zone alarm "svchost exe" act as server

Hi all first post so be gentle ,
i,ve have the free version of zone alarm on my home pc (xp home additiom OS) and when i boot up and desktop appears i get a message "do you want generic host process for win 32 services to act as a server". I found out that it is used for microsoft mesanger among other things ,so so far have said no and everything seems to work ok.
I dont use messager but i am wary of allowing my pc to act as a server on internet. what does this program do

thanks
simonk http://www.majorgeeks.com/vb/images/icons/icon5.gifhttp://www.majorgeeks.com/vb/images/icons/icon5.gifhttp://www.majorgeeks.com/vb/images/icons/icon5.gif

 

here is some information on SVCHOST
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q314056&

You don't need it to act as server. You should also disable Windows Messenger Service (NOT the same as MSN messenger; the instant chat program)
To make life easy, you can use this to disable the service:http://www.majorgeeks.com/download.php?det=3703

 

Windows Messenger vs. Messenger -- uh-oh!

Weeks ago I disabled Messenger Service on my computer. It's only called "Messenger" though...nothing's called Windows Messenger Service (unless I'm blind) so I want to be sure I did the right thing.

Under "Messenger Service" the description says: Messenger Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

So -- it's OK to be disabled? I have "Alerter" set on "manual". But it says this is NOT "Windows Messenger" so I must have the wrong thing disabled. uh-oh

(windows XP Home Edition)

 

semantics. The service is known commonly as the WINDOWS MESSENGER SERVICE and is listed as MESSENGER in the services snap in. We call MSN Messenger the IM Chat program that MS referrs to as WINDOWS MESSENGER. In providing support, it is often esstential to make the distinction between the two with names that are understood and are uniquely identifiable as the norm . Most everyone knows that MSN Messenger is the IM program, so we go with that.

 

Thanks Kodo, everything seems to be running fine so I figured I had done it right but maybe something was lurking in the background waiting to crash. Gotta love semantics.

 

You're welcome Pegg and I see we have another CNY user

 

Just for KODO - sorry to put it here in the post

Well, I didn't want to put down FULTON, NY -- who's heard of that (except for the record snowfall this winter)

Go ORANGEMEN!

 

I did a little research into this very issue awhile back and was surprised at the lack of info I could find. Tons of posts about it on Zone Labs' message board but (at the time) no explanation from ZL. They seemed to be avoiding the issue.

I found on my machine that at times internet access was intermittent (I'm on dial-up) when I denied it server permission in ZA, so I chose to allow it. It's the only program I've allowed server permission to and so far no problems/trojans/worms, etc. YMMV

 

more confused - if that's possible

OKAY -- I have MESSENGER totally disabled (I don't believe I mean the IM stuff. I mean what's in my computer-- "manage" -- Services --that's what Idisabled -- it's called "Messenger" -- it's disabled - period) (Windows XP Home)

NOW, with Zone Alarm (uh-oh, sorry, should this be another post?) well, I'm checking the log viewer for what is blocked and re: "Program Access" the name "Messenger" continues to be "blocked from connecting to the Internet" in the outgoing direction (of course). Now this will be blocked from 40-100 times and the "get more info." button isn't able to be clicked on for this like it is for other postings on the log viewer.

SOOOO, I don't use the IM Messenger -- is it doing something somewhere? Is this really the "program" Messenger -- but it's "disabled" ???

 

So now it has changed from "acting as server"/"incoming connection" to "outgoing connection" ?

As you might have noticed when disabling the Messenger-service, then there many services within Windows.

I guess what you are also experiencing is the Windows Time-service, which every once in a while tries to synchronize with an Internet Time-Server (Not really needed but nice to have for some people). To configure this synchronization double-click the clock on the taskbar and select the Internet Time-tab.

