sychost.exe trying to connect to internet - help!!

  shazza65 20:33 16 Aug 2007
Locked

I am currently running Comodo firewall and it is still in its learning phase. I keep on getting the following messages:

schost.exe is trying to connect to services.exe with a couple of IP addresses namely

IP:192.168.0.2 port dhcp(68) - UDP and
IP:239.255.255.250 upnp-mcast(190c....

I've found unless I allow these I cannot connect to the internet.

I understand windows needs to connect the internet for stuff and just want to make sure, when I allow these all the time, I wont be jeopordising my computer's safety.

Many thanks

  brundle 21:22 16 Aug 2007

Svchost runs Windows Services, it's not connecting to anything itself per-se. The first sounds like ordinary router/PC communication (DHCP is what assigns your PC an IP address, without which it can't access the internet or be accessed from the internet), the second is the Windows Universal Plug and Play service, it picks up UPNP devices available on a network. You can allow it safely, but it's not needed as a service generally speaking (especially if your PC is not part of a network). To stop the service goto start menu/run, type
services.msc

Press return, scroll down to Universal Plug and Play, right click it, select Properties, click Stop and set it to Manual or Disabled. Reboot if necessary.

  shazza65 22:05 16 Aug 2007

Many thanks for your help, it has put my mind at rest. Just couldn't understand why the firewall gave it a "red" warning, when basically it needed it in the first place!

  roy 23:39 16 Aug 2007

I don't know your firewall but would think that you can 'allow' that action permanently. Have a look at Options or similar in your firewall software. Roy

  Ashrich 00:31 17 Aug 2007

Can you be accurate on the spelling of the software trying to connect , it is important that the word is spelt here correctly is it ...svchost.exe or sychost.exe or schost.exe , the first is a Windows process , the other two are linked to worms/viruses , sychost.exe is the Leox b worm , schost.exe is a mass mailing worm called [email protected] virus .

Ashley

  shazza65 20:46 17 Aug 2007

Well spotted, not only have I spelt the blooming title of the thread wrong, I have spelt it wrong in the description as well!!!! (Message to self - take more note of spelling!!

The application trying to connect to the internet is (no listen very carefully I shall ziss only once - in a crap french accent):

Generic Host Process for Win32 Services is trying to act as a server. What would you like to do?

svchost.exe
remote IP : 80.67.84.17 : http(80) - TCP

svchost.exe
IP : 192.168.0.2 Port : dhcp(68) - UDP

and one other that just wont pop up at mo but it wont pop up at mo.

They all show a security alert rating of red. If I dont Allow or Deny, the alerts go away and then come back again after a while.

  Ashrich 22:57 17 Aug 2007

Whew , just for a moment I thought you were infecting the world ( your PC I meant , not you personally )

Generic Host Processes is fine to tick and allow , as you saw , without it you can't access the internet , when the other one pops up , make a note of it , if it isn't familiar to you , and Google for the name that is trying to connect , you should easily find what it is and whether you can allow it .

Ashley

  shazza65 23:26 17 Aug 2007

Another one put to rest ....... next!

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

Galaxy Note 8 vs iPhone X

The secrets of creating gory VFX

How to update iOS on iPhone or iPad

WhatsApp : comment lire vos messages sans que l’expéditeur le sache