones tab as trusted
    Add localhost 127.0.0.1 as trusted.
    On the programs, give svchost.exe 3 checks from the left - no internet server.

    Once you do all this, you can go away from the internet or do standby with no issues.

    Regarding the alert you mentioned in the first post about svchost wants to accept connection from the internet - yup. Every couple minutes or seconds everybody connected asks every other box who is who. Who has 192.168.1.101 asks the router. Who has 192.168.1.1 asks your computer. They have nothing better to do but keep checking the connections and block the packets from the other side of the router's firewall.

    Edit: If you want to see a nice description of all this, see this thread
    http://forums.zonealarm.com/zonelabs...ssage.id=19724

    Message Edited by zasuiteuser on 12-10-2008 10:06 PM
    <hr></blockquote>

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •