New Update Failed; No Internet Connectivity: svhost.exe warnings

This morning an update for CIS Internet Security was made available.

Allowed Updater to download and install. Entered passsword when requested. Rebooted when asked. Restart was normal and successful.

However, limited or no connectivity came up when I attempted to connect the DSL router to the computer. Could not see the modem, no settings visible in browser at address

Running XP Pro SP3, all M$ updates current. Did have ARP enabled in older version previous to this one.

Repaired installation by removing COMODO Firewall Free with Revo Uninstaller and cleaning up about 28 leftover registry entries using a registry cleaner. I downloaded a new full installer at COMODO (35.8 MB 32-bit) using another computer and transferred file to computer that was without COMODO.

Install as COMODO Firewall Free was successful and came in as default settings.

Defense + now in Training Mode. ARP not enabled.

Believe me, I understand an update can cause a problem such as no connectivity, so I was prepared for such a calamity.

Now, the question: I have gotten two warnings re svhost.exe. What should I do about them?

svhost.exe is attempting to connect to the Internet. Port 1034
svhost.exe is attempting to connect to another computer UPNP/SSDP Port 2869 - TCP

I do not know what action is being performed or why, so I have so far chosen to block without remembering my answer. Firewall is blocking these two actions perfectly so far.

Do I need to continue blocking or should I allow?



Hello! I also encountered the same situation! When I updated the "5.4"version, restart the computer to appear “warning”!

CIS5.4 warning “svhost.exe” need to connect the external computer! because I will set the firewall in the "protection arp cache " feature is turned on, and to appear above! but when I turned off the feature, no longer has this Situation!

Arp cache so it will not be protected whether it is too dangerous? please management are able to solve the problem! Thank you!

Ray. L 6/5/2011

Hai, guise :wink:
Pls refer to this thread:


Thank you for the link.

Additional information re the alerts: Both refer to the computer, aka, TCP or UDP. Packets are being sent from, which is the DSL modem. I have, so far, blocked these intrusions w/o remembering my answer, and have, at the moment, 16 intrusions blocked in the firewall.

I have Firewall set to Safe Mode, and Defense + set to Training Mode.

What is the source of this behavior, and why is it running?

As I am a newbie, any information provided will be helpful.



Your pc is trying to get it’s assigned IP address from router.
A fix is underway and is expected on Monday.


  • Set defense+ to clean pc mode if your pc is clean
  • Disable firewall until you have internet and then reenable it on safe mode level.


That’s the thing. I do have internet access even with blocking the above actions.

Will the updated version be a new file? Should I wait until then to download and install?


Why disable the firewall unless running Windows Firewall? Does Defense + protect the PC in Clean Mode, is that what you are saying? I am certain I misunderstand your intent here.


This is now officially a communication meltdown… ???

Why did you disable Defense+? [set it to training level, which basically ALLOWS everything running?]
Safe mode trusts all files on your system already and monitors NEW files from then on…
svchost is needed for communication with the router…