Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Zone Alarm 8 firewall on WXP-SP3 is advising me:

  • svchost.exe (Generic Host Process for Windows 32 services)
  • lsass.exe (LSA Shell (Export version)

both try sometimes to access internet.

Should I allow bothj or one of them to access internet or not??? I Googled about this, but I can't find an answer. YES or NO!


share|improve this question
eh - SP4 ??? – ChrisF Jun 30 '10 at 9:50
No such thing as XP sp4, well not yet anyway. – Moab Jul 1 '10 at 2:50
LOL if Windows is really telling you you have Service Pack 4, I would say reformat and reinstall. – Hello71 Jul 1 '10 at 22:56
Sorry, I fixed it's WXP-SP3. – Marco Demaio Jul 8 '10 at 12:32
up vote 0 down vote accepted

Yes svchost has to access the internet for certain features and software to work.

If you are sure it is Lsass, and not Isass, it is OK to let it access the local network.

Isass is part of the sasser worm.

share|improve this answer
Ho do I know the difference? – Marco Demaio Jul 8 '10 at 12:32
The sasser worm exploits a vulnerability in Lsass, sorry, its not the file itself. Lsass should be located in the System32 folder, if it is found elsewhere it could be malware masquerading as a system file. If you run virus scans regularly, you are probably ok. – Moab Jul 8 '10 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .