Generic Host Process for Win32 Services

عدد الرسائل : 198 تاريخ التسجيل : 11/11/2006

Generic Host Process for Win32 Services

Original Message

Name: Ben
Date: March 22, 2002 at 16:23:42 Pacific
Subject: Generic Host Process for Win32 Services

Comment:
<BLOCKQUOTE K2XpR="0" Wicpm="0">Can anyone tell me what this program dose, Generic Host Process for Win32 Services? It always wants to connect to the net and it is driving my [color:f30d=green! important][color:f30d=green! important]Firewall up the wall.
</BLOCKQUOTE>[url=][/url]
Report Offensive Message For Removal

Response Number 1

Name: wawadave81@hotmail.c
Date: March 22, 2002 at 21:38:18 Pacific
Homepage: home of borgdrone1of2
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE K2XpR="0" Wicpm="4">hello
its part of xp and 2000 o/s it could be a ligitamate application trying to acess the web could allso be a trojin
i did a [color:f30d=green! important][color:f30d=green! important]google [color:f30d=green! important]search and got many hits heres one

It all starts out with understanding some of the new feature this OS have over previous and even the 2000 series.

You canmost of that information at this link,but you should at least be aware of this.

?msdn.[color:f30d=green! important][color:f30d=green! important]microsoft.com/msdnmag/issues/01/1..[?]

Services Reliability
The last area of reliability improvements is in the area of the services infrastructure. Prior to [color:f30d=green! important][color:f30d=green! important]Windows [color:f30d=green! important]2000, some services shared a process with other services and some ran in their own process. Windows 2000 introduced the generic service host process, Svchost.exe. The goal was to reduce system resources by consolidating the various processes hosting built-in operating system services into a single process. Or, it could permit the [color:f30d=green! important][color:f30d=green! important]system [color:f30d=green! important]administrator to configure the system to run certain services in their own processes, which would prevent one service from corrupting the private memory of other unrelated services (this capability is not documented or supported yet).
If you look at the [color:f30d=green! important][color:f30d=green! important]Windows [color:f30d=green! important]XP process list in Task Manager , you will notice at least four Svchost.exe processes: two running under the [color:f30d=green! important][color:f30d=green! important]SYSTEM account (sometimes referred to as LocalSystem) and two running under two new service accounts: NETWORK SERVICE and LOCAL SERVICE.

One of the two Svchost processes running under SYSTEM hosts the bulk of the services, 29 of them in total. The second one hosts a single service, Remote Procedure Call (RPCSS). The reason this service needs to be in a separate process is that user-written DLLs are loaded into this process. By having RPC running in its own process, these DLLs cannot adversely affect the operation of the other built-in operating system services. The Svchost process running under NETWORK SERVICE hosts a single service, the DNS Client. The Svchost process running LOCAL SERVICE hosts the TCP/IP NetBIOS Helper, Remote Registry, Simple Service Discovery Protocol, and Web Client services.
The reason for the two new service accounts is to improve system security by reducing the privileges that services run with. LOCAL SERVICE is a built in account that doesn't need a password to log on. The account has only a few privileges, and is not a member of the local administrators group. So, if a service that is running under this account is compromised, it cannot take down the whole machine. LOCAL SERVICE also has no network credentials, so attempts to access a machine on the network will connect with the null session. The NETWORK SERVICE account has the same set of privileges as LOCAL SERVICE, but has access to the machine's credentials for outbound connections, similar to the SYSTEM account.
If you want to know more then read the whole article.
The next key seem to be the need then to understand how and why they end up going out side your system or show up in your firewall logs.
You can get some idea about most of them at this article at Microsoft and I have listed some of the important ones which will show up as process numbers.
?support.microsoft.com/default.aspx?sci..[?]
System Process
8 System
132 smss.exe
160 csrss.exe Title:
180 winlogon.exe Title: NetDDE Agent
208 services.exe Svcs: AppMgmt,Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,LanmanWorkstation,LmHosts,Mes senger,PlugPlay,ProtectedStorage,seclogon,TrkWks,W32Time,Wmi
220 lsass.exe Svcs: Netlogon,PolicyAgent,SamSs
404 svchost.exe Svcs: RpcSs
452 spoolsv.exe Svcs: Spooler
544 cisvc.exe Svcs: cisvc
556 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
580 regsvc.exe Svcs: RemoteRegistry
596 mstask.exe Svcs: Schedule
660 snmp.exe Svcs: SNMP
728 winmgmt.exe Svcs: WinMgmt
852 cidaemon.exe Title: OleMainThreadWndName
812 explorer.exe Title: Program Manager
1032 OSA.EXE Title: Reminder
1300 cmd.exe Title: D:\WINNT5\System32\cmd.exe - tlist -s
1080 MAPISP32.EXE Title: WMS Idle
1264 rundll32.exe Title:
1000 mmc.exe Title: Device Manager
1144 tlist.exe
Yes those are the numbers that show up with ZA and other logs.
But if you want to find Any process..
Start up MS Info by going to the Run command on the Start button, you will need to type in msinfo32 and then it should fire right up.
Go to the section labeled "Software Environment" and then to the subsection labeled "Running Tasks". This will show all programs and services that are running and their process ID's.
Another Memeber suggested you could also try this.
Easier way: type ctrl+shift+esc to bring up the task manager. Select the processes tab. Locate the process id in the pid column.
The last thing I can think of is the information at this thread.
Some ideas how to close the ports these processes use
?www.dslreports.com/forum/remark,178360..
This post does not hold all the answers for you. As you can see some of you have already helped to brings these thoughts together.
They can be improved upon. So I hope others will post their ideas and tips here also. But for now, if you are running XP and you are still not sure how it all comes together go back to that first link and study it.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 2

