Print

Welcome to Smokey's Security Forums.

Guests have only limited access to the board and it's features, please consider registering to gain full access!

Registration is free and it only takes a few moments to complete.

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[pcaca]

Recently I've made some rules for svchost after noticing that my computer clock was slow by more than 2 hours  

So I created a new table for w32time.  I specified an ip and a port (123).

However creating rules for svchost is a real pain since it runs so many services.

What i'd like to see is someting like the output from tasklist /svc, where the services run by svchost are clearly diferentiated.

I'd seen this in a firewall but I forget which, since i ran most of them at one time or another.

Good point. That would be very useful!

Creating rules for services instead of executable files would be much better, especially for svchost. So, if I create rule for Windows Update Service (HTTP/HTTPS), Jetico will allow HTTP/HTTPS connections only for svchost.exe instance which is runing Windows Update sevice and other istances like DNS Client should be denied from accessing HTTP/HTTPS. This way we will have better security and better organization of rules.