Mysterious connections

cmdagent.exe and cmdinstall.exe keep sending requests on UDP port 53 even though I disabled all online functionality. The connections are looking for example for

It should be possible to disable these connections somewhere in the settings because they pollute my Wireshark captures. I know I can create blocking rules for cmdagent.exe and cmdinstall.exe but that prevents other on-demand online functionality.

Please help.

Has anyone investigated this?

Steps to reproduce:

Install a clean Windows 7 SP1 64bit machine.

Perform all windows updates.

Download Comodo Internet Security from

Disconnect computer from internet.

Start the Comodo Internet Security installer cispremium_installer.exe

Untick “I want to enable Cloud Based Behavior Analysis”.

Untick “Send anonymous program usage”.

Customize installation, untick “COMODO Antivirus”, untick “COMODO GeekBuddy”, untick “Chromodo Browser”.

In Configuration Options, untick “Do not show alerts that request…”.

Continue with installation and untick “I want to enable Comodo DNS servers”, untick “I want to help COMODO”.

Agree and install.

Reboot computer.

Untick “Check for program updates”.

Untick “Check for database updates”.

Remove all rules from Firewall Application Rules.

Untick “Enable Cloud Lookup” in File rating settings.

Connect computer to internet.

Observe cmdagent.exe and cmdinstall.exe trying to access the internet for mysterious reasons.