Sophos Client Firewall - SVCHOST.EXE

Question

I am working on configuring the client firewall on a couple of machines, before trying to deploy it out to others. I have had relative success, but for some reason I cannot get outbound svchost.exe UDP DNS requests unblocked. I have added svchost.exe as a trusted application, but it is still being blocked for memory modified.

Anyone have any suggestions that could help with this problem?

Thanks in advance

This thread was automatically locked due to age.

QC · Accepted Answer

Hello digitizedmind, modified memory isn't normal - i.e. usually an application should not fiddle with another's memory space. I think that only a specific instance of svchost.exe is blocked - but as the log doesn't list the PID it'd be hard to identify the one being blocked. Please see  Sophos Client Firewall: 'Memory Modified' reported as the reason for blocking an application and  Best Practice: Firewall settings guide for a discussion of this setting. Christian :41863