PDA

View Full Version : svchost was blocked from accepting a connection ... (ZA Pro), everything's OK?


Eng
December 15th, 2005, 02:31 AM
Hi folks,

Successfully using ZA Pro 6.1.737.000 but have discovered in logs table that "Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (169.254.20.60 Port 2250)." This event occurs repeatedly with other IP (169.254.20.56 Port 2250) as well. Smart Defense has labelled svchost.exe as "system" with access to all except internet in server column. I searched for the above IP and have found out following info:

Search results for: 169.254.20.60

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: ...
City: ...
StateProv: ...
PostalCode: ...
Country: ...

NetRange: 169.254.0.0 - 169.254.255.255
CIDR: 169.254.0.0/16
NetName: LINKLOCAL
NetHandle: NET-169-254-0-0-1
Parent: NET-169-0-0-0-0
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
RegDate: ...
Updated: ...

Can someone explain what's going on. Am I in danger?

Any help is appreciated.

Thanks and regards,
Eng

Mrkvonic
December 15th, 2005, 04:16 PM
Hi,
Blocked is good.
You probably are not in danger.
My firewall(s) have in the past and in still in the present often blocked / block various attempts to connect to ports from outside, mainly spam messages.
If you fear for your system, you can try running scanners.
Did you check your firewall vs grc or sygate port scan test?
If all ports are closed / stealthed you're set.
Mrk

CrazyM
December 17th, 2005, 05:09 PM
-{ Quote: "Successfully using ZA Pro 6.1.737.000 but have discovered in logs table that "Generic Host Process for Win32 Services was blocked from accepting a connection from the Internet (169.254.20.60 Port 2250)." This event occurs repeatedly with other IP (169.254.20.56 Port 2250) as well." }-
Do you have any more log details on protocol and other port/service used?
The IP in question is usually used by systems that do not have an IP assigned or having trouble obtaining an IP.

Regards,

CrazyM