Forum Discussion
How to block only one instance of Svchost from accessing to Internet?
I'm looking for a way to block a Windows service that runs under svchost.exe process from accessing to Internet. I can't block the whole process because it will break other things. I just want to block one instance like this svchost.exe -k utcsvc which is located in %SystemRoot%\System32\svchost.exe -k utcsvc. Is there any way to do it inside Windows or with third party software? I'm using Kaspersky Internet security if that helps.
- Hi,
You cannot. Instead try blocking the connection based on network flow characteristics like port.- I'm note sure if blocking IP address is an efficient option let alone blocking a port. they can be changed easily by the server.
Hawkings001 You can create Outbound Block Rules in Windows Firewall to block connections from a specific Windows Service.
Open wf.msc and create a new Outbound Rule. Choose Custom-Rule and click Next. Use "%SystemRoot%\system32\svchost.exe" as program path. Directly beneath the program path you can select "Customize..." to specify which services this rule applies to. Select "Apply to service with this service short name" and enter "utcsvc" as the short name. Keep the defaults for Protocol and Ports (Any). Keep the Scope on Any to Any. Choose "Block the connection" as Action. Apply the rule to all profiles. Name your rule and click finish.
Block-Rules always win against allow rules, and the rule you created applies only to this one service.
I found out that this is a standard Windows firewall feature and I have to disable KIS firewall if I want to do this. I'll have to see If i can pull that off first and whether or not it's worth it..Thanks anyway
