• Should Firewall "Allow" Generic Host Process for Win32?

    From corky@here.now.com@21:1/5 to All on Wed Nov 2 04:19:28 2022
    My Sygate 5.6 firewall is "allowing" Generic Host Process for Win32.
    Is this the correct setting? I have no idea what the "Process" is,
    nor do I really care. I just noticed it while resetting a few other
    simpler settings in Sygate.

    I checked with GRC.com. All my XP ports are Stealth - for what that's
    worth. I do run the simpler XP firewall at the same time as the
    Sygate.

    I caused a few problems with my firewall, that's why I was drubbing
    around inside it. I had to straighten a few things out.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul@21:1/5 to corky@here.now.com on Wed Nov 2 06:41:23 2022
    On 11/2/2022 6:19 AM, corky@here.now.com wrote:
    My Sygate 5.6 firewall is "allowing" Generic Host Process for Win32.
    Is this the correct setting? I have no idea what the "Process" is,
    nor do I really care. I just noticed it while resetting a few other
    simpler settings in Sygate.

    I checked with GRC.com. All my XP ports are Stealth - for what that's
    worth. I do run the simpler XP firewall at the same time as the
    Sygate.

    I caused a few problems with my firewall, that's why I was drubbing
    around inside it. I had to straighten a few things out.


    When you run Firefox, it is listed as Firefox in Task Manager.

    If the OS uses "rundll" to operate a DLL, then the Task Manager
    displays "rundll" instead of the name of the DLL itself. This might
    make it harder for an outgoing firewall to determine whether
    it needs to be blocked or not.

    A "svchost" might be more of what they had in mind. A svchost can
    host sixteen items, and some of those items could be network-oriented.

    On WinXP Pro, you can use "tasklist /svc" to see the names of the
    entries inside a svchost. A tool such as Sysinternals Process Explorer,
    when you run it as administrator, can also ferret out the details
    of a svchost.

    Paul

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From corky@here.now.com@21:1/5 to corky@mulkins.org on Wed Nov 2 07:14:56 2022
    On Wed, 02 Nov 2022 06:40:16 -0600, corky@mulkins.org wrote:

    On Wed, 2 Nov 2022 06:41:23 -0400, Paul <nospam@needed.invalid> wrote:

    On 11/2/2022 6:19 AM, corky@here.now.com wrote:
    My Sygate 5.6 firewall is "allowing" Generic Host Process for Win32.
    Is this the correct setting? I have no idea what the "Process" is,
    nor do I really care. I just noticed it while resetting a few other
    simpler settings in Sygate.

    I checked with GRC.com. All my XP ports are Stealth - for what that's
    worth. I do run the simpler XP firewall at the same time as the
    Sygate.

    I caused a few problems with my firewall, that's why I was drubbing
    around inside it. I had to straighten a few things out.


    When you run Firefox, it is listed as Firefox in Task Manager.

    If the OS uses "rundll" to operate a DLL, then the Task Manager
    displays "rundll" instead of the name of the DLL itself. This might
    make it harder for an outgoing firewall to determine whether
    it needs to be blocked or not.

    A "svchost" might be more of what they had in mind. A svchost can
    host sixteen items, and some of those items could be network-oriented.

    On WinXP Pro, you can use "tasklist /svc" to see the names of the
    entries inside a svchost. A tool such as Sysinternals Process Explorer, >>when you run it as administrator, can also ferret out the details
    of a svchost.

    Paul

    Well, the thing was marked "Ask", and since I never remember that
    process asking for "Allowance" at any time, I blocked it. So far, it
    ain't complaining.

    Don't even get into that svchost stuff. Sygate's full of those. I
    don't even want to look them up to see what they are.

    By now, you're probably asking yourself, if he doesn't know nor care
    what most of that crapola is, why is he screwing with it? You're
    right. I've been asking myself that for the last few hours.

    Well -

    The Service Host process (svchost.exe) is a shell for loading services
    from DLL files. Services are organized into groups, and each group is
    run inside a different instance of the Service Host Process. There are
    usually many instances of svchost.exe running because Windows requires
    numerous services to operate correctly.

    Page explaining it even in more detail:

    What Is the Service Host Process (svchost.exe) and Why Are So Many
    Running?

    https://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

    Walter Glenn @wjglenn | ? Reviewed By Nick Lewis

    Updated Oct 21, 2022, 10:18 am EDT | 4 min read

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From corky@mulkins.org@21:1/5 to Paul on Wed Nov 2 06:40:16 2022
    On Wed, 2 Nov 2022 06:41:23 -0400, Paul <nospam@needed.invalid> wrote:

    On 11/2/2022 6:19 AM, corky@here.now.com wrote:
    My Sygate 5.6 firewall is "allowing" Generic Host Process for Win32.
    Is this the correct setting? I have no idea what the "Process" is,
    nor do I really care. I just noticed it while resetting a few other
    simpler settings in Sygate.

