svchost.exe showing on active connections window [RESOLVED]

Ever since I updated my Comodo Firewall earlier this year, it has been showing svchost.exe as listening on port 135 and alg.exe listening on port 1029in the active connections window, which it never did before.

After digging around using TCP View and Process Explorer I have discovered the service using svchost is Remote Procedure Call (RPC).

I was wondering if this is normal behaviour. I have used GRC Shields Up which shows the ports as stealth and there doesn’t seem to be any bytes going in or out on these ports according to Comodo’s active connections window.

Any help would be grateful, thanks!

It’s normal :slight_smile:

Happened to me before too…


You can shut down the alg.exe(Application Layer Gateway) if you wish by disabling it in services.msc

Click start/run/type services.msc in box next to open.Find “Application layer gateway” right click on it and choose properties,where you can stop it and set it to disabled.


svchost should be outgoing only. See here.

Completely normal, though as matty said, you can pretty much turn off ALG. I’m pretty sure 135 is dcom, which likewise is free for disabling (there should be instructions around somewhere, just search).

Thanks peeps :slight_smile:

This thread is now closed.

If you need this thread re-opened, Please PM any online Moderator.