win2k and winxp question about internet access

Discussion in 'other software & services' started by rayik, Feb 4, 2003.

Thread Status:
Not open for further replies.
  1. rayik

    rayik Registered Member

    Joined:
    Feb 4, 2003
    Posts:
    14
    This is my first post to this forum.

    I use zone alarm pro on 2 different computers (one win2k and the other winxp based). zone alarm prompts you when a program requests internet access.

    I've also been looking at the xp machine closely (since I had a trojan infection recently and ended up reformating the hd and doing a fresh install of xp). I've been using the demo version of DiamondCS Port Explorer. On the xp machine it shows lsass.exe as connected on a socket but as a "hidden process and not a service or system process." Yet on the win2k machine lsass.exe showes up connected on a socket as a system process. Why would it be any different on the xp machine?

    ALso, on the xp machine, the messenger service is disabled. Yet zone alarm asks me if messanger can have permission to access the net as a SERVER. Again is that normal and if so, why?

    Lastly, I've notice that when using the win2k box, zone alarm asks me if i want to allow internet explorer and outlook express to access the internet as a SERVER. Is that normal? If so, why do they need to act like a SERVER on the net (instead of just a normal program)?

    Thanks for any help.
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,312
    Location:
    Netherlands
    Regarding the Port Explorer hidden sockets question, you should read this thread: http://www.wilderssecurity.com/showthread.php?t=6989

    I have a counter-question about messenger. Sometimes the messenger service and MSN Messenger are confused. So I would like to know which one you are referring to?

    The last bit I will leave up to the ZA specialists. ;)

    Regards,

    Pieter
     
  3. rayik

    rayik Registered Member

    Joined:
    Feb 4, 2003
    Posts:
    14
    Thank you for the link. Interesting to read that lsass.exe is probably a false positive.

    I'll search for za posts concerning the requests for server access.

    Thank you for the reply.
     
  4. rayik

    rayik Registered Member

    Joined:
    Feb 4, 2003
    Posts:
    14
    Pieter, sorry forgot to answer your question above. It was asking for server access for MSM messenger. That is not the messenger service I disabled. I guess I confused the two.

    Again, thanks for your response.
     
  5. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    17,842
    Location:
    New England
    Hi rayik,

    I run Zone Alarm Plus on a Windows XP system and occasionally I will get ZA pop-ups asking for server level access rights for programs that clearly don't need to run as a server. Internet Explorer does this the most, but it can happen with almost any program. While I don't have the exact reason for this, I have found a strong pattern to these occurrences...

    On my system, it appears to be related to DNS access problems. If there is any problem resolving DNS when I enter a new URL into IE, then IE somehow adjusts and requests server rights, and if I allow it, IE ends receiving a connection from one of my ISP's DNS servers and I get access to the URL I was going after. However, if I deny server access and just refresh the page in IE, I still end up getting where I wanted to go.

    So it seems that on my XP system, this all appears to be a reaction to a temporary DNS access problem (perhaps even just a timing delay).

    Now, in your case, is the request for server rights happening all the time or just some of the time? If it is every time, then perhaps you could describe your home network set-up, especially as far as how the W2K box accesses the network and resolves DNS. Do you have a LAN? Are you using ICS for network sharing? Are you running the "DNS Client" service on that system?

    Best Wishes,
    LowWaterMark
     
  6. rayik

    rayik Registered Member

    Joined:
    Feb 4, 2003
    Posts:
    14
    LowWaterMark,

    The 2 machines are not connected.

    Thanks for sharing your experiences with programs asking for server access on xp. The xp machine just was reformated and xp reinstalled. I'm reasonably sure it's ok (even going to an extreme of running pcflank's tests on a newly formated and installed os).

    On the XP machine, I've just gone in ZA and selected no server access to the internet for the programs listed (but not the services).

    I've been using 2k daily for about 3 years (work and home). I just started using xp about 1 month ago. It does seem to run a bit different than 2k and I'll just have to learn about it and get used to it.

    Thanks for your response.
     
  7. Coyote

    Coyote Spyware Expert

    Joined:
    Feb 9, 2002
    Posts:
    11
    Location:
    Great Country Of Texas
    there is a very good site by Blackviper at http://www.blackviper.com which goes into some detail about the services and how to setup different profiles to achieve a faster and/or more useful machine depending upon whether you are a gamer or share internet connections and others. I have found his information very useful here.


    http://www.blackviper.com/WinXP/service411.htm

    http://www.blackviper.com/WinXP/servicecfg.htm

    http://www.blackviper.com/WIN2K/servicecfg.htm

    HTH

    Tom Wilson ~ Coyote
    http://TomCoyote.org
     
  8. Tassie_Devils

    Tassie_Devils Global Moderator

    Joined:
    May 8, 2002
    Posts:
    2,514
    Location:
    State Queensland, Australia
    Hi rayik/coyote_tom, welcome to the boards :D

    Rayik, tom has posted great links there [if you have not seen them before] for checking your services.

    As to the 2 OS's being different in terms as to what's running or not, I am curious, because I have JUST started a new thread [which way to go?] in here asking for comments on each OS.

    I am getting a complete new system [the works] and am wondering what OS to install? Current Win2K PRO or XP PRO. I realise this may be a bit off topic to your original post, so you could comment in my thread ;) I would appreciate it, seeing as you run both.

    LowWaterMark also has valuable comments in here so would certainly take his post into consideration :)

    Just my $0.02 worth :cool:


    edit: tried to put a smilie after last par, but my dsylexic fingers typed a ? instead. Go figure, lol
     
Loading...
Thread Status:
Not open for further replies.