MpCmdRun.exe

After using Defender since its final release many weeks ago without any
problems, for the last several days my ZoneAlarm firewall has been alerting
me that MpCmdRun.exe wants to access the internet. Furthermore, it seems to
want to access my ISP, rather than MS. (Destination DNS
dns.rnc.net.cable.rogers.com).

I'm aware that MpCmdRun.exe is a legit Defender file that checks for
definition updates. I already do that manually from the WU wbsite, without
any problem.

My questions:

1) Why have these alerts suddenly appeared?
2) Why does MpCmdRun.exe want to access my ISP, rather than MS?
3) Is there any good reason not to block MpCmdRun.exe from accessing the
internet, given my success with manual updates?

"gaslad" sprayed multiple newsgroups:'

> After using Defender since its final release many weeks ago without any
> problems, for the last several days my ZoneAlarm firewall has been
alerting
> me that MpCmdRun.exe wants to access the internet. Furthermore, it seems
to
> want to access my ISP, rather than MS. (Destination DNS
> dns.rnc.net.cable.rogers.com).
>
> 2) Why does MpCmdRun.exe want to access my ISP, rather than MS?

That is "the way things work" -- any application, e.g., 'firefox.exe' should
ask
the "local" DNS ("Domain Name Service") server to translate domain-names,
such as 'www.DeskTopGirls.com' or 'www.Microsoft.com' to IP-addresses.
Then, with that IP-address in-hand, the application then can contact D.T.G.
or M.S.
via the supplied IP-address.

... Melvin

Thanks Melvin. That makes sense.

Sorry for the cross-post. I waited 5 minutes for the first post to appear,
and when it didn't I thought I had made some posting error. Then I figured
this was the more appropriate newsgoup- hence the double post.

"Melvin (math) Klassen" wrote:

> "gaslad" sprayed multiple newsgroups:'
>
> > After using Defender since its final release many weeks ago without any
> > problems, for the last several days my ZoneAlarm firewall has been
> alerting
> > me that MpCmdRun.exe wants to access the internet. Furthermore, it seems
> to
> > want to access my ISP, rather than MS. (Destination DNS
> > dns.rnc.net.cable.rogers.com).
> >
> > 2) Why does MpCmdRun.exe want to access my ISP, rather than MS?
>
> That is "the way things work" -- any application, e.g., 'firefox.exe' should
> ask
> the "local" DNS ("Domain Name Service") server to translate domain-names,
> such as 'www.DeskTopGirls.com' or 'www.Microsoft.com' to IP-addresses.
> Then, with that IP-address in-hand, the application then can contact D.T.G.
> or M.S.
> via the supplied IP-address.
>
> ... Melvin
>
>
>

Hello gaslad,

Any clues in the System events log you can see?
--

"gaslad" wrote:

> After using Defender since its final release many weeks ago without any
> problems, for the last several days my ZoneAlarm firewall has been alerting
> me that MpCmdRun.exe wants to access the internet. Furthermore, it seems to
> want to access my ISP, rather than MS. (Destination DNS
> dns.rnc.net.cable.rogers.com).
>
> I'm aware that MpCmdRun.exe is a legit Defender file that checks for
> definition updates. I already do that manually from the WU wbsite, without
> any problem.
>
> My questions:
>
> 1) Why have these alerts suddenly appeared?
> 2) Why does MpCmdRun.exe want to access my ISP, rather than MS?
> 3) Is there any good reason not to block MpCmdRun.exe from accessing the
> internet, given my success with manual updates?
>
>
>
>

Hi Engel- and thanks.

Nope, nothing in the logs stands out.

Perhaps it's related to my recent activation of IE7's Phishing Filter, or to
some Update I downloaded on 'Patch Tuesday'. Whatever. I've decided to grant
this Defender app blanket permission in my ZA firewall, rather than put up
with those alerts. Just another MS oddity, I guess.

"Engel" wrote:

> Hello gaslad,
>
> Any clues in the System events log you can see?
> --
>
> "gaslad" wrote:
>
> > After using Defender since its final release many weeks ago without any
> > problems, for the last several days my ZoneAlarm firewall has been alerting
> > me that MpCmdRun.exe wants to access the internet. Furthermore, it seems to
> > want to access my ISP, rather than MS. (Destination DNS
> > dns.rnc.net.cable.rogers.com).
> >
> > I'm aware that MpCmdRun.exe is a legit Defender file that checks for
> > definition updates. I already do that manually from the WU wbsite, without
> > any problem.
> >
> > My questions:
> >
> > 1) Why have these alerts suddenly appeared?
> > 2) Why does MpCmdRun.exe want to access my ISP, rather than MS?
> > 3) Is there any good reason not to block MpCmdRun.exe from accessing the
> > internet, given my success with manual updates?
> >
> >
> >
> >