Generic Host Process for win32 services...where does it connect?

[newbie~wan]

This has been asked before, but I don't remember the thread goin anywhere, so I'm asking this time and providing a little info.

I checked out the IP that it tries to connect to. It's registered to the IANA - Intenet Assigned Numbers Authority.

What exactly is this connection trying to establish? I've always let it through, but what would happen if I didn't? I think I'll try telling it no and see what happens.

[newbie~wan]

So I tried telling this app "no - u cant access the interent", and it proceeded to consume massive quantities of my cpu cycles for a few minutes until I finally let it through firewall.

what a shock, after that cpu usage back around zip.
Good 'ol M$; "IF I cant spy on you, I will render you computer useless.....MUAHAHAHAHAHA!"

[newbie~wan]

Isnt anyone besides me curious what this process is doing?

I looked around the MS site for a while, but I dont think I was doing it in a productive manner, because I didnt feel like I was getting anywhere.
Imagine that though, its hard to find out what these unknown processes do.

[Graham]

I installed ZA on win XP last night and got the same request, I was going to post about it but you beat me to it.
The address that was stated was in my ISP's range (213) and it said DNS after it. I would like to know what it is too.

G

[BFlurie]

Are your network protocols searching for a DNS server? Many types of connections don't need DNS lookup enabled.

[LeGitan]

I think I may have an idea about this one. It just occured to me after reading the posts and I am going to give it a try. I think it has to do with the WindowsXP TCP/IP protocol. In Win98 you could disable DNS but the XP does not have that feature. I have just removed the DNS entries and will see about that, but I think this may have something to do with it. As for it asking for server rights, this I am not sure about. If anyone else has some input on this it would be appreciatted.

Ken

[IRQ Conflict]

Hey guy's! found this thread after searching for the answer on Google! God bless Google! hehe anyway, apparently this is a tcp/ip sharing service that has been a part of Win 2000 for years and I think is required for running some servers....not sure though check this out! :

"No, there is nothing wrong with svchost and it has been part of Windows 2000 for years. It is actually a service for running (hosting) a variety of programs." You can read about it here:

http://support.microsoft.com/directo...;en-us;Q314056

[Win2k okay but]

Out of annoyance I told this process "no" for a long time; it made the boot process a bit slower. Made no perceptible difference in performance when I told it "sure, go ahead." I just checked the link in the above message and found, for Win2K:

"To view the list of services that are running in Svchost: On the Start menu, click Run , and type CMD, type tlist -s
"Tlist displays a list of active processes. The -s switch shows the list of active services in each process. For futher information on the process type tlist pid ."

But typing "cmd tlist -s" in the Run window got only a plain DOS box.

I mention it here because (1) it is a native Win2K program used, according to MS, to access or run Windows processes, so it's not a trojan in its MS form; and (2) it is such a wonderful MS answer - it may be technically correct but it doesn't impart any useful information. "Hey buddy, where are we?" "About 150 feet up in a helicopter." "Okay, this must be a Microsoft building."

[DVNT1]

Get TLIST (along with a few other tools) here...

http://download.microsoft.com/downlo.../UMDHTOOLS.exe

[Mortis]

Greetings... I have wondered and asked this before... I am still not sure what it is, however- If I deny it access to server rights, all is good. If I deny it permission to access the net, I can not connect to the internet. I have cable so the above statements about it having to do with network information would then make sense. If anyone else has more info- that would be great!

Mortis