Generic Host Process for Win32 "listening" on port 5000?

Discussion in 'other firewalls' started by roark37, Jun 29, 2006.

Thread Status:
Not open for further replies.
  1. roark37

    roark37 Registered Member

    Joined:
    May 23, 2006
    Posts:
    190
    Using Zone Alarm Free, last I week I added my DHCP server to the trusted zone to solve some problems I was having. I was getting constant alerts that seemed to be communications between my router and pc and also my pc could not get internet access upon wakeup after being put in sleep mode. From researching these problems the recommendation was to add the DHCP server to the trusted zone for both these issues and it does seem to have solved both problems. My question is now that the DHCP server has been added to the trusted zone, in the Zone Alarm overview section in the top right where it has the icons for open programs, I have 3 for Generic Host Process for Win 32 service. The last one on the far right says "Listening to port TCP:5000(trusted zone only)" if you hold the mouse under it. Is that both normal and safe? Does anyone else get this message about "listening" using Zone Alarm or any other firewall? And does this expose you in any way or pose any security risk? And if so, what can be done to fix it or make it more secure?

    Thank you.

    roark37
     
  2. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    Hi,
    Port 5000 will be uPnP

    EDIT:
    I have been re-reading your post.
    Which DHCP IP have you entered into your safe zone? Is this your ISP (Internet Service Provider) DHCP? or your router IP? (as it should be).
    Does your router support uPnP?
     
    Last edited: Jun 30, 2006
  3. roark37

    roark37 Registered Member

    Joined:
    May 23, 2006
    Posts:
    190
    Thanks Stem. The link you provided had the information I needed to fix this.(I think) I was confused because before posting I had found out that Upnp was tied to port 5000 but when I went to disable Upnp it was already disabled. The link you provided had information regarding the connection between port 5000 & port 1900. Port 1900 is tied to Messenger so I disabled that(which had been on) and since I have done so no more "listening" from Generic Host Process for Win32 so I am assuming that was the problem.

    Also, to answer your question I had added my router ip as the DHCP server which I had thought and you seem to agree, was correct.

    Thanks again for your help. Appreciate it.

    roark37
     
  4. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    Your Welcome,
    I am glad the link helped.

    Stem
     
  5. roark37

    roark37 Registered Member

    Joined:
    May 23, 2006
    Posts:
    190
    It looks like I spoke too soon and now I am more confused than ever. I disabled Messenger manually and disabled it at startup. That caused the "listening" message to disappear in Zone Alarm Free so I though the problem solved. When I rebooted today though I am getting constant alerts in ZA that "Messenger is trying to access the trusted zone". Additionally the "listening" to port 5000" is back. Messenger is disabled and I also downloaded the "shootthemessenger" application from grc.com and it confirms Messenger disabled so I can't figure out why I keep getting the alerts it is trying to access the trusted zone. I also don't understand how when I first disabled Messenger the "listening to port 5000 went away and now after a reboot is back. Has anyone else had any issue like this? I would appreciate any advice or recommendations. Also, I did log into the router and confirmed that Upnp is disabled.

    Thank you.

    roark37
     
  6. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,751
    Location:
    Texas
    Look for the Messenger folder in Program files and rename the folder MessengerDisabled. See if that helps.
     
  7. Stem

    Stem Firewall Expert

    Joined:
    Oct 5, 2005
    Posts:
    4,948
    Location:
    UK
    Hi roark37,
    Take a look at WWDC (this will close the port 5000 for you (and others if needed))
     
  8. roark37

    roark37 Registered Member

    Joined:
    May 23, 2006
    Posts:
    190
    Thanks Ronjor and Stem for the recommendations. After another reboot the problem went away again. Although I had manually disabled Messenger I did run shootthemessenger from grc.com in between reboots so I may have missed something manually and the application took care of it.

    Thanks again though for your help.

    roark37
     
Loading...
Thread Status:
Not open for further replies.