Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: fidmas on December 19, 2011, 02:50:18 PM

Title: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 02:50:18 PM
Recently, I see:
Event ID: 4226
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

in the Event Viewer at every start-up, and only at start-up.  after scanning 6 ways to sunday, and finding no worms, I tried disabling avast 6.0.1367 and rebooting.  No problem.

Setting "load avast! only after other services" helps some, in that I don"t see this event at start-up sometimes.

I'd like to increase this "a little", but everything I see on the net, to do this, contains malware.

XP(SP3)

Any ideas anyone?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: bobo1 on December 19, 2011, 03:13:10 PM
Are you running bit torrent software? can cause this.
Run Malware bytes free to check for spyware?
Have you run a avast boot time scan?.
Def a malware process going off.
I have no issues
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: YoKenny on December 19, 2011, 03:30:00 PM
I do not see any Event ID: 4226 events on my XP Pro system.

Have you updated to avast! 6.0.1367  ???
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 03:57:30 PM
Are you running bit torrent software? can cause this.
Run Malware bytes free to check for spyware?
Have you run a avast boot time scan?.
Def a malware process going off.
I have no issues
Wouldn't touch Torrent with a 10' stick!

Ran Malwarebytes but I'll do it again.  Takes 5.5 hours.

Avast Boot time scan 2 days ago.  Didn't find anything, but I'll do it again.

Again: Only on Start-up and no event triggered if avast is disabled!!

Yes: avast 3.0.1367.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: xtinguish on December 19, 2011, 04:53:41 PM
This is an easy problem to remedy.  It's because windows sets a very low limit for half open connections and this is easily reached when downloading via torrents. The best thing to do, is to increase the number of half open connection to 100 and this will allow torrents to download faster without breaking your new limit. it's a well known problem and requires a very small download to correct it. I have also encountered this when not downloading torrents due to various programs updating at start-up but would suggest you don't increase to more than 100.Link below
http://half-open.com/download_en.htm (http://half-open.com/download_en.htm)
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: CraigB on December 19, 2011, 04:57:36 PM
This is an easy problem to remedy.  It's because windows sets a very low limit for half open connections and this is easily reached when downloading via torrents. The best thing to do, is to increase the number of half open connection to 100 and this will allow torrents to download faster without breaking your new limit. it's a well known problem and requires a very small download to correct it. I have also encountered this when not downloading torrents but would suggest you don't increase to more than 100.Link below
http://half-open.com/download_en.htm (http://half-open.com/download_en.htm)
Doesn't the OP say there not using torrents  ???
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: xtinguish on December 19, 2011, 04:59:50 PM
@ craigb. If you read my note, you will see that it can also occur when not using torrents.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: Bluemeanie on December 19, 2011, 05:14:49 PM
I see these from time to time as well. I've also heard that a poorly configured web page can cause this as well. Seeing this thread now, and looking again, I see that I'm getting them now at bootup as well, but not every time. And no torrents here at all, also just ran Malwarebytes and SAS and they're clean. So, is this something to even be concerned about?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: Pondus on December 19, 2011, 05:21:59 PM
Quote
Ran Malwarebytes but I'll do it again.  Takes 5.5 hours.
it is not necessary to run full scan   ;).....OBS...always click the update button before you start a scan!
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 05:31:45 PM
This is an easy problem to remedy.  It's because windows sets a very low limit for half open connections and this is easily reached when downloading via torrents. The best thing to do, is to increase the number of half open connection to 100 and this will allow torrents to download faster without breaking your new limit. it's a well known problem and requires a very small download to correct it. I have also encountered this when not downloading torrents due to various programs updating at start-up but would suggest you don't increase to more than 100.Link below
http://half-open.com/download_en.htm (http://half-open.com/download_en.htm)
Thanks.  I'm not using Torrents, that I know of, so can i up to something like 20 first, to see what happens?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 05:32:58 PM
This is an easy problem to remedy.  It's because windows sets a very low limit for half open connections and this is easily reached when downloading via torrents. The best thing to do, is to increase the number of half open connection to 100 and this will allow torrents to download faster without breaking your new limit. it's a well known problem and requires a very small download to correct it. I have also encountered this when not downloading torrents but would suggest you don't increase to more than 100.Link below
http://half-open.com/download_en.htm (http://half-open.com/download_en.htm)
Doesn't the OP say there not using torrents  ???

