Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My Zone Alarm 8 firewall on WXP-SP3 is advising me:

  • svchost.exe (Generic Host Process for Windows 32 services)
  • lsass.exe (LSA Shell (Export version)

both try sometimes to access internet.

Should I allow bothj or one of them to access internet or not??? I Googled about this, but I can't find an answer. YES or NO!

Thanks!

share|improve this question
    
eh - SP4 ??? –  ChrisF Jun 30 '10 at 9:50
    
No such thing as XP sp4, well not yet anyway. –  Moab Jul 1 '10 at 2:50
    
LOL if Windows is really telling you you have Service Pack 4, I would say reformat and reinstall. –  Hello71 Jul 1 '10 at 22:56
    
Sorry, I fixed it's WXP-SP3. –  Marco Demaio Jul 8 '10 at 12:32

1 Answer 1

Yes svchost has to access the internet for certain features and software to work.

If you are sure it is Lsass, and not Isass, it is OK to let it access the local network.

Isass is part of the sasser worm.

share|improve this answer
    
Ho do I know the difference? –  Marco Demaio Jul 8 '10 at 12:32
    
The sasser worm exploits a vulnerability in Lsass, sorry, its not the file itself. Lsass should be located in the System32 folder, if it is found elsewhere it could be malware masquerading as a system file. If you run virus scans regularly, you are probably ok. –  Moab Jul 8 '10 at 17:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.