stewer, OK, I see what's happening. It accesses the local network and sends requests on Port 11423. And then it opens a Listening port on 11423. ZA correctly identifies the outgoing as a local network access. But the listening as it's to all URL addresses (.) not just limited to the loacl network, gets classified as Internet Access I assume. So it's not anything to be alarmed about - other than its sets off alarms! Re the DCOM removal instructions above: Steve Gibson at www.grc.com has The DCOMbobulator to do this. It'll run a test, and disable / re-enable DCOm on a click of a button. Small program (29KB), no install, just run it. Most significantly it'll also test whether M$ patch worked or not if you've installed it. Includes full instructions.