Where do I look?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 05:39:57 PM
Quote
Ran Malwarebytes but I'll do it again.  Takes 5.5 hours.
it is not necessary to run full scan   ;).....OBS...always click the update button before you start a scan!

Thanks.  Yup. I always update first.  Quick Scan missed one once, at a friend's house, so rather than doing a QS for 1 hour first, I've been starting a Full Scan and going away. :-)
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: xtinguish on December 19, 2011, 05:42:51 PM
Click where it says Half Open Limit Fix.  When you download and run, it will tell you what your half open limit is and you can increase it to a higher level.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 06:24:01 PM
Well, I used the "Half Open" fix to change from 10 to 20, and got the same event on the reboot.  So, I went ahead and made it 100.  I've rebooted now twice with no events.  I'll tell better after some time passes, but it looks good.

As I said, it never did this if I disabled avast, so I have to wonder what avast is doing trying to open that many connections?

Anyway, Thanks for now.  That's the only tcpip.sys patcher on the net that's not infected. :-/
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 19, 2011, 06:56:06 PM
There are alternative solutions than changing the half... limit (which in addition opens security holes).

For the following, please revert back the previous patch/hack to the original Windows default and reboot.

Are you permanently connected? Change that setting in

avast main GUI -> settings -> updates -> "I am permanently connected...".

Try also in that same tab in avast the proxy to "no proxy (direct connection)".

Then reboot and test again.

There are additional tweaks if those are not enough (still, using the default values in Windows, with no need to hack/patch). So please report back.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 08:16:08 PM
OK.  I set "always connected".  It wasn't set before because: Even though I'm using a DSL Gateway, it doesn't power up until at least one machine, on the LAN, powers-up.  It is possible for the router to take longer than the computer to start.

I also set "No Proxy" as you suggested.

I then went back to the TCPIP.sys patcher and reverted to the original file.

Rebooted and got the 4226 event again.  However, I then rebooted 3 more times CLEAN!

IDUNO....  Maybe it's time to sit back for 7 hours, or so, and do another Malwarebytes scan and avast boot time scan. :-(

/Bob
--
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 19, 2011, 09:00:24 PM
I don't think you need to keep scanning.

Please try working as usual for some time. The specific event is not going to prevent from you to use your system. Only in some specific cases, this particular event shows a problem with actual effects.

If some other hardware needs to be turned on before your computer, it may be wise to simply wait an additional minute before turning the system on.

If the event returns after several days of using the system normally, please report back and we'll try more specific additional configurations in avast (which are available, but not directly in the GUI of avast).
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 19, 2011, 09:17:53 PM
I agree.  However I am doing a Malewarebytes scan right now (set to lower priority so I can continue working).  When I get the time, I'll probably do a boot time avast scan for completeness.  Won't hurt! ;-)

Just FYI: I may not have been clear.  The 4226 happend at boot time even when the DSL Gateway was up and happily running for hours.

I'll keep an eye on this and let you know in a couple days, I guess......
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 20, 2011, 03:21:53 PM
Well.  3 reboots and 3 4226 events.  This does not seem to be as consistant if I just bring it up/down/up right away.  It seems some time has to elapse.  Either up-time or down-time.

Any suggestions before I try the "Hack" again, for a day, to see if it really worked?

BTW: Both Malwarebytes and avast boot time scans were clean.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: YoKenny on December 20, 2011, 03:37:26 PM
OK.  I set "always connected".  It wasn't set before because: Even though I'm using a DSL Gateway, it doesn't power up until at least one machine, on the LAN, powers-up.  It is possible for the router to take longer than the computer to start.

I never power down my DSL Gateway so that is probably why I do not see that event.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 20, 2011, 04:10:08 PM
OK.  I set "always connected".  It wasn't set before because: Even though I'm using a DSL Gateway, it doesn't power up until at least one machine, on the LAN, powers-up.  It is possible for the router to take longer than the computer to start.

