How to Disable MMC.EXE acting as a server? (Microsoft Management Console)

[Chipmonk]

I've managed to close all the listening ports using online guides, and the
utilities at GRC.COM.

However, if I click Start -> Run -> type DCOMCNFG and hit OK. When the
Microsoft Management Console opens, I click on "Components" but then Zone
Alarm prompts asking if I want to allow Microsoft Management Console to act
as a server program. Whether I deny or allow access, TCP ports 135 and 1030
are opened regardless.

The IP address it's trying to connect to is 0.0.0.0 which, as I understand
it, is Loopback(?) in other words it's trying to connect to itself, and not
a remote system?

What confuses me even more is that Steve Gibson says on his Website
(GRC.COM) that *ONLY* Task Scheduler, MSDTC or DCOM will cause TCP 135 to
open. I know for certain I have DCOM and Task Scheduler disabled, but MSDTC
no longer appears in the Services window so I cannot be 100% sure.

This occurs both before AND after I've freshly re-installed WindowsXP Pro,
applied SP1 and installed Zone Alarm (free). Network card disabled in BIOS,
no Internet connection set up.

Why does MMC need to act as a server? How can I disable it from even trying?

 

[Wesley Vogel]

If you've got DCOM disabled, don't open Component Services snap-in
(DCOMCNFG).
And don't click on "Components".

"DCOMbobulator" allows any Windows user
to quickly check their system's DCOM vulnerability, then
simply shut down the unnecessary DCOM security risk.
http://grc.com/dcom/intro.htm

 

[Chipmonk]

Hi Wesley,

Funnily enough I had just found DCOMbobulator earlier today and used that to
turn off DCOM.

But apart from not touching "Components" under DCOMCNFG, I'm getting so many
similar behaviours from so many Windows components.

For example, if I simply click Start -> Help, then Zone Alarm asks if I want
to allow HelpHost.exe act as a server program. I stopped and disabled Help
under Services, but using Help always restarts the service and sets it to
Automatic again. I unticked an option in Help to prevent it trying to access
the MS Knowledge Base, but that didn't help as I still get the prompts from
Zone Alarm. Even
with the Help service stopped and disabled, if I try to rename HelpHost.exe,
some
process recreates it again.

This all seems odd and I don't see anyone else reporting these behaviours in
forums. If it's normal behaviour and everyone was experiencing them, then
that's all fine; I could live with that.

Other programs which try to do this include Windows Explorer, Find, MSDTC
(disabled now), COM Surrogate (disabled now).

Even my mouse utility program
requests "Internet Access" (IP 0.0.0.0NS) if I click any of the
programmable buttons (which I set as ENTER, Copy, and Paste).

Why does this keep happening to me? Is it sympomatic of an incorrect IP
configuration?

 

[Wesley Vogel]

I don't think you have anything to worry about.

I use ZA also.
I have four Xs (no access) for each of these in Program Control:
Microsoft Management Console
Microsoft HTML Help Executable
Spooler SubSystem App
Windows NT ClipBook Viewer
Windows TaskManager

I had Windows Media Player Setup on the list, but I disabled it in the
registry.

You don't have to disable the programs themselves, just deny access when ZA
asks.

Open ZA Help | Index | Access permission | Read a little.

If you don't think a program should have access, block it or set to ask.

There's nothing wrong with Microsoft Help and Support Center & Microsoft
Help Center Hosting Server trying to access online. H & S C will check for
KB articles and in Event Viewer if you have errors, clicking on: For more
information leads you to MS's online database for Event IDs.

Also when you open Help and Support it will access so it can update the
Did you know? Updated: Tuesday, 20 July, 2004 items. Among other things.

Windows Explorer will try because it's integrated with Internet Explorer.
Same with MS Word.

Search will try to obtain access because that's part of it's function.

In ZA, Program Control, even for programs that I grant access, I have two
Xs under Server. I grant *NO* Server access for *any* program.

Your mouse utility is probably checking for updates.

I hope I've set some of your concerns to rest in this less then eloquent
message.

 

[Chipmonk]

Hi Wesley,

Thanks very much for the comprehensive reply, it's much appreciated. You've
certainly eased my mind regarding suspected IP configuration problems.

BTW, with Windows Media Player, I also rename the shortcuts to MPLAYER2.EXE
(it's in the same folder), so it just uses the core engine without the
bloated stuff.

Cheers.

 

[Wesley Vogel]

You bet.

mplayer2.exe is Windows Media Player Version 6.4.9.1125
wmplayer.exe is Windows Media Player Version 8.0 or 9.0

I was referring to setup_wm.exe = Microsoft Windows Media Configuration
Utility.