Sign in with
Sign up | Sign in
Your question

Should Antivirus Block these services?

Last response: in Windows XP
Share
Anonymous
March 2, 2005 3:03:05 PM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Hi guys.
I run Xp home editon on a fujitsu computer at home, which is not part of a
network.

While checking my antivirus logs ( norton internet security ), i noticed it
stated it had blocked several "microsoft sevices:"

Rule "Default Block Microsoft Windows 2000 SMB" blocked
(81.154.27.121,microsoft-ds(445)).
Inbound TCP connection
Local address,service is (BOTHER(81.154.254.210),microsoft-ds(445))
Remote address,service is (81.154.27.121,3644)
Process name is "System"
Rule "Default Block EPMAP" blocked (81.154.122.71,epmap(135)).
Inbound TCP connection
Local address,service is (BOTHER(81.154.254.210),epmap(135))
Remote address,service is (81.154.122.71,3991)
Process name is "C:\WINDOWS\system32\svchost.exe"

Are these legitminate microsoft sevices, that i need to unblock via norton
and acess to my computer.
Sorry its long, thank you for your help.




Expand AllCollapse All
Anonymous
March 2, 2005 7:29:54 PM

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

"the cause" <thecause@discussions.microsoft.com> wrote in message
news:825BC587-A52A-41CA-AE43-446C505E3F9E@microsoft.com
| Hi guys.
| I run Xp home editon on a fujitsu computer at home, which is not part of a
| network.
|
| While checking my antivirus logs ( norton internet security ), i noticed it
| stated it had blocked several "microsoft sevices:"
|
| Rule "Default Block Microsoft Windows 2000 SMB" blocked
| (81.154.27.121,microsoft-ds(445)).
| Inbound TCP connection
| Local address,service is (BOTHER(81.154.254.210),microsoft-ds(445))
| Remote address,service is (81.154.27.121,3644)
| Process name is "System"
| Rule "Default Block EPMAP" blocked (81.154.122.71,epmap(135)).
| Inbound TCP connection
| Local address,service is (BOTHER(81.154.254.210),epmap(135))
| Remote address,service is (81.154.122.71,3991)
| Process name is "C:\WINDOWS\system32\svchost.exe"
|
| Are these legitminate microsoft sevices, that i need to unblock via norton
| and acess to my computer.
| Sorry its long, thank you for your help.
|
|
|
|
| Expand AllCollapse All


FireWalls block activity at the protocol level. Anti Virus blocks virus activity at the
file level.

Port 135 and 445 are standard Windows NT MS Networking protocol ports.

It looks like NIS was doing its job !

--
Dave
!