0

My Zone Alarm 8 firewall on WXP-SP3 is advising me:

  • svchost.exe (Generic Host Process for Windows 32 services)
  • lsass.exe (LSA Shell (Export version)

both try sometimes to access internet.

Should I allow bothj or one of them to access internet or not??? I Googled about this, but I can't find an answer. YES or NO!

Thanks!

Improve this question
4
  • eh - SP4 ???
    – ChrisF
    Jun 30, 2010 at 9:50
  • No such thing as XP sp4, well not yet anyway.
    – Moab
    Jul 1, 2010 at 2:50
  • LOL if Windows is really telling you you have Service Pack 4, I would say reformat and reinstall.
    – Hello71
    Jul 1, 2010 at 22:56
  • Sorry, I fixed it's WXP-SP3.
    – Marco Demaio
    Jul 8, 2010 at 12:32

1 Answer 1

Reset to default
0

Yes svchost has to access the internet for certain features and software to work.

If you are sure it is Lsass, and not Isass, it is OK to let it access the local network.

Isass is part of the sasser worm.

Improve this answer
2
  • Ho do I know the difference?
    – Marco Demaio
    Jul 8, 2010 at 12:32
  • The sasser worm exploits a vulnerability in Lsass, sorry, its not the file itself. Lsass should be located in the System32 folder, if it is found elsewhere it could be malware masquerading as a system file. If you run virus scans regularly, you are probably ok.
    – Moab
    Jul 8, 2010 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .