| Filename | Program Name | Description | Recommended Action |
|---|
| AIM.exe | AOL instant messenger | The worlds most popular IM client | Always permit as a client, but think twice before granting any IM program server rights. |
| Alg.exe | Application layer gateway | Part of WinXP that provides support for ICS and Internet connection firewall (ICF) | If a third party firewall warns you that Alg.exe wants to access, check to make sure you're not double firewalled. If you, are disable ICF. If you are using neither ICF or ICS and are warned that Alg.exe is trying to access the Internet, deny it. A Trojan or worm is trying to use it as a backdoor. |
| Dwwin.exe | Dr. Watson | MS application error reporting tool which gathers data about malfunctioning software and can send it to Microsoft | Permit once to transmit this information. |
| Explorer.exe. | Windows Explorer | Microsoft's windows shell | This generally doesn't need to have access to the Internet. Permit once if you intentionally performed an operation that requires net access. |
| Iexplore.exe | MS Internet Explorer | MS Web Browser | Some spyware can start your browser and pass information to its maker via a URL or cookie. To prevent snooping, permit once if you don't mind one extra click at IE start-up. |
| Lsass.exe | Local security authentication server, Windows NT/2k/xp | Validates passwords when user logs in | Always permit, but keep in mind that this file is a frequent target of malware, so scan it regularly to make sure it hasn't been altered. |
| Msimn.exe | MS outlook express | MS Mail client | For pop3, OE needs to make outgoing connections on ports 110(pop) and 25(smtp). If your firewall lets you select which ports a program can use, permit these ports always but allow access on no others. If you're using IMAP, allow access to port 143 as well. |
| Msmsgs.exe | MSN and windows messenger | MS IM service | See Aim.exe |
| Navapw.exe | Norton antivirus auto-protect | performs nightly updates of NAV patterns | Always permit. |
| Ndisuio.sys | NDIS user I/O | Internal windows driver; Performs internal windows communications tasks within windows | Always permit. |
| Ntoskrnl | NT OS kernel | Windows NT/2k Kernel | Always permit. Note that this file is attacked and altered by many Trojans and worms; scan regularly. |
| Quicktimeplayer | Apple Quicktime player | Plays quicktime and various other audio and video formats | Permit once when you actually want to stream media across the Internet. |
| Realplayer | Realmedia players | plays digital medias | See quicktimeplayer.exe |
| Rundll32.exe | Run DLL as a program | runs code from a dynamic link library (eg, from a control panel applet)as if it were a complete program | Permit once with care. But be suspicious; if you can't think of a reason the applet you just clicked needs to access the Internet, then click no. |
| Sevices.exe | Windows NT/2000 services | Performs system logging, tracks resources, sends messages and alerts, manages pnp devices, handles windows networking | Always permit. |
| Setup_wm.exe | Windows media player setup | Occasionally tries to check with MS for updates | Always deny. This program can leak information about the media you play. Get your updates through Windows update. |
| Svchost.exe | Generic host process for win32 services (Win2k) | This program is similar to Unix inetd.exe program. It runs one or more DLL who's code provides services to machines on the network | Always Permit. |
| Userinit.exe | initiate user environment | This sets up a user's computing environment immediately after log on. It starts the shell, establishes network connections and handles other similar logistics | Always Permit. |
| Winlogon.exe | Windows log on utility | Accepts user passwords | Always Permit. |
| Wkufind.exe | Ms works update detection | Checks for MS works, and Picture it updates | Permit once when update is desired. |
| Wmplayer.exe | Windows media player | MS media Player may be activated my web pages or other software and can slow the system dramatically | See Quicktimeplayer.exe |
| Wuaucit.exe | Windows update, auto update client | Retrieves updates from windows update server | Always permit, but be warned: According to MS, updates may invoke DRM restrictions, preventing you from playing multimedia content already on your system. Read the details of each update before applying it. |
