A suggestion and request to the LnS t5eam: When an application or DLL requests permission to go the Internet please have LnS ALSO announce the destination IP. I think this should be possible because ZoneAlarm does it. Today I just installed Win Xp Pro Sp2 on a reformated machine. SVCHOST.EXE requested that WINHTTP.DLL access the internet. Figuring Windows was still unpolluted, I authorized. Then, the shocker: the destination was 18.104.22.168, which belongs to a strange company : Leadon Ltd of London with this rather small authorized IP range: 22.214.171.124 - 126.96.36.199. Why would this particular Windows, sold for and installed in the USA, want to go an obscure place in London? The point is : if the IP is not announced at authorization time, the user who is about to authorize is just gambling. Even if the user traces the connection as I did, it's already too late. Thanks for considering this suggestion.