ZoneAlarm firewall and LSA Shell lsass.exe. pls help - Firewalls

This is a discussion on ZoneAlarm firewall and LSA Shell lsass.exe. pls help - Firewalls ; zonealarm firewall shows LSA Shell (Export version) wants to accept connection from the internet. Application lsass.exe Source IP: 119.40.177.18 Port 500 can somebody pls expaling why lsass.exe wants to accept connections from the internet...

+ Reply to Thread
Results 1 to 3 of 3

Thread: ZoneAlarm firewall and LSA Shell lsass.exe. pls help

  1. ZoneAlarm firewall and LSA Shell lsass.exe. pls help

    zonealarm firewall shows LSA Shell (Export version) wants to accept
    connection from the internet.

    Application lsass.exe
    Source IP: 119.40.177.18 Port 500


    can somebody pls expaling why lsass.exe wants to accept connections
    from the internet

  2. Re: ZoneAlarm firewall and LSA Shell lsass.exe. pls help

    mkh wrote:
    > zonealarm firewall shows LSA Shell (Export version) wants to accept
    > connection from the internet.
    >
    > Application lsass.exe
    > Source IP: 119.40.177.18 Port 500
    >
    >
    > can somebody pls expaling why lsass.exe wants to accept connections
    > from the internet


    That's for IPSec key exchange. If you don't use IPSec, you can set the
    PolicyAgent service to "disabled". Not providing services you don't want
    to be used is the best way to prevent them from being attacked anyway.
    No need to install crap like ZoneAlarm for that.

    On Windows 2000 or XP you can use win32sec [1] or ntsvcfg [2] to disable
    services users normally don't need.

    [1] http://www.dingens.org/index.html.en
    [2] http://www.ntsvcfg.de/ntsvcfg_eng.html

    cu
    59cobalt
    --
    "If a software developer ever believes a rootkit is a necessary part of
    their architecture they should go back and re-architect their solution."
    --Mark Russinovich

  3. Re: ZoneAlarm firewall and LSA Shell lsass.exe. pls help

    mkh wrote:
    >zonealarm firewall shows LSA Shell (Export version) wants to accept
    >connection from the internet.
    >
    >Application lsass.exe
    >Source IP: 119.40.177.18 Port 500
    >
    >
    >can somebody pls expaling why lsass.exe wants to accept connections
    >from the internet


    to receive further instructions or data from whomever 'owns' you

+ Reply to Thread