I never power down my DSL Gateway so that is probably why I do not see that event.

Like i stated before. the event get logget even when the DSL Gateway has been up and running for hours.  This has nothing to do with it.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 20, 2011, 04:59:14 PM
Settings -> updates -> "I only connect with dial up modem".

I know this is not your case, but the change may influence the number of connections (hence, the event may decrease too).

Also, avast settings -> troubleshooting -> "load avast services only after other system services".

Save those changes and reboot.

Remember to wait 10 minutes before testing. Do NOT force updates.

Additionally, do you have any other tools with autostartup?


About the hack, you should consider that it is a hole in your security. Since you are not using P2P, there shouldn't be any reason to change this setting.

Please report back.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: Tetsuo on December 20, 2011, 06:31:09 PM
Even if the OP should decide to use p2p clients, this particular Event will not have any serious effect in real life - just a little slowdown in downloading for a couple of minutes at boot time.

He should just ignore it - providing that he is sure that the system is clean, with no malware.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 20, 2011, 07:56:00 PM
Settings -> updates -> "I only connect with dial up modem".

I know this is not your case, but the change may influence the number of connections (hence, the event may decrease too).

Also, avast settings -> troubleshooting -> "load avast services only after other system services".

Save those changes and reboot.

Remember to wait 10 minutes before testing. Do NOT force updates.

Additionally, do you have any other tools with autostartup?


About the hack, you should consider that it is a hole in your security. Since you are not using P2P, there shouldn't be any reason to change this setting.

Please report back.

I'll try that.  You sure avast will still see the connection for updates?

There are a couple things set to run at startup, but nothing that touches the internet, with the exception of an email checker that waits 4 minutes before checking.  This event always happens before I can even get to the Event Viewer.  It occurs right after "The Event log service was started." and before "The Terminal Services service was successfully sent a start control.".

Wait 10 minutes before checking - what?  If it's there, it'll be there right after boot-up.

I'll make the change and shut down for lunch and report back.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 20, 2011, 08:08:08 PM
Even if the OP should decide to use p2p clients, this particular Event will not have any serious effect in real life - just a little slowdown in downloading for a couple of minutes at boot time.

He should just ignore it - providing that he is sure that the system is clean, with no malware.

I agree this could be ignored.  It seems that startup is now taking about 20 seconds longer before the XP "Connection" icon appears in the tray.  IDUNO......

After scanning my brains out, I'm convinced the machine is clean.  Besides, wouldn't a worm pick a better time to call out, other than at boot-up, before anything stabilizes, and never again?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 20, 2011, 08:59:20 PM
OK ady4um.  I checked "connect via dialup" and unchecked "always connected". I would have thought they would be mutually exclusive but.....

Shut down for 17 minutes. and there's the same event at bootup.  Please see attached picture.  And yes, the gateway was left on.

I'm going to disable avast and come down for 17 minutes again.  The last time I tried that I simply did a "Restart".
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 20, 2011, 09:49:39 PM
Results:  Avast disabled.  System shutdown for 17 minutes.  No TCPIP event logged.

BTW: My wife's XP Home machine gets the same event.  I know -- It's on the LAN so it could have got the same infection.  But, if it's not avast, at least avast is pushing it over the threshold.

FYI: I went back in the event log and see one of these randomly, after another random error, since the beginning of time.  It only started triggering on every bootup on December 6, 1011.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 20, 2011, 10:15:55 PM
If anyone has any new ideas, I'm all ears.  In the mean time, i set the max half-open hack to 50.  No more 4226 events.  I know it's a security hole, but I can't imagine a worm being happy with only 50.  Also as I understand it, W7 has removed the limit completely.  Or, is that only an Internet myth?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 21, 2011, 01:51:44 AM
For the update parameters, I meant both at the same time, the dial up settings AND the permanently connected. My guess is that with dial up alone, avast should wait a little longer to try to connect (instead of trying immediately).

To be clear, I don't think this has something to do with some malware, and I still think that opening the value to 50 max connections is worse than having this event listed.

Since you seem to have avast uninstalled, I would run the specific removal utility http://www.avast.com/uninstall-utility (http://www.avast.com/uninstall-utility) for avast under Windows Safe Mode. Run it more than once. Each time, select a different version / edition of avast, until you cover each and all versions you ever had.

Then manually clean any (hidden) folder containing "avast*" or "alwil" in the folder's name.

In Windows Normal Mode, reinstall the latest stable avast and reboot.

Now delete any and all firewall rules related to web browsers and to avast.

Set again the dial up setting, the "load services only after other services", save and reboot.

If the event returns back, I'll give you a manual change to the avast.ini file to delay the update attempt and we'll try that, but this should be only as a last choice.

Of course, if you are using another security tool, or if you used / tested another security tool and you uninstalled it, then it would be best to, first of all, run the respective removal utility for that other tool (see my signature's links) so to remove any leftovers that could conflict with avast.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 21, 2011, 02:33:20 PM
For the update parameters, I meant both at the same time, the dial up settings AND the permanently connected. My guess is that with dial up alone, avast should wait a little longer to try to connect (instead of trying immediately).

I'm snowed under today with work but I can experiment with these settings again, although I to think turning Off "Permanently Connected" would be more aggressive.

Quote
To be clear, I don't think this has something to do with some malware, and I still think that opening the value to 50 max connections is worse than having this event listed.

Yeah.  I may just put it back and live with the silly 4226 event.

Quote
Since you seem to have avast uninstalled,

No.  I never uninstalled it.  Just disabled it and re-booted to prove the point.

Quote
I would run the specific removal utility http://www.avast.com/uninstall-utility (http://www.avast.com/uninstall-utility) for avast under Windows Safe Mode. Run it more than once. Each time, select a different version / edition of avast, until you cover each and all versions you ever had.

Then manually clean any (hidden) folder containing "avast*" or "alwil" in the folder's name.

In Windows Normal Mode, reinstall the latest stable avast and reboot.

Now delete any and all firewall rules related to web browsers and to avast.

Set again the dial up setting, the "load services only after other services", save and reboot.

If the event returns back, I'll give you a manual change to the avast.ini file to delay the update attempt and we'll try that, but this should be only as a last choice.

Of course, if you are using another security tool, or if you used / tested another security tool and you uninstalled it, then it would be best to, first of all, run the respective removal utility for that other tool (see my signature's links) so to remove any leftovers that could conflict with avast.

I'll try all this, probably tomorrow.  As for other AV stuff, I had AVG years ago and completely whacked it (including protected Registry keys) before installing avast.  I also cleaned-up avast4 before installing avast5.  I did however just let avast6 do its thing, without removing 5 first.

All this takes a while, so I'll let you know as soon as possible.  Since my wife's machine has the same symptom, I'll probably have to do this twice.  I also have hers set to email me when avast finds something.  I have to remember how I did that. :-/

Thanks again for the ideas.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 21, 2011, 04:59:28 PM
For previous versions of avast, simply run the removal utility several times, selecting each version. Then manually search any folder as already indicated (as some remnant hidden folder may be left anyway) Remember to run the removal utility for avast under Windows Safe Mode.

For firewalls (which I still think is your first suspect), and other security tools (like avg), instead of manually searching for remnants, search for the respective info and removal utilities at this partial list: http://singularlabs.com/uninstallers/security-software/ (http://singularlabs.com/uninstallers/security-software/). Follow the respective instructions for each utility.

Please report back when you are ready.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 21, 2011, 07:51:50 PM
Thank you.  I'll play ASAP and report back.  As for Firewall, I'm just using Windows XP's that has no outgoing protection.  Does that change any of your procedures?  I never worried about spreading any thing since i have never caught anything to spread.  I thought this 4226 could have been the first time, but it's clearly just avast related.

As far as cleanup.  Where else does avast hide folders other than "\Program Files" and "C:\Documents and Settings\All Users\Application Data\AVAST Software"?

Thanks......
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 21, 2011, 10:16:52 PM
Well, I made the time today.  I followed your instructions (only avast6 was there).  Rebooted twice now and Low and Behold everything "seems" cool. :-)  No 4226 events.  At least not yet. :-)

I seem to remember using "AlwaysConnectedWaitSeconds=120" in an .ini file (differant issue -- to wait for the router in the morning, when first powering it up) but forgot where.  Can you tell me where to look for the .ini file?

