should svchost.exe be allowed internet access??

Learn about Computer Security General Security Questions and Comments
1

question

2

It depends on your activities. For example you need microsoft updates you must svchost.exe allows internet access. For others activities you need not svchost.exe allow internet access?

3

Hey FJR1300,
“svchost handles processes executed from DLLs and should not be terminated” is what CPF says.
You should follow their advice unless you have reason to think something fishy’s going on.
I have 2 rules for svchost in AM: 1 In, 1 Out.
If you block it you WILL lose your internet connectivity (At least that’s what I think. Please correct me if I’m wrong. I’m not an expert.)
Hope that helps.
Cheers,
grampa.

4

Hi FJR1300

As has been stated, good or bad, svchost.exe is a fundamental part of the Windows OS and will probably need some Internet access. As an example, and by default, svchost is used by Windows, in the following situations:

DHCP Client (Dynamic Host Configuration Protocol)
When your PC connects to the Internet it is given an IP Address by your ISP and is subsequentially updated at specific periods.

DNS Client (Domain Name System)
When you need to access a page on the Internet the name of the page needs to be resolved to an IP Address.

ERSvc (Error Reporting Service)
Reports system and application faults to Microsoft

Win32Time (Windows Time Synchronisation)
If you synchronise your PC clock with an Internet source.

Windows Automatic Updates

There are others…

Toggie

5

It really depends on whether or not you are talking about the real one in windows system, or
a phony one that is in disguise. Please google the process and read up on it. Then check your system to be certain you have the correct one.

Edit message to add url:

Here is a pretty decent explanation of this process with illustrations:

http://www.computerhaven.info/svchost.htm

6

How do I even make a rule about svchost.exe explicit, in the AM or wherever, if it’s not showing?

7

Ravenheart:

Svchost.exe is considered a safe application by CFP, however, if you wanted to create specific rules you could:

  1. Turn off ‘Do not show any alerts for applications certified by Comodo’ In Security/Misc
  2. In Application Monitor manually create specific rules for svchost.exe (it lives in %Windows%/Syetem32)

An alternative to number 2, is to turn Alert Frequency up to very high, deal with the prompts and then edit the rules. Just remember to reset AF, other wise you will continue to receive lots of prompts.

are there any specific rules you wish to create?

Toggie

8

Toggie, no, I was just trying to get a better handle on what shows and what doesn’t.