MpCmdRun.exe

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

After using Defender since its final release many weeks ago without any
problems, for the last several days my ZoneAlarm firewall has been alerting
me that MpCmdRun.exe wants to access the internet. Furthermore, it seems to
want to access my ISP, rather than MS. (Destination DNS
dns.rnc.net.cable.rogers.com).

I'm aware that MpCmdRun.exe is a legit Defender file that checks for
definition updates. I already do that manually from the WU wbsite, without
any problem.

My questions:

1) Why have these alerts suddenly appeared?
2) Why does MpCmdRun.exe want to access my ISP, rather than MS?
3) Is there any good reason not to block MpCmdRun.exe from accessing the
internet, given my success with manual updates?
 
gaslad said:
After using Defender since its final release many weeks ago without any problems,
for the last several days my ZoneAlarm firewall has been alerting me
that MpCmdRun.exe wants to access the internet. Furthermore, it seems to want
to access my ISP, rather than MS. (Destination DNS dns.rnc.net.cable.rogers.com).

2) Why does MpCmdRun.exe want to access my ISP, rather than MS?
Click to expand...

It is asking your ISP's DNS ("Domain Name Server") for the IP-address of the
MS server,
e.g., "please tell me the IP-address for the name 'www.microsoft.com'."
Since asking your local DNS-server is the preferred method for contacting
any server
(MS or IBM or YAHOO), what you're seeing is perfectly-normal traffic.

Similarly, Firefox is accessing your ISP's DNS-server for the IP-address
for every web-site that you ask Firefox to access, e.g.,
"what is the IP-address for 'www.DeskTopGirls.com'?"

Experiment: tell ZoneAlarm to _not_ trust 'firefox.exe', and then ZoneAlarm
will give you the same alerts for your web-surfing as you're getting from
Defender.

Who do you trust? :-)
 
Back
Top