If this fix holds, I'll cleanup my wife's machine currently displaying the same symptom.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 12:11:38 AM
Think I found it.  "C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\avast5.ini"?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 22, 2011, 01:27:08 PM
(only avast6 was there). 
What do you mean? do you mean you only try the removal utility for avast 6 only?

As far as cleanup.  Where else does avast hide folders other than "\Program Files" and "C:\Documents and Settings\All Users\Application Data\AVAST Software"?

Well, there are application data and might be others. By setting Windows Explorer to show all hidden and system files and performing a search for all the partition, you should be able to find all possible folders. Of course this should be performed after the removal utility and before reinstalling.

Since it seems you already re-installed, I can't say if older drivers may still be conflicting.

About the firewall, I insist. ALL firewalls, enabled or not, should be reviewed for older rules. Even if they seem to be correct, delete them. Aside from having to give new permissions, there is no "con".

Older firewalls and older security tools might be already uninstalled, but running the respective removal utilities for them usually removes the potential conflicts.


"C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\avast5.ini"?

Yes, that's the ini, but I'm not sure the "AlwaysConnectedWaitSeconds=120" is the entry we are looking for to solve your problem. There are other possible entries to delay the first attempt to update after each reboot or reconnections. The entries need to be added manually using notepad (the only allowed program) and then reboot.

Since you performed already several actions, I won't add more info until you report back the current situation (after testing your current settings).
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 02:59:43 PM
Quote
What do you mean? do you mean you only try the removal utility for avast 6 only?

No.  I mean when I installed avast5 i had problems until i "Completely" removed avast4 and reinstalled 5.  When I tried to "Upgrade" to avast6, I had glitches until i "Completely" removed 5 and 6 and reinstalled avast6 from scratch.  Hence, the removal utility could not fine any remnants of older versions because there weren't any.

Quote
Well, there are application data and might be others. By setting Windows Explorer to show all hidden and system files and performing a search for all the partition, you should be able to find all possible folders. Of course this should be performed after the removal utility and before reinstalling.
Yeah, I searched the entire drive for any files, folder, hidden files and folders with "avast' or "alwil" in its name.  Found no "alwil", but did find some "_avast_" folders and an "avast??.scr" in c:\Windows.  I killed them all.
Quote
About the firewall, I insist. ALL firewalls, enabled or not, should be reviewed for older rules. Even if they seem to be correct, delete them. Aside from having to give new permissions, there is no "con".

Older firewalls and older security tools might be already uninstalled, but running the respective removal utilities for them usually removes the potential conflicts.
Ok but <groan>.  Comodo was on this box over 4 years ago.  When I removed it, I killed all of its folders and protected registry keys, by hand, tediously, by hand.  There is nothing else "running" here except the default bare bones Windows XP Firewall.
Quote
Yes, that's the ini, but I'm not sure the "AlwaysConnectedWaitSeconds=120" is the entry we are looking for to solve your problem. There are other possible entries to delay the first attempt to update after each reboot or reconnections. The entries need to be added manually using notepad (the only allowed program) and then reboot.
Well, I used it, and all looks good, except I've been up for an hour so far this morning, and the last "Update attempt" was 12/21/2011 3:22:57 PM EST yesterday.  I'm going to play with the "connect via modem" option and see what happens.  The "Auto-update" is set for every 240 minutes.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 03:25:55 PM
Update:  I turned on "Always connected" option also, did a Restart and left the room.  When I got back, the database was updated.  However, the router was obviously left on.  I'll need to wait long enough for for a router-on, Windows-startup, avast-update, to tell for sure.  Probably in the morning.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 04:49:54 PM
Quote
About the firewall, I insist. ALL firewalls, enabled or not, should be reviewed for older rules. Even if they seem to be correct, delete them. Aside from having to give new permissions, there is no "con".

