SVCHost.exe want to access the internet?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I've got a brand new laptop.
I've got Symmantec firewall running.

I've had a popup asking saying SVCHost.exe wants to contact the
The message also says it's low risk.
Should I allow this?

Previously... the wirless connection to the net just WOULD NOT work!!
The laptop has been replaced.
The first time I got this message... I can't remember what I set the
permission to.
(Could this have been the cause of my internet connection going?)

Any help would be appreciated.



Re: SVCHost.exe want to access the internet?

Quoted text here. Click to load it

I get these from time to time as well.  I assume they're API calls for
host name resolution.  I haven't determined exactly what triggers
them, but I'd concur wiht the tool's assessment of low risk, normal

Todd H. /

Re: SVCHost.exe want to access the internet?

Hash: SHA1

OM wrote:
Quoted text here. Click to load it

svchost.exe is also known as the "Generic Host Process for Win32 Services",
which might not make sense at first read :-)

A program can run in a way that's called a "service". A service typically
provides some sort of functionality that's always on whatever user is
logged on and even if no-one is logged on. One example would be Windows
XP's Firewall service; this is a program that's always running to help
protect the computer's network connections.

Depending on how a service is set up, it is sometimes run inside the
Generic Host Process, so instead of seeing, for example, "myapp.exe" you
would see svchost.exe. This is also why you'll often see many svchost.exe's

Likewise, if the program wanted to connect to the Internet (say to update
itself or provide some sort of Internet functionality) you would see
svchost.exe trying to connect.

Although pretending to be svchost.exe (or variants like scvhost) is a
fairly common method used by viruses to hide themselves, as long as you
have a clean system it would be safe to allow svchost.exe to access the

If you're curious what's running under the Generic Host Processes, go to
Start->Run and type in: cmd
Press OK. In the command window, type: tlist /s
This will show a list of the running programs, and in each of the
svchost.exe entries you'll see the names of the programs running under the
Generic Host Process.

Quoted text here. Click to load it

You should be able to find what permission you gave svchost.exe in the
firewall's settings (consult the documentation on where to find it).
Although I can't say I've come across an Internet connection problem caused
by svchost.exe being blocked, I think it would be a possibility.

Hope this answers your questions!

Adam Piggott, Proprietor, Proactive Services (Computing). /

Please replace dot invalid with dot uk to email me.
Apply personally for PGP public key.
Version: GnuPG v1.4.2 (MingW32)


Re: SVCHost.exe want to access the internet?

adam... that was really useful.
thanks for the reply.

Re: SVCHost.exe want to access the internet? says...
Quoted text here. Click to load it
**************** REPLY SEPARATER ******************
SVCHOST.EXE is a service that Microsoft uses to interface to .DLL files. There
can be many actual services connected under one SVCHOST, and that makes it an
ideal location to hide malware. Most of Microsoft's networking functions are
connected in this manner, so activity is to be expected. You can use the
command "tasklist /svc" to display the actual services connected under
SVCHOST.EXE. For example, the following are active on my XP:

SVCHOST.EXE                 1968 RpcSs
SVCHOST.EXE                 1048 Dnscache
SVCHOST.EXE                 1084 LmHosts
SVCHOST.EXE                 1140 AudioSrv, CryptSvc, lanmanserver,
                                 lanmanworkstation, Netman, RasMan,
                                 ShellHWDetection, TapiSrv, w32time, winmgmt
SVCHOST.EXE                 2788 stisvc

J.A. Coutts

Site Timeline