Hi All,

since days, I am seeing the following event listed in my eventviewer:

Access denied attempting to launch a DCOM Server.
The server is:
{00020906-0000-0000-C000-000000000046}
The user is Unavailable/Unavailable, SID=Unavailable.

This happens always shortly after I establish a connection to the internet.
Anyway, which programs I have open. I tried to open nothing else than the
computermanagement [just to see/wait for the event]. It comes always. I
created a new useraccount, just to be sure, that this does not depend on
settings in the profile. Result:It happens with each user, even new ones. A
full virus-scan gave no results. Spybot found no problems. BTW, the
mentioned DCOM server is MS Word. The event happens nearly each minute and
floods my eventlog. But I am afraid, that there can be more problems.

I do not know, how to anaylze the cause. Could someone please help?

I use Windows 2000 Server, english, SP4, all securityfixes, McAfee netshield
with latest engine and signature files. MS Office and the Net Development is
also installed, as SQL Server and Webserver. Everything patched fine.
Noone can log on to my box, I have removed the everyone access from the most
relevant settings [like access this computer from network, shares etc.]

Best regards,
Manfred Braun

(Private)
Mannheim
Germany

mailto:_manfred.braun_@manfbraun.de
(Remove the anti-spam-underscore to mail me!)

Re: DCOM access try after connecting the internet by Gerard

Gerard
Mon Apr 26 07:19:54 CDT 2004

I am experiencing exactly the same problem. I'm running XP Home SP1
automatically updated via Windows Update, up-to-date E-trust antiviruse. A
search through Google shows numerous similar unsolved cases....Apparently,
folks are being experiencing this since March 31st .... Would be good to
hear something from MS on this.



Re: DCOM access try after connecting the internet by Karl

Karl
Mon Apr 26 10:34:59 CDT 2004

What error message are you getting?

Is your machine fully patched? Go to http://windowsupdate.microsoft.com to
check. It could be that you're missing one or more RPC / DCOM patches used
by Blaster / Welchia / Nachi worms. If you're not patched, when you go on
the Internet, a worm makes your RPC / DCOM service halt, which causes
problems for your RPC and DCOM reliant applications.


"Gerard Manvussa" <germanvu@hotmail.comremovethis> wrote in message
news:408cfe6d$0$22854$626a14ce@news.free.fr...
> I am experiencing exactly the same problem. I'm running XP Home SP1
> automatically updated via Windows Update, up-to-date E-trust antiviruse. A
> search through Google shows numerous similar unsolved cases....Apparently,
> folks are being experiencing this since March 31st .... Would be good to
> hear something from MS on this.
>
>



Re: DCOM access try after connecting the internet by Gerard

Gerard
Mon Apr 26 12:40:16 CDT 2004

I finally got rid of this problem by firewalling my internet connection.
However, I answer your questions :

> What error message are you getting?
The ONLY visible symptom is that system event log is flooded with event
10003 :
"Access denied attempting to launch a DCOM Server.
The server is:
{00020906-0000-0000-C000-000000000046}
The user is Unavailable/Unavailable, SID=Unavailable"
where {00020906-0000-0000-C000-000000000046} stands for MS Word.

> Is your machine fully patched?
Yes.



Re: DCOM access try after connecting the internet by Gerard

Gerard
Wed Apr 28 10:32:23 CDT 2004

> The ONLY visible symptom is that system event log is flooded with event
> 10003 :
Not true : another symptom is that the security event log shows numerous
null sessions (anonymous logon) originated from outside (workstation names
unknown on the local network). Those null sessions and the 10003 events
disappear as soon as I enable the firewall and come back when I disable it.



Re: DCOM access try after connecting the internet by anonymous

anonymous
Wed Apr 28 14:01:04 CDT 2004

I have the same problem all patches etc. wish someone knew
i ran windows updates and installed all, scanned and no viruses. the key also is word. if you find out please post
are there seperate patches to install not picked up by running windows update

----- Gerard Manvussa wrote: ----

> The ONLY visible symptom is that system event log is flooded with even
> 10003
Not true : another symptom is that the security event log shows numerou
null sessions (anonymous logon) originated from outside (workstation name
unknown on the local network). Those null sessions and the 10003 event
disappear as soon as I enable the firewall and come back when I disable it