svchost.exe: virus or ok?

HacksawEddie

i got kerio firewall, seems ok so far.
its now asking me
"Someone from 192.168.0.1,(router?) port 1900 wants to send UDP datagram to port 1031 owned by 'Generic Host Process for Win32 Services' on your computer"
details: c:\windows\system32\svchost.exe

i know some viruses can hide in svchost, so not sure if i shulod let it connect to the net..does it need to go online?

cheers
¬hacksaw

Mutant_Fruit

Generic HOst Process should be configured as follows:

Incoming packets: NO, NO NO NO! Definately block incoming

Outgoing packets: Yes, i think this has to be allowed or else you cripple your internet.

HacksawEddie

thanks, but how do i do that?
i cant seem to find the option

Mutant_Fruit

Open the Kerio Firewall window, then Click on the "Network Security" tab.

Then scan that list for SVCHost (Generic Host process might be called) and then double click on it and set the permissions there.

HacksawEddie

i cant find the network security tab, i only have kerio personal firewall 2.1.4, is there a different version that has that tab or am i just blind?!

Mutant_Fruit

Get the latest version of kerio! Version 4 is a lot better than 2.X

When you get 4.x, then you'll see the tab