Name: [email]Lord Happy[/email]
Date: April 30, 2002 at 06:15:42 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>Thanks for taking the time to post your response. Many of the Google references to this file talk about Code Blue, which is an IIS virus. As I'm running a fresh install of W2K, I'll trust that this file is doing as advertised by Microsoft and we'll see what happens.
Thanks!
Lord Happy
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 3

Name: [email]fran[/email]
Date: May 04, 2002 at 23:53:45 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>After reading the two responses on what "Generic Host Process for Win32 Services" does, I am now even more confused. I am not real computer savvy but I know my way around. The request constantly comes up on my computer asking for server and connection rights, but I don't know what to do. Someone please help me figure this out, sometimes I let it and other times I don't. I have noticed, occasionally, I cannot connect to any website even though I am online, could this generic host thing have something to do with it?
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 4

Name: Sxy_Flip
Date: May 09, 2002 at 20:53:05 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>thank u
its also bugging my ZoneAlarm</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 5

Name: [email]Steve[/email]
Date: May 11, 2002 at 10:07:29 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>Here's a site that might explain what this "creature" does.
http://www.bugnet.com/analysis/0201/sfxpfbi1.html
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 6

Name: [email]#1 Son[/email]
Date: May 12, 2002 at 18:15:57 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>This Win32.exe program screwed us up for better part of the day after we installed ZoneAlert!
Whe I denied its access, I was not able to get on my server although I have a Cable Modem. I could not get any email, could not get on anything at all!
For a long time, I did not relate the two. When I finally did and let the Win32 through, everthing worked fine.
This is contrary to what Steve's link says. Can someone give me a better explanation?
#1 Son
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 7

Name: [email]Willa[/email]
Date: May 18, 2002 at 15:24:19 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>Ditto to Response #6 As soon as I installed Zone-alarm I discovered that SVCHOST.EXE is needed to allow access to the internet. So just go ahead and tell Zone to allways give access. I am thrilled to find this bulletin board, as I have more questions.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 8

Name: [email]Kobiashi[/email]
Date: May 22, 2002 at 14:31:37 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>I think Generic Host Process for Win32 Services is a transport for dns queries (among other things) this will be why you are not able to access any sites if this service is blocked. After I allowed this through I checked the za log and noticed that the address it was connecting to was a dns server.
</BLOCKQUOTE>[url=][/url]

عدد الرسائل : 198 تاريخ التسجيل : 11/11/2006

اقتباس :: Response Number 9

Name: boxuin
Date: May 22, 2002 at 19:38:32 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>Dns server is correct, you need to allow it. Just check the box for always allow on zone and forget about it.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 10

