services.exe and firewalls

  • Thread starter Thread starter Tim Greenway
  • Start date Start date
T

Tim Greenway

I have sygate personnal firewall on my machine. For the
past 3 days now, services.exe has been trying to "get out"
and communicate on the web. At this point, services.exe
is blocked and is not allowed. As this has just started
to happen, I am quite suspicious.

Should I allow services.exe access to the internet? Can
you suggest anything that maybe wrong?

Thank you, in advance, for your help!

Tim Greenway
 
In
Tim Greenway said:
I have sygate personnal firewall on my machine. For the
past 3 days now, services.exe has been trying to "get out"
and communicate on the web. At this point, services.exe
is blocked and is not allowed. As this has just started
to happen, I am quite suspicious.

Should I allow services.exe access to the internet? Can
you suggest anything that maybe wrong?

Thank you, in advance, for your help!

Tim Greenway
Click to expand...

perhaps not as up to date as you think ? Is it port 135 thats
trying to "get out"?

http://www.europe.f-secure.com/v-descs/msblast.shtml

although the removal tool link is incorrect ... it should be

ftp://ftp.f-secure.com/anti-virus/tools/F-Lovsan.zip
 
In
Tim Greenway said:
Steve/Jim:

Probably not that uptodate as you would like. I shall
check the TCPIP ports and alike. From what you have said
it sounds like the blast worm - I thought the firewall
would keep it out - all the test that I have done on the
firewall security indicate the ALL ports were blocked - it
must have to do with the overflow request the worm uses.

Anyway, now I have a clear understanding I shall tackle it
with vigour.

Thank you very much for your help Steve/JIm - its truly
appreciated and greatly received!

Tim
Click to expand...

thanks for the feedback Tim, good luck Steve
 
I have Zone Alarm running on a Win 2000 Pro machine, and it logs attempts by
the services controller to get out ot the Internet all the time. This
machine is not virus infected. Not knowing what purpose it would serve, I
left the application blocked.

JP
 
Back
Top