Warning message keeps appearing

[navarre]

i have on-access protection control activated and for a few days now a message keeps appearing saying this:

"Network Shield: Blocked DCOM exploit  (some IP number)"

i've scaned the computer for viruses, i keeps Avast updated, and still the massage keeps showing up!
what does it mean and how do i stop it?

[Lisandro]

Network Shield is a protection against known Internet worms/attacks. It analyses all network traffic and scans it for malicious contents. It can be also taken as a lightweight firewall (or more precisely, an IDS (Intrusion Detection System).

Network Shield protects you from internet worms that spread themselves via various security holes in your system. Typicaly these kind of viruses don't infect files but instead  they attack running processes on your PC (either Windows components or some server programs like SQL Server, IIS etc.). These kind of attacks are not easily catched by ordinary antivirus during file or mail scanning. It is not a duplicate work with Standard Shield. Basically, it covers all Internet worms. Such as Win32.CodeRed, Win32.SQLSlammer, Win32.Blaster, in32.Welchia (Nachi) and Win32.Sasser.

Messages like:
Network Shield: blocked "DCOM Exploit" - attack from 81.178.115.162:135/tcp
are due to the RPC/DCOM exploit, which is a vulnerability that allows an attacker to gain access to the destination machine by sending a malformed packet to the DCOM service. It uses the RPC TCP port 135.

Do you use a firewall? Which one?
You should have one 

[navarre]

thanks for the reply, i don't use a firewall, don't even know how to use one... do i HAVE to install one or is this vulnerability eliminated by installing windows patches?

also, every time the message appears someone is trying to access my computer??

[Lisandro]

thanks for the reply, i don't use a firewall, don't even know how to use one... do i HAVE to install one or is this vulnerability eliminated by installing windows patches?

I think you need a firewall, at least, Windows XP SP2 internal one.

also, every time the message appears someone is trying to access my computer??

Yes  :'(

[CharleyO]

***

Welcome to the forums, navarre.   

These days, it is impossible to be on the internet more than a few minutes before your computer will be attacked. The internet is a dangerous place to be without a firewall. While Windows XP firewall is better than none, it is only half a firewall providing only inbound protection. You really need both inbound and outbound protection. Not all malware comes from internet connections. Malware is also included on some commercially available cd programs/games. You can also get malware on a cd or floppy given to you by someone who has made it on their own computer which might be infected. Much of this malware will send out your personal information contained on your computer. This is why you need a firewall with both inbound and outbound protection.

I would suggest Zone Alarm Free for a first firewall. Even after many years on the internet, I still use ZA Free with confidence.

http://www.zonelabs.com/store/content/company/products/znalm/freeDownload2.jsp?dc=12bms&ctry=&lang=en

You can "teach" ZA Free to learn what to let out of your computer and what to block from leaving your computer. In the beginning, it will give you pop-up alerts when a program tries to go to the internet. This pop-up has a checkbox to remember this decision and below that are buttons for allow and deny. Once you let ZA Free know what programs to let out and what programs to deny access to the internet, it will not bother you very much ... only if a new program wants to access the internet. This usually only takes a few days for ZA Free to learn.


***