Name: [email]Colin[/email]
Date: May 23, 2002 at 14:54:56 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>I have been having the same problem where if I deny Generic Host Processes (known as svchost.exe)the right to connect to the internet through ZoneAlarm nothing on the internet works! I have researched this and see that it deals with Universal Plug and Play which has some security issues. Does anyone know why and if I need to let this use the internet? Is it a security risk? If I do not let it connect nothing works, so if anyone out there can help please post.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 11

Name: [email]MultiMbps[/email]
Date: May 27, 2002 at 00:54:19 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>UPnP is a different process -- you'll see it listening on ports 5000 and 1900.
SSDP and Universal Plug and Play can be disabled independently. Open Control Panel > Admin Tools > Services, right click and stop/disable both 'SSDP Discovery Service' and 'Universal Plug and Play Device Host'.
What bothers me about this Generic Host item is that it's actively listening on UDP 1026.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 12

Name: [email]Art Wolinsky[/email]
Date: May 27, 2002 at 16:00:59 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>I have ZA set to Allow Cconnect for Local and Internet, but only Allow Server for Local. I have it prompt me if it wants to act as a Server for Internet. I see no immediate reason why it would have to act as a server and if one does come up I want to know about it. I don't remember ever getting prompted for it to act as a server.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 13

Name: [email]Colin[/email]
Date: May 28, 2002 at 17:40:58 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>Even after allowing it to always connect to the internet, local - allow to be a server in local and internet it still will cause problems where no internet programs will work like the 3rd time I connect to the internet. The only solution is to reboot. Does anyone know how to solve this?
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 14

Name: [email]Colin[/email]
Date: May 30, 2002 at 12:59:26 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>I upgraded to ZoneAlarm Pro and now the problem is solved. Try the 30 day trial and see if it fixes it for you.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 15

Name: [email]dale_wwjd[/email]
Date: June 04, 2002 at 06:56:33 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>I have a copy of the cracked ZA Pro access to trusted and internet and disabled the servers for both and so far so good. My questions are these...
Am I the only one has the feeling that it's creating a giant hole in the ship for bill and his fello spies on the MSMS (Microsoft mothership) and potential hackers?
By simply blocking server acces in ZA is it securing us from potential threats?
And finally could anything breaching privacy law be leaving my Pc and where would it be going?
Sorry for the length :(
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 16

Name: [email]JoeShmo[/email]
Date: June 06, 2002 at 08:30:57 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>in ZA, I have "Generic Host Process" blocked for everything except trusted access. But, if you right click on it, and go to options, I have everything EXCEPT DNS blocked for it, and things seem to be working. When I find something else it needs to do, then i'll allow those ports as well.
If you just give programs rights to the internet, you are kind of defeating the purpose for zone alarm in my opinion. By only allowing specific ports to specific hosts, I want to make sure theres no spyware talking to anything out there (like the media player spyware stuff). Also, if interested in spyware and running XP, be sure to grab XP-anti-spy, which will disable alot of the XP built in spyware stuff.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 17

Name: [email]Tom[/email]
Date: June 10, 2002 at 12:29:29 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>One thing that bothers me about GHP for win32 is if you give it full permision it can connect any time it wants... I gave it permision to access the dns but only temporarily... later it came up and asked to connect to 207.46.226.34 which is owned by MS. When I looked it up it says its Time.windows.com, which probly has to do with xp's time sync "Feature"(Control Panel/Date&Time/InternetTime). Sounds harmless but its still kinda scarry when your computer is calling home with out your knowing. What other "features" pop up later?
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 18

