What Am I Seeing Here?

Mortis · January 2nd, 2002, 09:40 PM

Greetings. First off, couldnt decide whether this should go here or at the "Networking and Internet" forum... then decided this made more sense.

Ok, on to the questions. I am running Windows XP and have Zone Alarm Pro. Under programs listed as active, I see:

1. Generic Host Process for Win32... I have this enable to connect, but not act as server.

2. Norton Anti Virus Utilities... I have enable to conncect for email auto-protect but not to act as a server.

3. Norton Anti Virus Alert Service I have disabled in both connect and to act as a server.

Now, I have #3 denied permission in all ways but it is listed as listening to port TCP 1030 UDP: 1031. What does this mean? I have seen other programs do this such as Win32 services listening to port UDP: 1038. What is occurring here? What does listening mean.

Also, I have seen random processes running like "process 908" and "process 964." What is this?

I have tweaked and disable many features in XP but am still learning. Can anyone enlighten me? I would greatly appreciate it. I will buy ya lunch... hehe.

Thanks,
Mortis

Mortis · January 3rd, 2002, 12:41 PM

Bump

Mortis · January 5th, 2002, 01:11 AM

Alright... how about this then: How do close a listening port. I checked at ZoneLabs.com and from google and seem to only find definitions and explanations. I understand that a program listed as listening to a port is waiting for a connection. When I run netstat /an, netstat -a... I have six listening proggies. How do I change the status from listening to closed? Or am I wasting my time? Again, I have windows XP home and ZA Pro.

Mortis

Germ · January 5th, 2002, 08:45 AM

http://www.xp-antispy.de/

Nice little freeware app to disable a lot of things you don't need in XP.

Germ

Mortis · January 5th, 2002, 05:46 PM

Thanks Germ... I posted that a couple of weeks ago... hehe.

Thanks,
Mortis

jameson_uk · June 6th, 2002, 02:50 PM

Quote:

Also, I have seen random processes running like "process 908" and "process 964." What is this?

can answer this part, this is referring to the process identifier (PID). If you get into Task Manager, you may need to go View | Select columns and tick PID if this is not showing.

This got me for quite a while too. Turns out that most of these random processes were SVCHOST.exe.

diabling services such as uPnP and SSDP stops this trying to connect to the net so much

storm2k · June 6th, 2002, 03:04 PM

nav needs to act as a server to check your email for viruses... basically it acts like a mini server in itself, it connects to your mail server via pop or imap, checks the mail and forwards back on.

i believe this changed in nav2k2, but i'm not sure... never thought about it... that's how it worked in the old versions anyway.

jameson_uk · June 6th, 2002, 03:26 PM

NAV seems to always be displayed as NAV in Zone Alarm.

The thing where it displays the program as "proces xxx" seems to be to do with SVCHOST.EXE (generic host process for Win32 process)

This covers just about anything that connects to the net via a DLL. This includes many of the windows services (such as the facility to automatically syncronise the clock with a net server)