Answer Line: Which Programs Should I Let Access the Internet?

I use Zone Labs' ZoneAlarm firewall software to protect my system from Net intruders. Sometimes ZoneAlarm asks me if a particular program should be given access to the Internet. How do I decide whether I should grant such access to a program that I've never heard of?

John Piering, Marietta, Georgia

When your firewall asks if a program you're not familiar with should be allowed access to the Internet, just say no. But before you click that No button, make sure you have not checked the option to remember the answer--for the time being, you want to be notified each time the program tries to get through.

If it turns out that declining to grant the access request prevents you from doing something you want to do, give the mystery program access. If not, you can instruct your firewall to remember your "no" answer so it will stop asking.

Search for the program's name on the Web. If something unsavory is going on, there's a good chance that someone has posted a message about it.

One program you're likely to receive alerts about is Svchost.exe, also known as the generic host process. It's a standard part of Windows 2000 and XP, but it's not a program users generally have to worry about or to interact with directly--other programs use svchost to carry out specific tasks, such as accessing the Internet. If svchost can't access the Net, neither can Internet Explorer. Granting such access to svchost is probably safe, although I can't give you a 100 percent guarantee.

Svchost runs processes that other programs give it, and figuring out what those other programs are is nearly impossible. If a new program uses svchost to access the Internet, your firewall should ask if the program is okay, without mentioning svchost. But if a Trojan horse program replaces an existing program or .dll file that accesses svchost, it could gain Net access without getting caught. I've never heard of this happening, but it could.

Is there a defense? Fortunately, yes. Some firewalls, including ZoneAlarm Pro 3, come with component controls. If a change occurs in a program to which you've granted permission--or to a .dll or other component of that program--the firewall will alert you the next time that program tries to access the Internet. If ZoneAlarm tells you that a program has changed (see FIGURE 1), and you haven't updated the program recently, click No.