    I checked with GRC.com. All my XP ports are Stealth - for what that's
    worth. I do run the simpler XP firewall at the same time as the
    Sygate.

    I caused a few problems with my firewall, that's why I was drubbing
    around inside it. I had to straighten a few things out.


    When you run Firefox, it is listed as Firefox in Task Manager.

    If the OS uses "rundll" to operate a DLL, then the Task Manager
    displays "rundll" instead of the name of the DLL itself. This might
    make it harder for an outgoing firewall to determine whether
    it needs to be blocked or not.

    A "svchost" might be more of what they had in mind. A svchost can
    host sixteen items, and some of those items could be network-oriented.

    On WinXP Pro, you can use "tasklist /svc" to see the names of the
    entries inside a svchost. A tool such as Sysinternals Process Explorer,
    when you run it as administrator, can also ferret out the details
    of a svchost.

    Paul

    Well, the thing was marked "Ask", and since I never remember that
    process asking for "Allowance" at any time, I blocked it. So far, it
    ain't complaining.

    Don't even get into that svchost stuff. Sygate's full of those. I
    don't even want to look them up to see what they are.

    By now, you're probably asking yourself, if he doesn't know nor care
    what most of that crapola is, why is he screwing with it? You're
    right. I've been asking myself that for the last few hours.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Mayayana@21:1/5 to corky@here.now.com on Wed Nov 2 08:25:51 2022
    <corky@here.now.com> wrote

    | My Sygate 5.6 firewall is "allowing" Generic Host Process for Win32.
    | Is this the correct setting? I have no idea what the "Process" is,
    | nor do I really care.

    If you don't care then why worry? I don't let it through.
    But somethings, like DHCP, require it. So you have to be
    able to do without those items. In the case of DHCP it means
    using a fixed IP address. Fortunealy, on XP there are only a
    handful of services that are actually needed by most people.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From corky@here.now.com@21:1/5 to corky@here.now.com on Wed Nov 2 07:31:46 2022
    On Wed, 02 Nov 2022 07:14:56 -0600, corky@here.now.com wrote:

    On Wed, 02 Nov 2022 06:40:16 -0600, corky@mulkins.org wrote:

    On Wed, 2 Nov 2022 06:41:23 -0400, Paul <nospam@needed.invalid> wrote:

    On 11/2/2022 6:19 AM, corky@here.now.com wrote:
    My Sygate 5.6 firewall is "allowing" Generic Host Process for Win32.
    Is this the correct setting? I have no idea what the "Process" is,
    nor do I really care. I just noticed it while resetting a few other
    simpler settings in Sygate.

    I checked with GRC.com. All my XP ports are Stealth - for what that's >>>> worth. I do run the simpler XP firewall at the same time as the
    Sygate.

    I caused a few problems with my firewall, that's why I was drubbing
    around inside it. I had to straighten a few things out.


    When you run Firefox, it is listed as Firefox in Task Manager.

    If the OS uses "rundll" to operate a DLL, then the Task Manager
    displays "rundll" instead of the name of the DLL itself. This might
    make it harder for an outgoing firewall to determine whether
    it needs to be blocked or not.

    A "svchost" might be more of what they had in mind. A svchost can
    host sixteen items, and some of those items could be network-oriented.

    On WinXP Pro, you can use "tasklist /svc" to see the names of the
    entries inside a svchost. A tool such as Sysinternals Process Explorer, >>>when you run it as administrator, can also ferret out the details
    of a svchost.

    Paul

    Well, the thing was marked "Ask", and since I never remember that
    process asking for "Allowance" at any time, I blocked it. So far, it >>ain't complaining.

    Don't even get into that svchost stuff. Sygate's full of those. I
    don't even want to look them up to see what they are.

    By now, you're probably asking yourself, if he doesn't know nor care
    what most of that crapola is, why is he screwing with it? You're
    right. I've been asking myself that for the last few hours.

    Well -

    The Service Host process (svchost.exe) is a shell for loading services
    from DLL files. Services are organized into groups, and each group is
    run inside a different instance of the Service Host Process. There are >usually many instances of svchost.exe running because Windows requires >numerous services to operate correctly.

    Page explaining it even in more detail:

    What Is the Service Host Process (svchost.exe) and Why Are So Many
    Running?

    https://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

    Walter Glenn @wjglenn | ? Reviewed By Nick Lewis

    Updated Oct 21, 2022, 10:18 am EDT | 4 min read

    SVChost Viewer I found here: https://www.softpedia.com/get/System/OS-Enhancements/SVChost-Viewer.shtml#download


    Developer's Description
    By ShoXDK
    Svchost Viewer is a program to see what all those svchost.exe are
    running. The software program scans all svchost processes that are
    currently running on the system and displays them in a tree view. This
    tree view can be expanded to show additional information and the
    services that are run under each svchost entry.
    Windows, Windows XP, Windows Vista, Windows 7
    Additional Requirements Microsoft .NET Framework 2.0

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)