Incoming Connection Alert

by bently Dec 9, 2005 7:19AM PST

Using XP home, sp2, Mozilla 1.7.13, Kerio firewall, AVG

Got this alert several times, I did NOT allow, not knowing if good or bad.

How in the world is the average user to know what should be allowed. If it is something I just initiated, I normally allow, if not, when in doubt I disallow.

Can anyone explain if the following is good or bad.
INCOMING CONNECTION ALERT!

Someone from 221.208.208.4, port 43233 - UDP
wants to send a UDP datagram to port 1026 owned by :Generic Hosp Process for Win32 Services: in your computer.

DETAILS ABOUT APPLICATION
c\windows\syster32\svhost.exe

Thanks

Ben

Discussion is locked

- Collapse -

Hi Ben

by Marianna Schmudlach Dec 9, 2005 7:24AM PST

Unfortunately I have NO idea about Kerio - but have a look here:

http://www.kerio.com/manual/kpf/en/ch07s02.html

HTH

- Collapse -

Deny

by Alphalutra1 Dec 9, 2005 8:41AM PST

As a Kerio user for a while(I am still using 2.1.5), I would deny this. SVCHOST(Generic Host Process for Win32) should never receive incoming connections. The only time it should access the internetis for outbound communication for DNS servers, DHCP, and for windows update. Besides this, SVChost should not be allowed to access the internet.

T. Ward

- Collapse -

Create rule

by dawillie Dec 9, 2005 10:12AM PST

as a Kerio v 2.1.5 user, you will also have the option of creating a rule everytime you 'deny'.

You should do so particularly for System 32 in bound.

I have a rather expansive rule set you can have if you like.

Of particualr interest should be the 'deny' rules.

Email me if you like and I will be pleased to send them to you.

David Williams

- Collapse -

I denied...

by bently Dec 9, 2005 2:25PM PST

and after you comfirmed it, glad I did.

Thanks to all, when in doubt, I deny.

Ben

Incoming Connection Alert

CNET Forums

Other Forums

Forum Info