Firewall alert question

I got an alert two days ago that said mdnsresponder.exe is trying to receive a connection from the internet and since I didn’t know what it was at the time I unchecked remember my answer and clicked to block it. So then I was given a choice to only block or block and terminate but I just chose to only block it. I recently installed iTunes on my pc when I got Apple TV and from what I understand this is for bonjour which is used by iTunes. I noticed the firewall had blocked it another five times later that same day without any alerts. I thought that when you unchecked remember my answer it only blocks that one instance. I’m not sure what it does or if it’s something I should have allowed and if so how do I fix this?

I am not sure at all but I think it might block the program for its session, so if you terminate the process and then run it again (assuming you can run it again) then I think it shouldn’t be blocked anymore. If you don’t want to bother with terminating processes and such you could try just restarting.

You could also double check that no rules were indeed created by going into the advanced settings for the Firewall and looking for the Application Rules.

Well that makes sense. Thank you. I did not find an application rule for it but did see one for C:\Windows\System32\svchost.exe - Allow UDP In From IP In (192.168.1.1/255.255.255.0) To Mac Any Where Source Port Is Any And Destination Port Is Any. I remember getting this alert and I allowed it after I googled it and from what I remember it was safe to allow and necessary but thought I’d run it by you for your input. I see there is an identical rule for Skype which I use so not too worried about it. I do appreciate your help as I am clueless with this firewall, lol. Do you know anything about this service and what it does? Thanks again for your help. :slight_smile:

Here is an article explaining svchost: http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

I quoted a part which I think is the most relevant to the question.

[b]So What Is It?[/b]

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Awesome. Thank you so much. :slight_smile: