Mpcmdrun.exe

[apached]

I keep getting a message that the Application MpCmdRun.exe is trying to access the Internet.
The destination IP: 209.87.209.52 DNS.
Is there some way to find out why it is being activated?
Any help appreciated.
apached

 

[tashi]

Hello.

mpcmdrun.exe is a process belonging to Microsoft Windows Defender Antispyware. It is a real time monitoring component required for signature updating.

The IP belongs to Zone Labs, home of the ZoneAlarm firewall.

 

[apached]

Hi Tashi,
Thanks for your reply.
"real time monitoring component required for signature updating"
Not sure what that means. Why is it reporting back to Zone Labs.
Does it mean that the Antispyware application has found spyware? Why does it not inform the user so that the user can take action to destroy the spyware?
What is the best course of action?
Sorry, I am not very computer savvy.
apached

 

[tashi]

Hi there.

Hi Tashi,
Thanks for your reply.
"real time monitoring component required for signature updating"
Not sure what that means. Why is it reporting back to Zone Labs.

If you have Windows Defender installed with automatic updating, the program is checking for the latest definitions. Which updates the program in order to give one the latest protection.

For instance, an anti virus program often updates several times a day.

What firewall are you using?

 

[apached]

Hi Tashi,
Thanks for the explanation. The frequent access attempts worried me because I thought it was the result of spyware activity.
I just have Windows firewall switched on, but it is Zone Alarm which provides the warning with a request to allow or deny access.
Also get requests from Adobe and MS Excel every time a pdf file or excel spreadsheet is opened.
apached

 

[tashi]

Hi apached

I just have Windows firewall switched on, but it is Zone Alarm which provides the warning with a request to allow or deny access.
Also get requests from Adobe and MS Excel every time a pdf file or excel spreadsheet is opened.
apached

Zone Alarm Firewall must be installed and running then.
Rule of thumb is one Firewall/one Anti-Virus. To avoid conflicts, system instability and loss of program efficiency.

Let's take a look at the system, please post a HJT log in our Malware Removal Forum

Instructions to produce a log are here: "BEFORE you POST"(READ this Procedure before Requesting Assistance)

For now, skip the steps to run the Spybot-S&D/Anti Virus scans. The HJT log will assist in making an analysis and assessing the programs installed.

Let me know when you have posted, and I will ask one of our helpers to take a look.

Cheers.