Name: [email]Greg[/email]
Date: June 11, 2002 at 07:16:08 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>As Fran, #1 son, Colin and others have said I too am experiencing occasional problems with connecting to any internet web site or my mail. Everything will work fine after a reboot. I leave my PC on all the time, as I am sure alot of you do too. Sometimes, after the computer been idle for awhile, when I return I cannot get to any web sites. This is driving me crazy! I have been trying to figure this out for awhile now. I upgraded from win 98 and have heard the horror stories that accompany upgrading, but this is the only problem I have. I tried so many things to resolve this, Removed my dial upconnections and reinstalled, uninstalled modem and reinstalled, the same for the modem driver. You can dial up and connect to your ISP (Internet service provider) just fine but you have no access to the web period. The only solution is a restart. I too run zonealarm but just the standard version 2.6.362. Now when you click on the programs tab I show 3 instances of GHP for win32 services running designated by the little icons at the top of the screen between the stop button and the zone alarm help button. Mine is set for LOCAL NETWORK allow and allow server and for INTERNET allow and allow server. Also under the lock tab in zonealarm I have mine set to engage internet lock when screen saver activates. I wonder if this is what is causing my trouble. I am hesitant to say the least to allow this program unrestricted access to the net. Until reading all these messages I had no clue as to what my connectivity problem might be. To be honest I came here trying to find out what GHP win32 services was also as it was bugging my firewall as well. It seems It was worht my time coming here. I'm gonna mess around with this a little now and see if I can get reconnected to the internet AFTER my connection problem appears WITHOUT a restart. Then I'll know for sure what is the root cause of the problem. I'm also gonna get the anti spy software which JoeShmo mentioned as well. Colin, after rereading your post you have the exact problem I have. Upgrading to Pro helped you maybe I'll try that too. Thanks for all the help. Im glad I found this board I'm sure I'll be back.
P.S. dale-wwjd - can you e-mail me the crack for ZA Pro? Thanx in advance.
</BLOCKQUOTE>[url=][/url]
Report Offensive Follow Up For Removal

Response Number 19

Name: Bill
Date: June 12, 2002 at 08:15:52 Pacific
Subject: Generic Host Process for Win32 Services

Reply:
<BLOCKQUOTE>In Windows 2000 and Windows XP computers, the Network Connections list typically includes the SVCHOST.EXE executable file. Windows 2000/XP uses this executable for services that are run from dynamic link library (DLL) files. These other services include operating system services, and can include services that are used by third party programs.
The Network Connections list may include more than one instance of SVCHOST.EXE. Each instance of SVCHOST.EXE hosts one or more services. NIS and NPF do not allow you to terminate this connection.
The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can run, depending on how and where Svchost.exe is started. This allows for better control and easier debugging.
Svchost.exe groups are identified in the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost
Each value under this key represents a separate Svchost group and is displayed as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ Service
To view the list of services that are running in Svchost:
Click Start on the Windows taskbar, and then click Run .

In the Open box, type CMD , and then press ENTER.

Type Tasklist /SVC , and then press ENTER.

Tasklist displays a list of active processes. The /SVC switch shows the list of active services in each process. For further information about a process, type the following command, and then press ENTER:
Tasklist /FI "PID eq processID " (with the quotation marks)
The following example of Tasklist output shows two instances of Svchost.exe that are running.
Image Name PID Services
========================================================================
System Process 0 N/A
System 8 N/A
Smss.exe 132 N/A
Csrss.exe 160 N/A
Winlogon.exe 180 N/A
Services.exe 208 AppMgmt,Browser,Dhcp,Dmserver,Dnscache,
Eventlog,LanmanServer,LanmanWorkstation,
LmHosts,Messenger,PlugPlay,ProtectedStorage,
Seclogon,TrkWks,W32Time,Wmi
Lsass.exe 220 Netlogon,PolicyAgent,SamSs
Svchost.exe 404 RpcSs
Spoolsv.exe 452 Spooler
Cisvc.exe 544 Cisvc
Svchost.exe 556 EventSystem,Netman,NtmsSvc,RasMan,
SENS,TapiSrv
Regsvc.exe 580 RemoteRegistry
Mstask.exe 596 Schedule
Snmp.exe 660 SNMP
Winmgmt.exe 728 WinMgmt
Explorer.exe 812 N/A
Cmd.exe 1300 N/A
Tasklist.exe 1144 N/A
The registry setting for the two groupings for this example are as follows:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost :
Netsvcs: Reg_Multi_SZ: EventSystem Ias Iprip Irmon Netman Nwsapagent Rasauto Rasman Remoteaccess SENS Sharedaccess Tapisrv Ntmssvc
RApcss :Reg_Multi_SZ: RpcSs </BLOCKQUOTE>

