jmbliss said:
I have sp 2 firewall in xp home. I check "no exceptions", these settings are
constantly changing and will have remote desktop checked, anytime I download
yahoo, 2 different programs are checked for yahoo messenger, when I installed
an hp printer, about a kazillion of hp exe programs are checked, and
sometimes Upnp, and lately "run dll as an application"......I uncheck them
all, reboot and it begins again....no one has access to this except me. I
never get any kind of blocking messages ever, and any sort of change of
settings notice. I do run 2 desktops off the cable modem with a Dlink wired
router
The Windows firewall stops inbound traffic. Chatters like yahoo's need
to get messages, so the firewall needs to let their traffic through --
so on install they tell the firewall to do that. If you don't want to
make an exception for that, you might as well uninstall the chatter.
In my opinion HP drop waaay too much software on you every chance they
get. I see I'm not alone. Go to add/remove programs and yank anything
you didn't think you asked for, then yank their exceptions again.
Media center and probably others use upnp discovery. It's a system
service; the way to shut it off is Start/Run, "services.msc", find "SSDP
Discovery Service" on the list, doubleclick and stop and disable it.
When you do, it might warn you of other services that depend on it; if
you don't see anything you care about go ahead and disable it anyway;
none of them I know of are in any way critical.
Remote Desktop and Remote Assistance are likewise services, with much
less obscure names. You can shut off every service starting with
"remote" the same way you did with SSDP, with no great loss. If you
want to take it farther than many would recommend, to the point that you
won't even be able to share anything on your home network, you can also
disable "Server" and "Workstation".
rundll is a generic tool used by lots of different programs, which is
unfortunate, because the Windows firewall is serviceable but very, very
basic. I think you're going to have to yank exceptions, run a program,
check exceptions, ad nauseam, until you identify who's doing this one to
you. Maybe someone here knows a better way.
You could research and use any firewalls on your router and/or modem;
that might make you much more comfortable setting up a looser home network.
And you could get serious about security: turn on logging, and check the
logs regularly.
You have to realize that "no exceptions" really isn't going to fly for a
home computer. It'll work for e.g. kiosks that use only a web browser,
but you're probably not going to be able to restrict even yourself that
far. You've already found one exception you didn't realize you wanted.
You have to trust some of this code. You already do. But it's good
to be paranoid.
One thing you might consider is to get a firewall that also controls
*outbound* connections. That will detect spyware and spam trojans that
get past your vigilance. I know you can set up Norton to prompt you
every time it detects any connection attempt from any program using any
code you haven't previously approved, on any port -- including updates
and new plugins to previously-approved programs. Just about anybody
would call that adequately paranoid. I'm sure there are others that
will do that level of checking too.
Hope this does it for you,
Jim
