Newbie Firewall Question

Im a noobie just starting research on security and encyrption, both have interested me for awhile, and now just got a break in work to where I can start to "do my homework" on the two subjects. Im testing 3 firewalls to see which I like the best, ZA pro, sygate, and nortons 2002, testing and seeing which suits my needs just starting out. The question I have is on a few programs from win xp that want to gain access. Application Layer gateway: NT Kernal and system: lsa shell export service: and explorer exe also generic host process. I have allowed and blocked all of those programs and it doesnt seem to matter either way to any programs they all work fine. The question I have is any or all of them spyware for MS and I should def block or those are just the XP proggys for checking for upgrades etc. any help is appr8ted.


Ferret

"Weke Weke"

I'm afraid I don't know as much about XP as I'd like, so I probably can't help you with your problem. I just wanted to stop and tell you that it's nice to see a newbie on the site who:

a) admits that they're a newbie
b) did some research first
c) asked an intellegent and well thought out question

We've had so many of the script kiddies recently, that your post was refreshing. Welcome to AO and I hope that someone else will be able to help you so that you'll stay around.

Quote:

---

The question I have is on a few programs from win xp that want to gain access. Application Layer gateway: NT Kernal and system: lsa shell export service: and explorer exe also generic host process.

---

I am not all that proficient on XP, but if you are concerned of the nature of the program or service running, and want to find out if you want allow or deny its access to the Internet, try these little programs that will make your life a little easier:

Xploiter/Tambu Security

Good Luck and welcome!! :) :)

Be paranoid, XP does phone home.

This may sound paranoid but I'd deny access to anything that I wasn't sure about.
Cheers,
cgkanchi

I say block every thing that doesn’t need internet access. Ask your self questions like why does winamp want to access the internet? Also helps to get adaware (http://www.lavasoftusa.com/) it will find spy ware that your fire wall misses.

O ya never let windows media player access the internet under any circumstances. S P Y W A R E

never can trust those bas**rds can you. aparantly XP is the first step in an internet based anti piracy checking system. but for the time being someone should start on a linux distributuion which can handle games as well as windows and then bill gates will have right up his

Quote:

---

but for the time being someone should start on a linux distributuion which can handle games

---

I agree with you on the need for more commercial apps and games to appear on *NIX systems. I am seeing more and more fairly sophisticated games appear on *NIX, but at the time being, I do not think it is ready for the hardcore gaming industry yet. :D

whackaxe> We've had a discussion about how games working/moving to linux would not impaire the windows sells and distribution. See Here

It's good to have something blocking net access to apps, like what three people above said. cwk9 points out one of the most important points of it, spyware. There's nothing worse then having all your info leak out to corporates like microsoft and others. Also, it's good to monitor things like cookies and so, which also leak out certain things like preferences... especially used for pop-up advertising (doubleclick.com ring a bell?)

The upgrade program has an odd name like msupdate.... not something familiar like explorer..

best bet, to know if you are blocking the update program, block everything and try to update, a pop-up should appear from ZA and the other apps, asking for access. If not, then unblock on thing at a time until something connects for the update. If the update works, and you blocked all those apps you named, keep em' blocked...

What kills me is that a lot of games are actually written in linux and then ported to Windows. They just never release them in linux because it's not generally profitable for them. There's one that makes games for linux though - Loki games. Visit them at:
www.lokigames.com

Edit: ACK!!! I just went to check and make sure they were still there and they've closed their doors.

Thank you very much guys for replying, I searching the net for each file to try and determine wheather its spyware or a legit service for driver upgrade check etc. I know MS phones home and Im trying to figure out where and thru what programs it does so I can block those, I still dont understand why Explorer.Exe needs to access the net. But Im hunting the reason, just havent found it yet. I have lavasoft on my sys but I also have kazza and so I have to leave some spyware on sys to keep kazza up and running correctly. As far as the 4-5 files that Im not sure about Ive blocked and unblocked and everything seems to run fine so Im just going to leave em Blocked for now. Thanks to everyone that posted for the nice welcome and the help that you did provide.

Kudos

Ferret
"Weke Weke"

Thanks for the link, str34m3r... I might order a game or two to try it out :) :)

I thought that there was a linux/windows distro that was being made called Lindows©

yes, but every who's beta-tested lindows (they had to pay $100 to do it!) has said it's a good idea but needs A LOT of work.

As for your firewalls I'd go with ZA Pro, but thats just me. Everyone has their own needs, but I like the way that you know exactly whats going in and out and what programs are doing it. I'm sure its possible with the others but ZA Pro makes everything alot simpler. You can take the spyware out of kazaa easily, just check on google. I did it but i don't remember the specific file names, registry entries, etc...

OK, I'm (sorta) new @ this security stuff, but I can tell you at least this one reason why explorer.exe has tried to use the internet on my machine:
If you save a URL as a shortcut and then single-click on it in windows explorer, the little preview window will try to show you a miniature view of the web page on the left-hand side (pass the dutchie)
This is explorer.exe outbound tcp on port 80 (http). Not exactly what you'd call mission-critical
Explorer will also use ftp resources, but I would reccomend using a third-party ftp client instead of explorer.

yeah, i'd definitely look into downloading ad-aware. also look at webwasher:
http://www.webwasher.com/

www.kazaalite.com found it the no spyware no ad kazaa thanks much pyro

As a rule of thumb, I play it paranoid. I deny all traffic unless otherwise specified. I must admit that I don't know anything about XP really, though if you can firewall out the applications access and have no adverse affects, then I would.

As for the gaming commentaries, most of your games can be played on a *nix machine these days, all in the wonder and glory of WineX available at transgaming.com. Seems that DirectX 8 is now available to *nix users.

Regards.