Windows Defender problems after Port 135 and rpc disabling!  Dr Lipman and others - help!

Windows Defender problems after Port 135 and rpc disabling! Dr Lipman and others - help!

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Windows Defender problems after Port 135 and rpc disabling! Dr Lipman and others - help! ipquestions 04-09-2006
Posted by on April 9, 2006, 5:45 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I've been trying to close as many unnecessary open ports as possible.
Whenever I do a netstat -an command or use TCPView by Sysinternals, I
notice that Port 135 is in this state:

Local Address Foreign Address

TCP 0.0.0.0:135 0.0.0.0:0
LISTENING

Since I'm not using a networked computer and had netbios running, I
disabled that. I deleted my "client for MS networks" option in the
local area connection properties. Then I tried running Dcomcnfg.exe and
unchecked the "enable Distributed Com" box.

I then edited HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc as follows:
Created an "Internet Key" with the string "UseInternetPorts" and a value
of N.

However, when I rebooted, Port 135 was still showing when doing a netstat
-an command.

I see it's blocked in my ZA internet zone security (incoming and
outgoing).

Why can't I shut it down upon rebooting?

TCPView tells me the port is running:

svchost -k rpcss.



I have noticed that when I disable dcom and create the RPC key, upon
rebooting Windows Defender beta Spyware by Microsoft won't run after
booting. Supposedly, that program depends on the remote procedure call
service.

I now keep getting this error message even after uninstalling and
reinstalling, and re-enabling Dcom.

Windows Defender Application failed to initialize: 0x800106ba. A problem
caused Windows Defender Service to stop. To start the service, restart
your
computer or search Help and Support on how to start a service manually.



Has anyone got a solution?









Posted by David H. Lipman on April 9, 2006, 5:53 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| I've been trying to close as many unnecessary open ports as possible.
| Whenever I do a netstat -an command or use TCPView by Sysinternals, I
| notice that Port 135 is in this state:
|
| Local Address Foreign Address
|
| TCP 0.0.0.0:135 0.0.0.0:0
| LISTENING
|
| Since I'm not using a networked computer and had netbios running, I
| disabled that. I deleted my "client for MS networks" option in the
| local area connection properties. Then I tried running Dcomcnfg.exe and
| unchecked the "enable Distributed Com" box.
|
| I then edited HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc as follows:
| Created an "Internet Key" with the string "UseInternetPorts" and a value
| of N.
|
| However, when I rebooted, Port 135 was still showing when doing a netstat
| -an command.
|
| I see it's blocked in my ZA internet zone security (incoming and
| outgoing).
|
| Why can't I shut it down upon rebooting?
|
| TCPView tells me the port is running:
|
| svchost -k rpcss.
|
| I have noticed that when I disable dcom and create the RPC key, upon
| rebooting Windows Defender beta Spyware by Microsoft won't run after
| booting. Supposedly, that program depends on the remote procedure call
| service.
|
| I now keep getting this error message even after uninstalling and
| reinstalling, and re-enabling Dcom.
|
| Windows Defender Application failed to initialize: 0x800106ba. A problem
| caused Windows Defender Service to stop. To start the service, restart
| your
| computer or search Help and Support on how to start a service manually.
|
| Has anyone got a solution?
|

RPC/RPCSS DCOM is required and many software components are dependent upon it.

