Incoming Connection Alert (Internet)

[dreamworks]

Hi guys ...

I keep getting this alert above stating that "Generic Host Process for Win32 Services.

Remote point: 202.190.131.251, port 3568.

Should I allow it? I clicked on deny but it pops up every now and then and I think its coming from my ISP??

Also getting from Remote point: wbb251.fwa4.jaring.my on the same port.

Is this a "message" from the ISP itself?

 

[xtweaker]

According to this whois site http://www.whois.sc/202.190.131.251 that IP is from Malaysia... If your ISP is not from there as I assume, don't allow it.

 

[dreamworks]

Thanks bro .. but what does Generic Host Process for Win32 Services does?

 

[xtweaker]

From this site: http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/

svchost.exe is a system process belonging to the Microsoft Windows Operating System which handles processes executed from DLLs. This program is important for the stable and secure running of your computer and should not be terminated. Note: svchost.exe is a process which is registered as the W32.Welchia.Worm. It takes advantage of the Windows LSASS vulnerability, which creates a buffer overflow and instigates your computer to shut down. To see more information about this vulnerability please look at the following Microsoft bulletin: http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx This is a registered security risk and should be removed immediately. Please see additional details regarding this process

ETID: This is actually much better. Check this out: http://support.microsoft.com/?kbid=314056

 

[LeeJend]

In short someone in Malaysia is trying to hack into your PC. Do not allow it and report the attempt to your ISP so they can block the Malaysian site.

 

[dreamworks]

R u sure about this LeeJend?

Cause it seems to be coming from the ISP itself???

 

[Lee]

It's inbound and it's recommended to allow by my firewall.

 

[xtweaker]

Well, even though the reverse IP whois is pretty obvious, and the trace route that I did to find that out was pretty obvious too, the last thing to do is contact your ISP's abuse department and ask them plain and simple.