عدد الرسائل : 198 تاريخ التسجيل : 11/11/2006

الكود:: [size=12][color=#0080c0][b]Response Number 20[/b][/color][/size]

[size=9][b]Name: [/b][email]GB[/email][/size]
[size=9][b]Date: [/b]June 12, 2002 at 10:25:45 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>I too have spent many brainstorming hours trying to track this host and it's uses.
I was glad to find this page, for i am not alone in thinking that my pc keeps calling home to the new state of America (microsoft), I dont like it and I will keep on this case untill i am satisfied that i can live without all this host's side kicks. I look forward to hearing more on this subject in this page, keep sniffing hound's.
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|20]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 21[/b][/color][/size]

[size=9][b]Name: [/b]bostonmess[/size]
[size=9][b]Date: [/b]June 14, 2002 at 11:23:57 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>check this. i've also wondered about these win32 services, svchost.exe. i ended up realising that you cannot tconnect to the net without allowing it in zonealarm. but b ing a quizzical git i decided to disable them in task manager. as some1 mentioned there r at least 4 of them and this stands 4 me 2. i disabled 3 and discovered that disabling 1 (the 1 around 3000k under username system) caused the pc to shut down as it closed the remote call procedure (wtf that is?) neway these other processes start up again. but they dont show up on my zonealarm as connected to the net. around this time some strange things happen, the taskbar flickers and sometimes changes colour to grey, also if I have it set at double size it goes to the default size. I dont know why all this happens (at 1st I thought it was a hack or something) but the strange thing is even though these win32 services are not shown on zonealarm I can still connect to the net with ie6? weird eh?
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|21]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 22[/b][/color][/size]

[size=9][b]Name: [/b]IDIOT_SAVANT_i4[/size]
[size=9][b]Date: [/b]June 16, 2002 at 19:17:37 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>I never have figured out wtf this is for ,after a year of ZA 2.63 I just block ALL server requests EXCEPT when I need to send a file through Yahoo!? servers. When you use Yahoo!? file send ,you end up loading the file to a temp address instead of sending it direct but the intended recipient still gets an address to d/l it from so whatdahey!,who needs servers anyway? I never have a problem connecting to the internet with it blocked but it does slow the loading of web pages considerably. IE6 has some of the phone-home features that Billy Goats and da boyz are so fond of in XP (I think),I sure seem to lose a lot of stuff, with every critical upgrade from MS I seem to lose 1 program. If this keeps up long enough ,all 80 of the proggy's on mah box will be gone,hehehehe :-) (save me a lot of housecleaning) :-))
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|22]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 23[/b][/color][/size]

[size=9][b]Name: [/b][email]DS[/email][/size]
[size=9][b]Date: [/b]June 18, 2002 at 20:53:39 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>The svchost.exe file tries to connect on my computer too. Thanks everyone for letting me know I am not alone on this. It has been driving me nuts and has wasted many hours of my time. I also have a file called rundll32.exe that wants to surf the internet also. Would this be a built-in XP feature too?

</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|23]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 24[/b][/color][/size]

[size=9][b]Name: [/b][email]Eduin[/email][/size]
[size=9][b]Date: [/b]June 25, 2002 at 11:25:03 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>My system was trying to connect to 239.255.255.250. Using IP Atlas, I found that this address is located at Marina Del Rey, California, United States.
Check it at:
http://www.xpenguin.com/plot.php?address=239.255.255.250
Additionally, my Tiny Firewall reports this suspectous connection:
Application: 'Tcpip Kernel Driver'; protocol: [2]; Remote address IGMP.MCAST.NET [224.0.0.22]: Unknown event
tcpip kernel driver
http://www.xpenguin.com/plot.php?address=224.0.0.22
This address is located at the same place...
Who is spying me?

