DCOM

[JakBeNymble]

Hi "~Proxo-Friends~",
I was checking my firewall logs, after some changes, and this service was contacting My ISP even without My dial-up connection being logged in. :o Firewall showed the traffic and IP of destination site. You might want to check this out on Your Machine. I checked the "services", and I didn't even see where the "DCOM" service was listed to even turn it off. But here is a free patch You can download , disable, and then forget about it. Click Here

Best Wishes,
"~JaK~"
******************************************************
PS: "And Here is a link for more Patches You might want to check out."Click Here

[besafe]

I run the tests and check out fine.

besafe

[Jaded_Goth]

Long live the DCOMbobulator,I say.

In the year it has been closed on this system,I have never found a reason to open it.

I have heard mention that some people have trouble setting up wireless connections,and have attributed that to the fact the dcom is shutdown.I can't see why...any thoughts?

Am dreading the official release of SP 2,now Microsoft have seen fit to make it impossible to disable it as the RPC service will depend upon it.Steve has made me a passionate dcom detester!

[Jaded_Goth]

This has nothing whatsoever to do with the DCOM.The reason I'm posting it here is because directly above is an ordinary netstat -an from my computer.

Now,the circumstances of the attached netstat are not dramatically different-but the results are.I have never seen anything like it.

I installed Abtrusion Protector a few days ago,and that is responsible for setting certain ports as "listening" (I've checked those out)...even so,I am pretty worried.

Tell me I'm owned and need to reformat?!!?

EDIT:Sorry,the image is not very clear.I did a super-quick resize cos I'm off to beddy-byes,now.

Oddysey-speed of loading or clarity,take your pick. *grin*

[Kye-U]

You think that's bad?

[Oddysey]

Both of you;

Calm down, calm down, nobody's hosed, all is cool. [smoke]

If you'll surf over to the Reverse Whois database, you'll find out some interesting factoids. I'll cover them here, with explanations. (Keep in mind that when you click that link, you'll see an error message at the top of the page, in bold print. Ignore the severity, and follow the directions - just fill in the blank, and hit the "Submit Query" button.)

In the first place, unless you see 127.0.0.1 go somewhere specific, then all those ports are OK - they are still local. Ditto for 0.0.0.0. In point of fact, it's certainly possible that the report has been compromised, but I greatly doubt it. If your machines were actually pointing out towards the 'Tardnet, then I'm certain that they'd be full of "goodies" by now.

You can safely ignore 0.0.0.0 and 127.0.0.1, unless they are pointed to a routable address.

It's the non-routable addresses that you wanna be concerned with. They are sent directly out to your broadband modems. All the 192.168.x.x stuff is where the action is. (It is conceivable that 10.0.0.x could also be used, but that's mighty rare these days.)

~~~~~~~~
Jaded_Goth;

Your entries point to two known locations. The 216.149.14.131 is part of the major block (216.149.0.0 to 216.149.255.255) that is reserved to XO communications. They have the odius duty of transferring all data coming in to, or going out of, the good ol' USA - Eastern bound. Your being in Merry Ol' England pretty much mandates that an address from this block will show up for you, when surfing to this side of the puddle.

You then have four connections listed for this forum. All is well for you.

Score: <span style='color:red'>Jaded_Goth - 1</span>, <span style='color:purple'>Monkey Spankers - 0</span>

~~~~~
Kye-U;

Your entries show more activity for some reason, but I still wouldn't be worried about external violations of your machine. I'd be strongly curious about how come so many connections are being opened, but otherwise, consider them null and void.

Your non-routable connections point to a couple of places.

1 & 3 point to Microsoft's Instant Messenger Service, & 2 points to this forum's server. Excepting one's personal views about any IM service, you're OK, too.

Score: <span style='color:red'>Kye-U - 1</span>, <span style='color:purple'>Chicken Chokers - 0</span>

~~~~
All in all, what we have here is a report that is too terse for non-netnerds. (Netnerds - can I say that?) Follow the link above for at least some inkling about who your computer is talking to. This might set your mind at ease, or it might set your fears in High Anxiety mode - that'll be up to you. :P

"Good luck, Jim. As usual, this message will self-destruct in 5 seconds."

5.... 4.... 3....


Oddysey

[Kye-U]

I know, I was just pointing out mine

I'm not worried about all of the connections, as I have Kerio 2.1.5 and Look'n'Stop filtering away!

[Jaded_Goth]

Kye-U-whooooaa nelly is right! If my netstat looked like that,my head would be spinnin' exorcist style!

Thanks you two.My mind really went to town yesterday (oh,hold on...where is it usually?) with all the talk of "Bishop-Bashers".

Oddysey,I do have samspade-but at 1.30 am I can't possibly be expected to act in a coherant manner.That would involve querying I.Ps AND fretting over white knuckle riders...

[Jaded_Goth]

Since the official release of SP 2,we'd best add that shutting down the DCOM on XP with SP2 is a bad idea.The rpc depends on it.

In fact,as I recall through trying it on the beta releases,DCOMBob just throws an error message when you try to use it to shutdown 135.

[besafe]

Kye-U Wrote:I'm not worried about all of the connections, as I have Kerio 2.1.5 and Look'n'Stop filtering away!

Kye-U:
Is there a reason why you are running two firewalls that do the same thing at the same time? Or are you using LnS for it's app monitoring etc. and Kerio for internet filtering?

besafe