Older firewalls and older security tools might be already uninstalled, but running the respective removal utilities for them usually removes the potential conflicts.
OK.  Done.  Nothing found.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 22, 2011, 05:36:41 PM
Yeah, I searched the entire drive for any files, folder, hidden files and folders with "avast' or "alwil" in its name.  Found no "alwil", but did find some "_avast_" folders and an "avast??.scr" in c:\Windows.  I killed them all.

I assume you first ran the uninstall of avast from control panel, then the removal utility under windows Safe Mode, then you rebooted, and *then* you manually searched for those remnants (that shouldn't be left there, but let's leave that issue aside).


Quote
Comodo was on this box over 4 years ago.  When I removed it, I killed all of its folders and protected registry keys, by hand, tediously, by hand.  There is nothing else "running" here except the default bare bones Windows XP Firewall.

That paragraph is not exactly in line with what you wrote a couple of posts after it, so I'll repeat this once more. The "by hand" cleaning work is only adequate when looking for something specific AND you know exactly what you are doing. In any case, the "by hand" cleanup should be done AFTER running the respective removal utility (for Comodo in this case).

In addition, Comodo has a Firewall + additional tools installation. Even when you install part of the tools or the firewall only, other files may be copied to the system anyway.

The same happens with preinstalled software. Even if you don't accept to effectively install and use some preinstall security tool, we know the remnants are left there.

So for both cases, searching for the respective relevant removal utilities is still important. In your case, you currently have a non-critical issue, but according to your previous posts, there might be something that may be still conflicting with the normal avast's drivers and services.

A partial list of removal utilities (and please read the respective info for each case) is located at http://singularlabs.com/uninstallers/security-software/ (http://singularlabs.com/uninstallers/security-software/).

If you already ran the relevant removal utilities (as I *might* be understanding from other posts, but I am not completely sure about it), then no problem.

Regarding the Windows Firewall, you already mentioned you have it disabled. It would take you a couple of minutes to get to the advance properties, reading the rules and deleting anyone related to web browsers or to avast.

Continue your testing and let us know how they finally result.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 09:04:00 PM
I give up.  I wrote a lengthy reply, with attachments.  My attachments were rejected along with the reply.  As far as I can tell, everything you want has been done.

Windows Firewall IS running and has been running for years, just the way avast wants it.  i can't show you the pictures of the settings because this forum won't let me attach the 4 compressed JPGs..

I'm not going to compose a reply to every point again.  I guess you'll have to believe me.  I've been a System Engineer for going on 40 years.  I don't consider myself an idiot.

If I get the time later to rewrite the original reply, point by point, I will.  Right now I need to get back to work.

Thank you for your help.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 09:17:25 PM
Firewall settings 1.

Need explanation -- Ask.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 09:19:16 PM
Firewall settings 2.

Need explanation -- Ask.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 09:20:39 PM
Firewall settings 3.

Need explanation -- Ask.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 22, 2011, 09:53:18 PM
Resume:
In avast -> settings

-> troubleshooting -> "load avast services only after other system services".

-> updates -> "direct connection (no proxy)".

-> updates -> "dial up connection" (should reduce the number of connections).


In addition, may or may not imprve you situation (you need to test it):

-> updates -> "permanently connected"


Save avast settings.

In avast5.ini (using notepad only, as any other program will be rejected by avast self defense module):

Code: [Select]
[InetWD]
AssumeAlwaysConnected=1
AlwaysConnectedWaitSeconds=300

(Note: the value "300" would mean 300 seconds = 5 minutes after first connection.)

For avast5.ini, I think there were additional possible options to be manually added, but I currently can't remeber them.

About the firewall pictures, you seem to have the LAN enabled in your firewall but the http(s) traffic disabled?
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 11:14:02 PM
Resume:
In avast -> settings

-> troubleshooting -> "load avast services only after other system services".

-> updates -> "direct connection (no proxy)".

-> updates -> "dial up connection" (should reduce the number of connections).

As it is/was.
Quote
In addition, may or may not improve you situation (you need to test it):

-> updates -> "permanently connected"
Actually I didn't get auto updates for 11 hours until I set this.  Rebooted and they came right down.  Dialup connections are hard to detect.  At least the one time I tried to code for it.  We'll see.