If you are on Broadband Internet then I suggest using a Cable/DSL Router. This
will isolate
Internet inbound activity to the Router and not the PC.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by on April 9, 2006, 6:30 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> From: <>
>
>| I've been trying to close as many unnecessary open ports as possible.
>| Whenever I do a netstat -an command or use TCPView by Sysinternals, I
>| notice that Port 135 is in this state:
>|
>| Local Address Foreign Address
>|
>| TCP 0.0.0.0:135 0.0.0.0:0
>| LISTENING
>|
>| Since I'm not using a networked computer and had netbios running, I
>| disabled that. I deleted my "client for MS networks" option in the
>| local area connection properties. Then I tried running Dcomcnfg.exe
>| and unchecked the "enable Distributed Com" box.
>|
>| I then edited HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc as follows:
>| Created an "Internet Key" with the string "UseInternetPorts" and a
>| value of N.
>|
>| However, when I rebooted, Port 135 was still showing when doing a
>| netstat -an command.
>|
>| I see it's blocked in my ZA internet zone security (incoming and
>| outgoing).
>|
>| Why can't I shut it down upon rebooting?
>|
>| TCPView tells me the port is running:
>|
>| svchost -k rpcss.
>|
>| I have noticed that when I disable dcom and create the RPC key, upon
>| rebooting Windows Defender beta Spyware by Microsoft won't run after
>| booting. Supposedly, that program depends on the remote procedure
>| call service.
>|
>| I now keep getting this error message even after uninstalling and
>| reinstalling, and re-enabling Dcom.
>|
>| Windows Defender Application failed to initialize: 0x800106ba. A
>| problem caused Windows Defender Service to stop. To start the
>| service, restart your
>| computer or search Help and Support on how to start a service
>| manually.
>|
>| Has anyone got a solution?
>|
>
> RPC/RPCSS DCOM is required and many software components are dependent
> upon it.
>
> If you are on Broadband Internet then I suggest using a Cable/DSL
> Router. This will isolate Internet inbound activity to the Router and
> not the PC.


I'm using a router. Are you saying I can't close Port 135 if it's
running rpcss? When I closed Dcom created the UseInternetPorts key, I
was still able to use the net and e-mail services.

I've since found out that Windows Defender can't run unless the "Client
for MS Networks" component is included in the Local Area Connection
properties. After I reinstalled that, Windows Defender ran again. What
a quirky program.


Posted by David H. Lipman on April 9, 2006, 6:43 pm
If you were  Registered and logged in, you could reply and use other advanced thread options


|
| I'm using a router. Are you saying I can't close Port 135 if it's
| running rpcss? When I closed Dcom created the UseInternetPorts key, I
| was still able to use the net and e-mail services.
|
| I've since found out that Windows Defender can't run unless the "Client
| for MS Networks" component is included in the Local Area Connection
| properties. After I reinstalled that, Windows Defender ran again. What
| a quirky program.

No, I am not specifically stating that. I am stating that you can't disable
RPC. The
specifics of not having TCP port 135 open is another issue and I don't know how
to not open
that port. However I am stating its a moot point if you are behind a NAT Router.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Ant on April 9, 2006, 7:58 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> I'm using a router. Are you saying I can't close Port 135 if it's
> running rpcss?

Yes, you can close the port. I've done it on my system (Win2k) without
any loss of functionality.

http://www.hsc.fr/ressources/breves/min_srv_res_win.en.html.en

"Disabling DCOM does not close TCP port 135. To close it, one solution
is to remove IP-based RPC protocols sequences from the list that can
be used by DCOM".

See the section labelled "--[ DCOM ]--" near the end of the page, and
read it thoroughly.

> When I closed Dcom created the UseInternetPorts key [...]

I've no idea what the UseInternetPorts registry entry is. It's not
present in mine.



Similar ThreadsPosted
RE: ANN: Windows Defender problems? March 20, 2006, 12:04 pm
Re: Windows Defender Problems/Questions? March 28, 2006, 4:37 am
Windows Defender September 6, 2006, 6:24 am
Windows Defender January 3, 2007, 2:59 am
Windows Defender March 25, 2007, 11:03 am
WINDOWS DEFENDER QUESTIONS = NOT HERE PLEASE ! March 17, 2006, 2:58 pm
ANN: Looking for Windows Defender support? April 4, 2006, 6:22 pm
ANN: Looking for Windows Defender support? April 15, 2006, 9:50 pm
Windows Defender update... August 22, 2006, 7:06 pm
Windows Defender Shutting Down February 3, 2007, 4:21 pm

The site map in XML format XML site map

Contact Us | Privacy Policy