Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed ForumsSystem AdministrationAntivirus Protection

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
Be the architects of evolution and help create the mobile internet future. It’s your move---enter to win here!
  #1  
Old September 13th, 2004, 03:19 PM
jarra jarra is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Feb 2004
Location: the Netherlands
Posts: 66 jarra User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 52 m 39 sec
Reputation Power: 5
SVCHOST contacted from remote machine

Hi,
I just reinstalled my computer (Win XP) and have this warning popping up in my sygate firewall every few minutes:

"generic host process for win32 services (svchost) is being contacted from a remote machine using local port 135 EPMAP location service dynamically assign ports for RPC do you want to allow this program to access the network"

Before the last re-installation, I allowed it once, after which a file called tftp.exe tried to connect to a remote site 3 times a minute, and sometimes my computer would count down to a restart (as Blaster did).

I reinstalled XP again (Total reinstall),
I downloaded the Microsoft security patches, installed norton antivirus and sygate firewall. But still i'm bothered by this 'remote machine trying to access the network.'
Is it a thing to worry about, what causes it, and how to stop this..?

Thanks for your help,
Jarra
__________________
http://www.jarra.nl

Reply With Quote
  #2  
Old September 14th, 2004, 01:52 PM
babushka99 babushka99 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Sep 2004
Posts: 6 babushka99 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: < 1 sec
Reputation Power: 0
This link will help: http://isc.sans.org//port_details.php?port=135&isc=028cb1441d87f69c476b63671084fa0b

Read the various comment. Many viruses/worms will use Port 135 to connect, so it is a good thing to have this port blocked from the outside. Change your notification in your firewall, etc. so it does NOT notify you whenever a connection is made from the outside.

Reply With Quote
Reply

Viewing: Dev Shed ForumsSystem AdministrationAntivirus Protection > SVCHOST contacted from remote machine


Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 6 hosted by Hostway