</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|24]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 25[/b][/color][/size]

[size=9][b]Name: [/b][email]khooroos[/email][/size]
[size=9][b]Date: [/b]June 28, 2002 at 06:57:10 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>it's a broad cast message
check out the PDF for learning about the IP's and terms
http://systems.cs.colorado.edu/grunwald/NetworksResources/Slides-stevens-tcpipv1/stevens-chap12-cast.PDF
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|25]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 26[/b][/color][/size]

[size=9][b]Name: [/b][email]riz[/email][/size]
[size=9][b]Date: [/b]July 01, 2002 at 11:38:57 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>Hi everyone...interesting reading...i have spent some time sniffing around xp and using various softwear on my system including z/a pro...an easy answer to this win32 process is installing sygate...i have blocked its access from day 1 and left it to remind me when it trys to access and as time goes by it kind of leaves you alone apart from at connections...i can still browse and use ftp's and so on with no problem while this process is denied access...i am using sygate pro and must admit i have not tried standard version...if you would like pro then mail me and i will send you details....dalentrace@msn.com
regards....riz
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|26]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 27[/b][/color][/size]

[size=9][b]Name: [/b][email]stebe[/email][/size]
[size=9][b]Date: [/b]July 02, 2002 at 21:09:12 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>Blocking it on my machine didn't stop me from connecting to this website.
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|27]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 28[/b][/color][/size]

[size=9][b]Name: [/b][email]Shahrouz[/email][/size]
[size=9][b]Date: [/b]July 05, 2002 at 02:52:49 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>After installing Norton Antivirus 2002, Zonealarm pro asked me if I want to grant access to Norton Antivirus Agent to access internet. When I clicked "More Information", Zonealarm pro told me that I must grant internet access to "Generic Host Process for Win32 Services". Zone alarm also told me the following:
"Generic Host Process for Win32 is the Microsoft Windows component your browser uses to perform DNS lookups"
I took a screen shot of my desktop when the said messages appeared on my desktop. If you want to see, just give me a mail.

</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|28]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 29[/b][/color][/size]

[size=9][b]Name: [/b][email]Anders[/email][/size]
[size=9][b]Date: [/b]July 06, 2002 at 04:00:38 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>I have Zone Alarm Pro 2.6.231 (no idea if this is up to date?) and Win2000 Pro with SP2 and pretty much most of the ?critical? updates since it?s release. I have denied all access by GHP for Win32 and have had no problems access in Internet. In fact (and maybe it?s psychological) after installing Zone Alarm and denying all access for GHP4Win32 my Internet connection seems much faster. However if I deny access for ?Services and Control App? (5.00.2195.2780 ? are these version numbers or something?) then I get no Internet access. Anyone know what this app is doing? I think it?s supposed to be there, but then Mr T Horse isn?t going to call it?s self ?Bad Trojan Horse App for Win32? I guess.
After reading response number 19 (by Bill) I tried typing tasklist on the CMD window and it says it?s not a recognised command, do I need to be in a specific directory to run this?
I?m no windows expert and after following Bill?s registry instructions was certainly interested by the BITSgroup, which transfers files in the background using idle network bandwidth. Now I guess this is what allows things like MSN messenger to work. Could this also allow your comp to be used as say some part of a peer-to-peer network even when you don?t want to be? E.g. don?t they need comps for routing and stuff? Could this explain why my connection seems faster?
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|29]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 30[/b][/color][/size]

[size=9][b]Name: [/b][email]milvoNZ[/email][/size]
[size=9][b]Date: [/b]July 07, 2002 at 20:40:43 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>Microsoft has a Knowledge Base article (Q250320) that explains what svchost.exe does. Hope this helps.
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|31]Report Offensive Follow Up For Removal[/url][/size]

[size=12][color=#0080c0][b]Response Number 31[/b][/color][/size]

[size=9][b]Name: [/b][email]Hehe[/email][/size]
[size=9][b]Date: [/b]July 13, 2002 at 05:17:58 Pacific[/size]
[size=9][b]Subject: [/b]Generic Host Process for Win32 Services[/size]

[size=9][b]Reply: [/b][/size]
<BLOCKQUOTE>If you try to go to Administrative Tools->Services and try to see some services that might be running, you will see that its just an svchost.exe is running with different parameters. You might want to disable them (like the Remote Procedure Call or others you don't need) in order to reduce number of svchost.exe processes running.
</BLOCKQUOTE>[url=][/url]
[size=7][url=http://www.computing.net/cgi-bin/report.pl/security/wwwboard/forum/272.html|32]Report Offensive Follow Up For Removal[/url][/size]