svchost.exe: virus or ok?

HacksawEddie · 07-05-2004 11:58AM #1

i got kerio firewall, seems ok so far.
its now asking me
"Someone from 192.168.0.1,(router?) port 1900 wants to send UDP datagram to port 1031 owned by 'Generic Host Process for Win32 Services' on your computer"
details: c:\windows\system32\svchost.exe

i know some viruses can hide in svchost, so not sure if i shulod let it connect to the net..does it need to go online?

cheers
¬hacksaw

Mutant_Fruit · 07-05-2004 12:01PM

Generic HOst Process should be configured as follows:

Incoming packets: NO, NO NO NO! Definately block incoming

Outgoing packets: Yes, i think this has to be allowed or else you cripple your internet.

HacksawEddie · 07-05-2004 12:13PM

thanks, but how do i do that?
i cant seem to find the option

Mutant_Fruit · 08-05-2004 01:16PM

Open the Kerio Firewall window, then Click on the "Network Security" tab.

Then scan that list for SVCHost (Generic Host process might be called) and then double click on it and set the permissions there.

HacksawEddie · 09-05-2004 02:35PM

i cant find the network security tab, i only have kerio personal firewall 2.1.4, is there a different version that has that tab or am i just blind?!

Mutant_Fruit · 09-05-2004 06:03PM

Get the latest version of kerio! Version 4 is a lot better than 2.X

When you get 4.x, then you'll see the tab

svchost.exe: virus or ok?

Comments