Author Topic: should svchost.exe be allowed internet access??  (Read 13781 times)

Offline FJR1300

  • Newbie
  • *
  • Posts: 8
should svchost.exe be allowed internet access??
« on: May 14, 2007, 11:52:40 AM »
question

Offline Andreas

  • Comodo's Hero
  • *****
  • Posts: 442
Re: should svchost.exe be allowed internet access??
« Reply #1 on: May 14, 2007, 11:59:31 AM »
question

It depends on your activities. For example you need microsoft updates you must svchost.exe allows internet access. For others activities you need not svchost.exe allow internet access?
Windows 7 Home Premium 32 Bit, CIS Premium 5.10.228257.2253 (Antivirus Security Level: stateful, defense+: Safe Mode, Firewall Security Level: Costum Policy Mode, Sandbox Security Level: disabled), Firefox 11.0, Thunderbird 11.0.1

Offline grampa

  • Comodo's Hero
  • *****
  • Posts: 392
Re: should svchost.exe be allowed internet access??
« Reply #2 on: May 14, 2007, 12:02:43 PM »
Hey FJR1300,
"svchost handles processes executed from DLLs and should not be terminated" is what CPF says.
You should follow their advice unless you have reason to think something fishy's going on.
I have 2 rules for svchost in AM: 1 In, 1 Out.
If you block it you WILL lose your internet connectivity (At least that's what I think. Please correct me if I'm wrong. I'm not an expert.)
Hope that helps.
Cheers,
grampa.
"It is a mistake to think you can solve any major problems just with potatoes." (Douglas Adams)

Toggie

  • Guest
Re: should svchost.exe be allowed internet access??
« Reply #3 on: May 14, 2007, 12:19:18 PM »
Hi FJR1300

As has been stated, good or bad, svchost.exe is a fundamental part of the Windows OS and will probably need some Internet access. As an example, and by default, svchost is used by Windows, in the following situations:

DHCP Client (Dynamic Host Configuration Protocol)
When your PC connects to the Internet it is given an IP Address by your ISP and is subsequentially updated at specific periods. 

DNS Client (Domain Name System)
When you need to access a page on the Internet the name of the page needs to be resolved to an IP Address.

ERSvc (Error Reporting Service)
Reports system and application faults to Microsoft

Win32Time (Windows Time Synchronisation)
If you synchronise your PC clock with an Internet source.

Windows Automatic Updates

There are others...

Toggie

Offline PapaSmurf

  • Comodo Member
  • **
  • Posts: 28
Re: should svchost.exe be allowed internet access??
« Reply #4 on: May 14, 2007, 09:26:23 PM »
It really depends on whether or not you are talking about the real one in windows system, or
a phony one that is in disguise. Please google the process and read up on it. Then check your system to be certain you have the correct one.


Edit message to add url:

Here is a pretty decent explanation of this process with illustrations:

http://www.computerhaven.info/svchost.htm
« Last Edit: May 14, 2007, 09:33:38 PM by PapaSmurf »
My friends call me Papa, you call me Mr. Smurf

Offline Ravenheart

  • Comodo Family Member
  • ***
  • Posts: 54
Re: should svchost.exe be allowed internet access??
« Reply #5 on: May 29, 2007, 01:21:25 PM »
How do I even make a rule about svchost.exe explicit, in the AM or wherever, if it's not showing?

Toggie

  • Guest
Re: should svchost.exe be allowed internet access??
« Reply #6 on: May 29, 2007, 01:40:23 PM »
Ravenheart:

Svchost.exe is considered a safe application by CFP, however, if you wanted to create specific rules you could:

1. Turn off 'Do not show any alerts for applications certified by Comodo' In Security/Misc
2. In Application Monitor manually create specific rules for svchost.exe (it lives in %Windows%/Syetem32)

An alternative to number 2, is to turn Alert Frequency up to very high, deal with the prompts and then edit the rules. Just remember to reset AF, other wise you will continue to receive lots of prompts.

are there any specific rules you wish to create?

Toggie

 

Offline Ravenheart

  • Comodo Family Member
  • ***
  • Posts: 54
Re: should svchost.exe be allowed internet access??
« Reply #7 on: May 29, 2007, 02:14:09 PM »
Toggie, no, I was just trying to get a better handle on what shows and what doesn't.

 

Seo4Smf 2.0 © SmfMod.Com | Smf Destek