SVCHost.exe want to access the internet?

[OM]

I've got a brand new laptop.
I've got Symmantec firewall running.

I've had a popup asking saying SVCHost.exe wants to contact the
internet.
The message also says it's low risk.
Should I allow this?

Previously... the wirless connection to the net just WOULD NOT work!!
The laptop has been replaced.
The first time I got this message... I can't remember what I set the
permission to.
(Could this have been the cause of my internet connection going?)

Any help would be appreciated.

Thanks.


OM

 

[Todd H.]

I've got a brand new laptop.
I've got Symmantec firewall running.

I've had a popup asking saying SVCHost.exe wants to contact the
internet.
The message also says it's low risk.
Should I allow this?

Previously... the wirless connection to the net just WOULD NOT work!!
The laptop has been replaced.
The first time I got this message... I can't remember what I set the
permission to.
(Could this have been the cause of my internet connection going?)

Any help would be appreciated.

I get these from time to time as well. I assume they're API calls for
host name resolution. I haven't determined exactly what triggers
them, but I'd concur wiht the tool's assessment of low risk, normal
operation.

 

[Adam Piggott]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've got a brand new laptop.
I've got Symmantec firewall running.

I've had a popup asking saying SVCHost.exe wants to contact the
internet.
The message also says it's low risk.
Should I allow this?

Previously... the wirless connection to the net just WOULD NOT work!!
The laptop has been replaced.

svchost.exe is also known as the "Generic Host Process for Win32 Services",
which might not make sense at first read

A program can run in a way that's called a "service". A service typically
provides some sort of functionality that's always on whatever user is
logged on and even if no-one is logged on. One example would be Windows
XP's Firewall service; this is a program that's always running to help
protect the computer's network connections.

Depending on how a service is set up, it is sometimes run inside the
Generic Host Process, so instead of seeing, for example, "myapp.exe" you
would see svchost.exe. This is also why you'll often see many svchost.exe's
running.

Likewise, if the program wanted to connect to the Internet (say to update
itself or provide some sort of Internet functionality) you would see
svchost.exe trying to connect.

Although pretending to be svchost.exe (or variants like scvhost) is a
fairly common method used by viruses to hide themselves, as long as you
have a clean system it would be safe to allow svchost.exe to access the
Internet.

If you're curious what's running under the Generic Host Processes, go to
Start->Run and type in: cmd
Press OK. In the command window, type: tlist /s
This will show a list of the running programs, and in each of the
svchost.exe entries you'll see the names of the programs running under the
Generic Host Process.

The first time I got this message... I can't remember what I set the
permission to.
(Could this have been the cause of my internet connection going?)

You should be able to find what permission you gave svchost.exe in the
firewall's settings (consult the documentation on where to find it).
Although I can't say I've come across an Internet connection problem caused
by svchost.exe being blocked, I think it would be a possibility.


Hope this answers your questions!

Adam Piggott, Proprietor, Proactive Services (Computing).
http://www.proactiveservices.co.uk/

Please replace dot invalid with dot uk to email me.
Apply personally for PGP public key.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)

iD8DBQFD6bQS7uRVdtPsXDkRAh9SAJ9RVT33+rdhjRFHANmlN4YTMaip5QCdHrrT
rOMxQd2jxkqNudItkhGNVs8=
=/aE2
-----END PGP SIGNATURE-----

 

[OM]

adam... that was really useful.
thanks for the reply.

 

[John Coutts]

I've got a brand new laptop.
I've got Symmantec firewall running.

I've had a popup asking saying SVCHost.exe wants to contact the
internet.
The message also says it's low risk.
Should I allow this?

Previously... the wirless connection to the net just WOULD NOT work!!
The laptop has been replaced.
The first time I got this message... I can't remember what I set the
permission to.
(Could this have been the cause of my internet connection going?)

Any help would be appreciated.

Thanks.


OM

**************** REPLY SEPARATER ******************
SVCHOST.EXE is a service that Microsoft uses to interface to .DLL files. There
can be many actual services connected under one SVCHOST, and that makes it an
ideal location to hide malware. Most of Microsoft's networking functions are
connected in this manner, so activity is to be expected. You can use the
command "tasklist /svc" to display the actual services connected under
SVCHOST.EXE. For example, the following are active on my XP:

SVCHOST.EXE 1968 RpcSs
SVCHOST.EXE 1048 Dnscache
SVCHOST.EXE 1084 LmHosts
SVCHOST.EXE 1140 AudioSrv, CryptSvc, lanmanserver,
lanmanworkstation, Netman, RasMan,
ShellHWDetection, TapiSrv, w32time, winmgmt
SVCHOST.EXE 2788 stisvc

J.A. Coutts