If you did that then how could Windows Update or any other Windows program work properly? svchost in and out is normal traffic. I dont know how to change svchost entires to only outbound in Comodo anyways cause there is no entires of svchost.
thanks for all your help, didnt much fancy going back to windows firewall, cheers eagle
Hey I was wrong. I found out how to get the results you want and the results I should have. Run the steath port wizard. Go to Firewall\Common Tasks\Stealth Port Wizard. Open that up and select block all incoming connections-stealth my ports to everyone. After you do this and reboot you should now get firewall intrusion logs about Windows System being blocked. Thats what you want.
\
its now blocking windows
c\windows systems svchost.exe
windows operating systems
systems
is this right cheers eagle
What does you log say? SVChost still needs to get out. Thats not what I meant. Did you run the wizard. Now you should have new Global rules.
yes they are being block inbound
it says its blocked 18 intrusions so far. i done what u said with the stealth port wizard
Good. In your Firewall\Advanced\Network Security Policy you should have a SVChost entry. Mine is set to custom. But Explorer.exe and System are set to block. I hope this is what you were looking for now that you see intrusions. So do I.
system32\svchost.exe is custom
then comodo firewall pro outgoing only
then the rest are custom cheers eagle
in firewall events is says that
windows operating system is blocked
system is blocked
c:\window\system32\svchost.exe is blocked
is this correct
Yes. Aslong as svchost can still get out but not in.
yes its only blocking inbound, why does it have to be blocked in anyway, what do i do with the firewall events because they is 58 intrusions in there so far
Dont worry about it. The counter will reset when you reboot. Wow I only have 10 intrusions. Sure nothing else is being blocked?
only the 3 i said
- window operating system
- system
- c:\window\system32\svchost.exe
these are in firewall events