Quote
In avast5.ini (using notepad only, as any other program will be rejected by avast self defense module):
I did, but I didn't know that.  I would have just gone to Safe Mode. :-)

Quote
Code: [Select]
[InetWD]
AssumeAlwaysConnected=1
AlwaysConnectedWaitSeconds=300

(Note: the value "300" would mean 300 seconds = 5 minutes after first connection.)
I had 240 but another minute can't hurt. :-)
Quote
For avast5.ini, I think there were additional possible options to be manually added, but I currently can't remember them.
Well, so far so good.  No 2446 events since I did the clean install.  We'll see better tommorrow when the Gateway and this computer get power at the same time.  i haven't "SEEN' the green "Updated" popup yet, but the updates are happening.  I could have been out of the room.  Tell better in the morning.  I'll also try EICAR.
Quote
About the firewall pictures, you seem to have the LAN enabled in your firewall but the http(s) traffic disabled?
Well, this machine doesn't/shouldn't "serve" anything on the internet.  Most of those are XP defaults, as I recall.  The REAL firewall is in the Gateway.  See attached.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 22, 2011, 11:59:35 PM
I may not have made that clear.  The Local Area Connection "IS" the DSL-Gateway.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 23, 2011, 03:35:41 PM
As expected, I dowered up this morning, which applies power to the DSL-Gateway/Router/whatever.  Everything comes up with no drama.  See attached.  5 minutes later, avast updated just fine.  So, i think we can call this resolved.

Since my wife's machine, on this little LAN gets the same 4226 events, I'll do the same on hers.  I don't expect a problem, but I'll yell if I have any.

Over the years I've been using avast, I love it, but seem to find that program updates never really go smooth.  Version 4 to 5 required a cleanup and fresh install.  Version 5 to 6 required a cleanup and fresh install.  Now, with this last upgrade to 6.0.1367 the 4226 events at boot-up showed up.  A cleanup and reinstall fixed it again.  Not an insult I hope.  Just a question.  Do you see many others with this inability to do smooth program updates?

Anyway, Thanks again for the help and Merry Christmas. :-)

/Bob
--
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: ady4um on December 23, 2011, 05:55:21 PM
Well, I can't really say if I see many with program updates not functioning at all.

First, I am just a common user. I don't work for avast, so I don't really know any stats. I could only base my guess only on what I see here in the forum, which is not a good measurement. Users don't usually post "my program update was fine", except for some few forum users when testing beta versions (which is nothing when comparing with the whole user base of avast).

Moreover, most program update issues are usually resolved with a couple of posts, since usually the problem is solved with very few simple steps.

About my own personal experience in my own system, I am still using the same old path of avast 5, since the update from 5 to 6 was successful.

I'm not saying there were no "bumps" at all, but in several years of using avast I have only cleaned previous installations so to make clean new ones only twice, and the reasons were not necessarily related to avast.

Since you haven't specified what exactly was the problem when updating from avast 5 to 6, I can't tell you if there was some simpler solution other than a complete clean install anew. It is possible the solution was simpler than that, but we will never know now :).

Since I am still using the old path, I will probably clean up the old installs before the upgrade for avast 7. So that would be my third time, and this time will not be related to any problem at all, but just to reduce the chances of potential future conflicts and to be more helpful to other forum members by having a similar installation as theirs.

I'm glad you have no more issues. Let us know if you find more issues in the future.
Title: Re: Event ID: 4226 TCP/IP has reached the security limit imposed... At Boot-up
Post by: fidmas on December 23, 2011, 06:25:42 PM
I just got done doing the same thing to my wife's machine.  This time to the letter of your instructions.  She had a lot more to clean up.  I guess I wasn't doing my job maintailing that box. :-0  All seems perfect there now also.
Quote
Since you haven't specified what exactly was the problem when updating from avast 5 to 6, I can't tell...
Geez.  I don't remember.  I don't remember every fire like you must.  People ask about my own software, and I have to go look in my Edit History if it's been more than a month. :-)

Anyway, I think a fresh install will be the rule after this.

I'll never really know what avast had to do with that half-open threshold exceeded, but it's gone now.

Thanks again,
Bob
--