Comodo pops up a firewall alert telling me that svchost.exe is requesting an Internet connection. Okay, so WHICH instance of svchost.exe might that be? Clicking on the “svchost.exe” link shows some properties of the executable but it doesn’t tell me the PID (process identifier) for the instance of svchost.exe that wants to make a connection. There are several instances of svchost.exe loaded in memory as part of the load-balancing of NT services. I won’t know which one to investigate to see which subprocess under svchost.exe might be trying to connect.
Also, some instances of svchost.exe might rollup many different processes. Telling me that svchost.exe wants to connect doesn’t tell me which subprocess is actually issuing the connect request.
I need the PID to let me know which process is requesting the connection. I really need to also know which subprocess under svchost.exe is asking for the connectiong. Otherwise, there is insufficient information in the firewall alert popup for me to make an informed decision.