I have just installed avast 4.7 Home version. My firewall (Zone Alarm) reports that “Distributed COM Services” asking to act as server. Details are as follows:
Product Name: Microsoft(R) Windows NT™ Operating System
Filename: C:\WINDOWS\SYSTEM\RPCSS.EXE
I think it comes with avast 4.7 installation or updating process. What is it anyway? Should I block it from trying to act as server?
I am using a stand alone computer with Win98 OS.
Into the firewall settings, the following programs should be allowed to connect:
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner Service)
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (avast! Update executable).
This is a temporary file that just appears when an update (check) is about to launch, and disappears again afterwards.
Don’t need rights to connect:
C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service)
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)
or any other avast component.
Many thanks for your reply, tech.
I already allowed all avast commands that appear in Zone Alarm to connect.
So, I should block C:\Windows\System\rpcss.exe. Right?
What is this command for? Why is it activated?
avast does use the RPC service, but I can’t see why ZA would be reporting this acting as a server any avast access would be from the files mentioned by Tech.
Sorry I have no experience with winNT but there were previously DCOM vulnerabilities which were patched, is your copy of NT fully patched ?
You might want to pay a visit to grc.com and look for the Decombobulator (http://www.grc.com/freeware/dcom.htm), which checks for vulnerability and disables the DCOM service I think.
Server Alerts
You may receive some alerts asking you if a certain program should act as a server and be given "server rights". Under most circumstances, you do not want to give a program "server rights" unless you want to allow outside connections to access that specific program.
If you do not recognize the program or process that is asking for "server rights", you can do one of two things:
If you do not recognize the program name, you can click the More Info button which will guide you to the Zone Labs Web site. We attempt to provide descriptions for many programs in order to help our users make safe decisions.
If you need more information than what is offered at ZoneLabs.com, search the Microsoft Support site for information on the program in order to determine what the program is and what it is used for.
The safest approach is to deny “server rights” to any program (unless you are running a Web site from your computer for instance).
At any time in the future, you can always change the setting of the program to give it “server rights” by going to Program Control (left-hand column) > select the Programs tab > highlight the program you wish to give “server rights” > click on the “X” under “Server” and click “Allow” in the little box that pops up.