What is WIN 32? Good or Bad?

My norton internet security repeatedly tell me
that "Microsoft Generic Host Process for Win 32" is
trying to access my computor. I run XP. Norton says to
permit, but then warns me of an attempted intusion. I
don't want to block it if it is important. What do I
do? Thanks

Steven
Wed Jan 28 19:30:24 CST 2004

If it is trying to access your ip address as shown by ipconfig /all or
127.0.0.1 from your local computer then it very likely is a legitmate
process. --- Steve


"Larry" <anonymous@discussions.microsoft.com> wrote in message
news:637f01c3e5fa$37a3c410$a401280a@phx.gbl...
> My norton internet security repeatedly tell me
> that "Microsoft Generic Host Process for Win 32" is
> trying to access my computor. I run XP. Norton says to
> permit, but then warns me of an attempted intusion. I
> don't want to block it if it is important. What do I
> do? Thanks
>

S
Thu Jan 29 03:05:58 CST 2004

Namely, svchost.exe. Most likely legit but might be a rootkit, too.
Depending on level of paranoia, further investigation might be required.

--
Svyatoslav Pidgorny, MVP, MCSE
-= F1 is the key =-

"Steven L Umbach" <sumbach@nospam-ameritech.net> wrote in message
news:QmZRb.5618$BA2.4121@newssvr26.news.prodigy.com...
> If it is trying to access your ip address as shown by ipconfig /all or
> 127.0.0.1 from your local computer then it very likely is a legitmate
> process. --- Steve
>
>
> "Larry" <anonymous@discussions.microsoft.com> wrote in message
> news:637f01c3e5fa$37a3c410$a401280a@phx.gbl...
> > My norton internet security repeatedly tell me
> > that "Microsoft Generic Host Process for Win 32" is
> > trying to access my computor. I run XP. Norton says to
> > permit, but then warns me of an attempted intusion. I
> > don't want to block it if it is important. What do I
> > do? Thanks
> >
>
>

Drew
Thu Jan 29 20:13:26 CST 2004

svchost.exe doesn't narrow the search very much. Lots of system services
run under one instance of svchost or another. If you're running XP, do a
"tasklist /svc" in a cmd console and you'll see what I mean. If not XP, we
ship tlist.exe in the resource kit ("tlist -s").

Is there any other info about what it's trying to do?
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


"S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote in message
news:OacsHek5DHA.3308@TK2MSFTNGP11.phx.gbl...
> Namely, svchost.exe. Most likely legit but might be a rootkit, too.
> Depending on level of paranoia, further investigation might be required.
>
> --
> Svyatoslav Pidgorny, MVP, MCSE
> -= F1 is the key =-
>
> "Steven L Umbach" <sumbach@nospam-ameritech.net> wrote in message
> news:QmZRb.5618$BA2.4121@newssvr26.news.prodigy.com...
> > If it is trying to access your ip address as shown by ipconfig /all or
> > 127.0.0.1 from your local computer then it very likely is a legitmate
> > process. --- Steve
> >
> >
> > "Larry" <anonymous@discussions.microsoft.com> wrote in message
> > news:637f01c3e5fa$37a3c410$a401280a@phx.gbl...
> > > My norton internet security repeatedly tell me
> > > that "Microsoft Generic Host Process for Win 32" is
> > > trying to access my computor. I run XP. Norton says to
> > > permit, but then warns me of an attempted intusion. I
> > > don't want to block it if it is important. What do I
> > > do? Thanks
> > >
> >
> >
>
>

Kent
Sun Feb 01 12:07:51 CST 2004

Drew Cooper [MSFT] wrote:

> svchost.exe doesn't narrow the search very much. Lots of system services
> run under one instance of svchost or another. If you're running XP, do a
> "tasklist /svc" in a cmd console and you'll see what I mean.

In other words, it's Microsoft's own native Windows trojan, hiding
network services and making it difficult for users to disable unneeded
ports and services.

--
Kent W. England, Microsoft MVP for Windows Security

S
Mon Feb 02 03:23:47 CST 2004


"Kent W. England [MVP]" <kwe@mvps.org> wrote in message

> In other words, it's Microsoft's own native Windows trojan, hiding
> network services and making it difficult for users to disable unneeded
> ports and services.
>

LOL :)

Drew
Mon Feb 02 18:59:24 CST 2004

Tell me about it! I own some stuff in cryptsvc now. Have any idea how hard
it can be to track down resource abuse (leaking, heap corruption, etc.) when
there are dozens of other services all running in-proc?
:-(
--
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


"Kent W. England [MVP]" <kwe@mvps.org> wrote in message
news:%23IZxO5O6DHA.1936@TK2MSFTNGP12.phx.gbl...
> Drew Cooper [MSFT] wrote:
>
> > svchost.exe doesn't narrow the search very much. Lots of system
services
> > run under one instance of svchost or another. If you're running XP, do
a
> > "tasklist /svc" in a cmd console and you'll see what I mean.
>
> In other words, it's Microsoft's own native Windows trojan, hiding
> network services and making it difficult for users to disable unneeded
> ports and services.
>
> --
> Kent W. England, Microsoft MVP for Windows Security