 

Hmmm what to do
right ill keep svchost.exe denied as server access and report back if i get any problems
http://www.majorgeeks.com/vb/images/icons/icon11.gifhttp://www.majorgeeks.com/vb/images/icons/icon11.gifhttp://www.majorgeeks.com/vb/images/icons/icon11.gif

 

synchro and trusted zones

Well, that was what the other post was about and I had questions about svchost.exe so I looked here too. They started talking about ZoneAlarm so that got me started about MESSENGER.

# 1) And....do what? I went there and it's checked in the box that says "automatically sync. w/ an internet time server"
the server is "time.nist.gov" but it says "an error occurred getting the status of the last sync. The RPC server is unavailable."

#2) I'm also not sure what is correct in my Zone Alarm trusted zones. It automatically set up a trusted zone of Broadcom Integrated Controller - which is always there. The WAN (PPP/SLIP) interface isn't always there - I don't remember seeing it actually until I was checking my logs and clicked on a blocked IP address and accidentally "ADDED" it to my TRUSTED ZONE and there it is -- as my "Adapter Subnet" and I can't remove it, edit it, etc. while it's "active" -- I've searched ZL.com and can't find out what to do...but this is a blocked site which I put here...ugh.

 

Pegg, can you please start a new thread regarding your new questions.
Thanks!

 

Yessiree-bob, but I was just replying to Snakefoot and using his quote so I didn't think I could do that somewhere else.

 

Guess Kodo will become happy if you:
1. Make a new thread about SVCHOST making outgoing connections
2. The first post in the new thread could contain your first post about the new problem, and then you could consider adding your two new questions.
3. Make a post in this thread about the new thread you just created.

P.S. If you don't want to synchronize with time-server, then just disabled it (With a little use of logic, then I'm sure you can find out how). If you want to synchronize with time-server, then I guess you have to allow SVCHOST to access the Internet.

 

I could make Kodo real UNHAPPY if I sent an INCREDIMAIL message to XFLAT signed by KODO

Hee-Hee (I did a search for that last night - WOW that was a doozy). Just kidding there Kodo, I wouldn't do that to you, you're a Central New Yorker, man.

OK - I have several Zone Alarm questions so I started a thread called "Calling all Zone Alarm Users - Help" and I'll go from there.

Kodo - stop reading!

Snakefoot - keep reading...
BUT - since YOU mentioned it...I still was wondering if YOU could tell me about MESSENGER trying to send OUTGOING stuff if it's disabled and if it's doing that 40, 50, 100 times, and you mentioned the Internet-Time tab...is there something there to change. I don't have the have SVCHOST as the server to the Internet (as far as I know).

 

Fulton isn't that far away ya know..

 

Since you have disabled the Messenger Service, then it is not the Messenger service trying to make outgoing connections

If you read the article Kodo posted in his first post, then you would have learned that several services is running within the SVCHOST (Messenger is just one of them). I'm just guessing that you also have the service "Windows Time" running within SVCHOST.

 

Well - that's what I figured.

Actually - I had found that article all by myself a couple of days before I saw Kodo post it here (AHHH - I'm becoming one of you...) Yep - a whole lot of stuff runs within SVCHOST.

SO - my LAST question about this (I promise). This is a program trying to send something OUT of my computer that Zone Alarm keeps blocking over and over again (which is good, I imagine).

Is there a BETTER way than having ZA block it hundreds of times a day? Do you mean just Disable Windows Time? (I know how to do that) or something else?

 

It is just me guessing that it is the Windows Time doing the traffic. Usually a firewall would show what port no it the outgoing request is using, and with that information it is possible to tell what service within SVCHOST, that is making the outgoing request.

I'm a little disturbed that you are not able to find out how to disable the Windows Time synchronization (Since I have already told you where to do it).

When you double-click the clock on the taskbar and select the Internet Time-tab, then the following image should be shown.

http://www.informit.com/content/images/art_alexander1_phoninghome/elementLinks/alexander1_fig4.gif

Surprisingly enough one have to untick Automaticly synchronize with an Internet time server to stop the time synchronization. (And press Ok to confirm your choice)

 

you guys need to start a new thread..