Generic Host process & wiondows explorer

Help for v2
1

What about apps/process like “windows explorer” and “Generic Host Process” they always tried to access the internet and act as servers.
With ZA I was able to set these unneeded actions to “not allowed”

Is comodo configured to not allow these unneeded accesses?

Thanks again

2

Generic Host Process = svchost.exe. It needs internet access otherwise important functions such as Windows Updates and even your internet will lose connection.

Windows Explorer = explorer.exe. It does not have any useful purpose for connecting, so I would recommend to block it with an Application Monitor (appmon) rule.

I take it that you disabled the default option: Do not show any alerts for the applications certified by COMODO?

3
Generic Host Process = svchost.exe. It needs internet access otherwise important functions such as Windows Updates and even your internet will lose connection.

Here is my setting for Generic Host in Zone Alarm.

935×608 103 KB

It was always trying to act as server which it did not need to do. Thus the setting you see. This seems to work fine.

I never have a problem with updates or browsing with it disabled as “server”

Does Comodo not differentiate between “Access” and “Server”?

I take it that you disabled the default option: Do not show any alerts for the applications certified by COMODO?
No , Do I need to disable this so that I have a choice how to allow services such as Generic Host?

Thanks

4

Hi Cliffhucker :slight_smile:

Svchost.exe is a tricky little beast! The problem is, it depends how much work you are willing to do, to restrict this service.

On my system, the only thing svchost does, is DHCP, and hopefully that will go soon, too. But to achieve this, I have had to create lots of rules in Net Mon and App Mon.

Essentially, if your OS hasn’t been ‘tweaked’ you may have to allow svchost access, to do a number of things, such as DHCP, DNS, Windows Updates etc.

The ‘Act as a Server’ thing is a bit misleading. To be honest I still find it confusing. It basically means, in the context of cfp, that the application or service, is waiting to connect, not that it is waiting for something to connect to it…As I said its confusing.

If you want to know exactly what’s connecting to the net and are prepared to create rules, as necessary, then disable ‘Do not show any alerts for the applications certified by COMODO’ Also iy you want the gory detail, set the Alert frequency to very high 88)

Hope this helps

Toggie

5

I remember ZoneAlarm (and Kerio) with Generic Host Process…They never documented it well.

Toggie, these tweaks must have something to do with disabling Windows services?

The act as server alerts means CFP is checking for loopback connections (tcp or udp).

6

With Generic Host process in ZAP I would I would not allow it as a “Server” and all would be fine.
But when I would block it to access the internet My browsing would stop. Then I would simply uncheck that in ZAP.

With Comodo, when the “allow/disallow” prompt comes up it defines if it wants to be server or just access which is great. However, in the App Mon it does not say/define the type of access if it is as server or not. So if have to delete all and start over.

I remember ZoneAlarm (and Kerio) with Generic Host Process...They never documented it well.
In the ZA forums it is advised to set the settings as I have them for Generic Host Proc. That is to not allow it as server. http://i118.photobucket.com/albums/o116/TahoeCliffhucker/ZAP.jpg

I am starting to like Comodo as I get familiar with it.

One suggestion is to enable custom window sizing.

Soya I suppose you can close this threaed if you see no value in it being open.

I am good to go.

Thanks again.
The support people get will make a huge diffference to the success of Comodo.

Cheers

7

That is a limitation to power users - the loopback connections aren’t shown or logged. If you denied or allowed the act as server alert and click the Remember option, it’ll end up as an incoming application rule. The only direct control with loopbacks is in Security > Adv > Misc > Config. If you don’t run a proxy server, then I highly recommend to Enable skip TCP loopback checks. Now you won’t be bothered by that same alert again.

This has been suggested many times and it should be in the (old) wishlist(s) already.

8

And IF I remember correctly, it has been stated by the dev team that the monitoring of loopback communications (and listening, as well) will return; I presume this to mean version 3.

LM

9

Oh you mean this? See how convenient it is? You don’t need to remember. That’s why I’m here

. I don’t know if that works in current 2.4 because my alert level is at low.

10

Sorry, you missed it on that one, Soya. :frowning: I still have faith in you, though, and still consider you the “Search Maestro.” I do remember it as being in a post from Egemen, however, so that part’s okay. :wink:

LM

Edit: Actually, I was thinking of a combination of this one: https://forums.comodo.com/index.php/topic,5190.msg38574.html#msg38574

and this one: https://forums.comodo.com/index.php/topic,2300.msg18093.html#msg18093

11

And how did I miss it? I thought this was about loopback logging not the close button. :stuck_out_tongue:

12

Gotta look at the whole page in perspective. It’s not just about the Close button, but also Listening Ports, Active Connections, and changes in general.

Here’s one about the act as a server…

https://forums.comodo.com/index.php/topic,819.0.html

lM

13

Whoa whoa whoa! One topic at a time here. Before we discuss about the future, let’s make sure we have answered Cliffhucker’s generic host and explorer questions and then we can call it quits.