Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: lespea on May 03, 2005, 12:20:06 AM
-
I came back to my computer after the avast screen saver had been running for a while and I was quite surprised to see that that sygate (firewall) had caught some packets that avastss.scr (avast screensaver) was trying to send to 224.0.0.22 and I am quite curious as to why it would need to send anything. The only meaningful thing pulled out of the hex was SUBSCRIBE /Lay so I don't know if it is an anti-crack thing or something checking to verify it's register or something. Anyways I'm going to block it until I know more information, if any of you know anything about this, as I couldn't google any good info. Thanks in advanced to anybody who knows what this's for.
Adam
-
So none of the devs know why it needs to broadcast?
-
I don't think the screensaver needs, or even should, send anything out.
Are you sure it's really the screensaver process? (could it be e.g. some hook loaded into the process?)
-
Hmm not sure, in retrospect I probably should have saved my firewall log for future reference :/. I've only seen it once and when it did come up I just looked at the IP and process broadcasting. Next time it comes up I'll post an update, I just initially thought it was some sort of update thing or something maybe, or like I said before checking to make sure it was registered or something.
-
I just initially thought it was some sort of update thing or something maybe, or like I said before checking to make sure it was registered or something.
While updating yes, avast! will connect (even to check against piracy)
But the screensaver module? In fact, I have never seen this in my firewall.
Some packets that avastss.scr (avast screensaver) was trying to send to 224.0.0.22 and I am quite curious as to why it would need to send anything.
Which is your screensaver (set into avast screensaver module)?
Some screensavers send packets...
-
224.0.0.22 is not a broadcast address, it is a multicast address. It is an address used by IGMP, or Internet Group Management Protocol. Some process on your machine is trying to join a multicast group and is sending an IGMP report to the address to which all IGMP-capable routers must listen.
I have no idea why Avast screensaver would be participating in IGMP. It's most likely something else.
John
-
I have just the defualt xp pic slideshow as my screensaver combined with the avast screensaver. Yeah I guess I should have realized that it was a multicast address, perhaps I should pay more attention in my networking class :/ lol. Still kinda wondering why it was sending it though, but like I said it only happened once and I was just kinda taken back by it and posted here... without saving the log :(... so maybe I mis-read it or something.