Firewall rules issue NAV2008

Norton Security | Norton Internet Security
1

Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Sed posuere consectetur est at lobortis. Vestibulum id ligula porta felis euismod semper. Donec ullamcorper nulla non metus auctor fringilla. Aenean lacinia bibendum nulla sed consectetur. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Cras mattis consectetur purus sit amet fermentum. Morbi leo risus, porta ac consectetur ac, vestibulum at eros. Sed posuere consectetur est at lobortis. Etiam porta sem malesuada magna mollis euismod. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis mollis, est non commodo luctus, nisi erat porttitor ligula, eget lacinia odio sem nec elit. Cras justo odio, dapibus ac facilisis in, egestas eget quam. Aenean eu leo quam. Pellentesque ornare sem lacinia quam venenatis vestibulum. Curabitur blandit tempus porttitor. Sed posuere consectetur est at lobortis.

2

svchost is part of Windows. Most likely it was a WIndows application running. Don’t worry about it.

3

Here is a great program to see each process on your pc.

 

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

4

thanks. I understand that svchost.exe is part of windows, but my concern is that it was modified and then in about two hours my firewall allowed connection to my PC via port 3389 without me asking it to do so. Plus I do not have remote service enabled.

 

My main concern is why did the firewall allow connection to an address that is identified as American Brass and Foundary

Message Edited by NY1986 on 09-27-2008 01:10 PM
5

I posted this incorrectly it should read:

 

12:58 PM

Program Name Microsoft Generic Host process for WIN 32 services

risk level low

default action allow

Action taken BLOCK

Local Computer- All network adapters

Traffic: Inbound TCP 3389

 

2:58pm

Program Name Microsoft Generic Host process for WIN 32 services

risk level low

default action allow

Action taken ALLOW

Local Computer- MY PC, 3389

Remote Computer: {removed}, 40190 (this is not a Microsoft or Norton Address)

Traffic: Inbound TCP 3389

 

Sorry all

6

on the svchost.exe being modified at 12:03pm. I do notice that Vista service pack 1 was installed on the same date at 12:30pm. So perhaps that svchost.exe  change and the installation of the service pack are related?