DCOM ERROR IN EVENT VIEWER

8250p42003,

Try this.

As long as your computer is ok, and applications run normally, it’s safe to ignore this error.

if your firewall was setup properly, blocking access to port 135 (assuming that you use a firewall), i don't think you would be seeing the dcom errors.. likely, the reason that you are seeing the "error" is because of a "windows updates" patch which disabled the "rpc" vulunerability, so dcom is not running as it "should" when the msblaster worm tries to exploit the vulnerability.. or, it is possible that you have already applied the tweak in grc's "decombobulator", and that is why "dcom" is not running as it "should", resulting in an "error" showing in the event viewer, meaning that the msblaster worm failed to do its deed on your pc..  if you were not seeing the dcom "error", you could be having major problems, instead, with the computer's shutting down automatically everytime you turned it on, caused by the "msblaster" worm.. that is my thinking.. 

i would try to start over configuring your firewall rules.. if you are not using any firewall, you could enable win xp's built-in "internet connection firewall" (it is not compatible with aol-dialup).. look for "internet connection firewall" in win xp's "help and support", in the index..

 

http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx

http://www.microsoft.com/athome/security/protect/default.aspx

 

Message Edited by redwolfe_98 on 07-25-2004 10:13 AM

Redwolfe, I am running norton internet security, and just looked in the firewall section, and here are the ports it says that are commonly blocked.

Numbers 80,81,82,83,1080,8080,8088,11523 and that is it. Should I add 135 to the list?

Danny I did what you suggested and it said that my computer was fine.

Joe

i am not an expert on firewall rules, but yes, it would not hurt to block tcp-inbound for port 135 (unless you have a special need for it, that you are aware of).. just be careful that you are only blocking tcp-in on that one port when you are creating the rule.. you don't want to block tcp-in for every port.. i think that some rule is allowing something to connect to port 135, tcp-inbound.. i have found that, as long as tcp-in for port 135 is blocked, dcom will not run at all.. (and so, no "errors" from it).. if you have all the "critical" windows updates installed, you are not vulnerable to the msblaster worm, anyway..

the default rules for the firewall should block port 135 without your having to create a rule for it, yourself..

one thing that i block is "generic host process", inbound (not outbound), both tcp and udp.. the local application is "c:\windows\system32\svchost.exe", or svchost.exe.. i just create the rule, permanently denying it access, when the dialog pops up asking if i want to allow "generic host process" to connect..  

the default rules for the firewall should work pretty well for you, so you could try starting over with the default rules, and then creating rules ("allow") for your isp, your internet explorer, etc.. the trick is knowing how to clear the rules, to start afresh.. 

if you see "generic host process wants to connect, inbound", deny it, both tcp and udp.. just be careful about what you allow.. generally, don't allow any unsolicited connections, but you could just deny something for the current session, without creating a rule to deny a connection permanently..

i guess it takes some trial and error when creating rules.. symantec should have some instructions for how to clear the rules so as to start afresh with the default rules.. 

Message Edited by redwolfe_98 on 07-26-2004 07:38 AM

I have the same error, different information than what the previous posts have indicated. Here is the history.
I have:
Microsoft Windows XP Home Edition
Version 5.1.2600 Service Pack 1 Build 2600 DELL Dimension 4600i
System Type X86-based PC
Processor x86 Family 15 Model 2 Stepping 9 GenuineIntel ~2660 Mhz
BIOS Version/Date Dell Computer Corporation A07, 11/6/2003
SMBIOS Version 2.3
Hardware Abstraction Layer Version = "5.1.2600.1106 (xpsp1.020828-1920)"
Total Physical Memory 512.00 MB
Available Physical Memory 195.75 MB
Total Virtual Memory 1.72 GB
Available Virtual Memory 1.14 GB

I got this error in the event viewer:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10005
Date:  7/27/2004
Time:  7:35:53 AM
User:  DELL\Trisha
Computer: DELL
Description:
DCOM got error "The service cannot be started, either because it is disabled or because it has no enabled
 devices associated with it. " attempting to start the service BITS with arguments "" in order to run the
server:
{4991D34B-80A1-4291-83B6-3328366B9097}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Clicking the link for more information at the bottom, took me to
 http://support.microsoft.com/default.aspx?scid=kb;en-us;841996&sd=ee

which basically says that if you do not have Help and Support set to auto in the services, this fix:
Security Update for Windows XP (KB840374):
 http://www.microsoft.com/downloads/details.aspx?FamilyId=563F65A3-D793-47B4-A607-948CAA5B3454&displaylang=en
would not install properly, you would get the error, and windows update wouldn't notice that the update hadn't
stuck.
 
So I check, and I DO have help and support set to auto,and it is running. Well I follow the instructions,
uninstall the fix from add and remove programs, reboot, check to make sure H&S is still set to auto, still
running (it is) and reinstall the fix. Reboot again, and all is well, no error.
 Until the next day, there it is again.
HMM. I track down this utility which verifies the instalation of hotfixes(xp + 2000)
 http://support.microsoft.com/default.aspx?scid=kb;EN-US;q282784

run it, and low and behold, it tells me I need to reinstall it (and also several other hotfixes!!!!) so I repeat
the above steps again, rerun the utility, all it okay, HURRAY!
 Until the next day, when it shows up again....
Repeating does not seem to have any permanent effect...All the other reinstalled hotfixes are fine now, just this one.
So here I am, trying to find out WHAT the problem could be.

Any advice?