Results 1 to 5 of 5

Thread: svchost.exe Program Access.

  1. #1
    stormsy Guest

    Question svchost.exe Program Access.

    Hi there,

    I got myself a new PC (since the old one was beginning to fail on me) and so naturally it came with Windows 7 Home Premium 32-bit.

    Installation of ZA Internet Secuirty Suite went like a breeze (the best I've had since using ZA) and I accepted ALL the default settings for ZA (such as; Auto-learn from Progam Control etc).

    However in the Logs for "Program" I have entries for svchost.exe (i.e.; Host Process for Windows Services) being blocked from accepting an incoming connection from the Internet on Port 1900. Does anyone understand what this is? I am behind a router if that info helps?

    I've looked in the Program Control for what "ticks" were assigned to "Host Process for Windows Services" and the following were given green ticks; ACCESS (trusted & internet) and SERVER (trusted). SERVER (internet) was given a red cross.

    Is it because I am still on aout-learn for Program Control that it's flagging this up? Would the log entries for this stop when ZA finishes aout-learning?

    Greatly appreaciate any thought on this, when using XP I never encountered this before.
    Thanks,
    Stormsy.

  2. #2
    stormsy Guest

    Default Re: svchost.exe Program Access.

    Okay - sorry for the double posting, but I think I may know where I have gone wrong

    When ZA detected ny network, I did not set the zone setting as "Trusted" (which I did when using XP) - and so I classed the zone as "Internet". As a result, under the Firewall Configuration, I use to have three entries on XP; My network, the loopback and the DHCP (listed all as trusted). Now, I just have the network and the loopback listed, and no DHCP listed. That could explain everything, since the requestes being logged are coming from the IP address of the DHCP (which isn't listed).

    I think it might be a re-install of ZA tomorrow!
    I'll let you know what happens.
    Sorry again for the double-posting! *heh*
    Stormsy.

  3. #3
    zaswing Guest

    Default Re: svchost.exe Program Access.

    Stormsy,
    Even though it's 5 weeks later, in case you still need it,
    Your svchost permissions are ok, but you can help things by this:
    As a user with administrator rights, you can turn off two Windows XP services since they are not needed for most people.
    First disable the UpNP service, Universal Plug and Play Device Host (no, it has nothing to do with your USB flash)
    Second, disable the SSDP Discovery service.
    The sequence is important because SSDP has UpNp dependency.
    This should quiet down ports 1900 and 5000 issues.

    See this list of Windows services, many of which can be shut off
    http://www.blackviper.com/wiki/Main_Page
    Look for "Black Viper's Configuration Examples and Recommendations" section.

  4. #4
    Join Date
    Nov 2004
    Location
    localhost
    Posts
    17,288

    Default Re: svchost.exe Program Access.

    A word of caution. The OP is using windows 7 and not XP.
    May be its time for the OP also to update to version 10 of ZA. The setting in 10 will be different than what was reported... so don't panic its by design.

    Finally UpNP may be a needed service especially if the user is using instant messaging or hardware attached that make use of this function. The security benefit of disabling UpNP may not be proportional to the potential connection issue he/she may experience.

    Thank you anyway for your valuable input in this forum.

    Cheers,
    Fax

    Click here for ZA Support
    Monday-Saturday 6am to 10pm Central time
    Closed Sundays and Holidays

  5. #5
    zaswing Guest

    Default Re: svchost.exe Program Access.

    Yes, Fax, and thank you.
    I assumed instant messaging not used, and no special gear that requires it. Some routers even send UpnP/SSPD stuff. No idea if needed or not.
    So long as ZA alerts or logs, a user who needs it and it doesn't work can check that ZA is blocking, and act accordingly.
    I wonder if it would be clear from the alerts or logs to know which device talks on those ports.

    Reading inability: I missed Win7 in the first sentence, the last sentence mentioned XP
    The link to blackviper that I mentioned includes sections for every version of Windows.

    Re: "The security benefit of disabling UpNP may not be proportional to the potential connection issue he/she may experience."
    Yeah, I always wondered about this and various other. Many warnings are based on old information and it's hard to tell how to nitpick through all
    Last edited by zaswing; June 15th, 2011 at 01:46 PM.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. explorer.exe, svchost.exe, iexplore.exe, winlogon.exe in ZA folder
    By mikem2 in forum Web Security/Security Toolbar/Do Not Track
    Replies: 3
    Last Post: May 18th, 2010, 11:55 AM
  2. Generic Host Process (svchost.exe) and UpdClient.exe
    By myschrec in forum Security Issues
    Replies: 5
    Last Post: March 17th, 2009, 07:55 AM
  3. Replies: 0
    Last Post: October 23rd, 2007, 08:00 AM
  4. Replies: 1
    Last Post: October 24th, 2006, 03:23 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •