Port use TRIPLICATION with Avast / Running out of system ports!

[nitram_cero]

If you are using uTorrent (or any highly intensive port using program) and Avast and weird things happens, maybe this can help you:

I noticed that Avast does packet analisys by "sandwitching" ports. I'll explain:

Aparently Avast hooks any program conections to itself (using 2 ports: for connect and listen) and a third one "pops from a system process 0" to the real destination.

When this happens to uTorrent (which has a lot of connections) it hogs the system and USES UP ALL AVAILABLE PORTS!
Almost none of the programs are verbose enough to tell you this. I ran into this answer by mere luck, as the aMSN (3rd party MSN client) wasn't able to login to my account because there were no ports left, getting the error message directly from the WinSock API.

Something I noticed (using "cport" tool) was that a lot of connections were in the FIN_WAIT_2 state. That mean's they are waiting for the "other side" approval to finally kill it, or for timeout.

I have "P2P Shield" off, but I think this comes from the "Web Shield" module.

Any solutions?
Thanks!

Regards
-Martín

[alanrf]

Which ports were in use by your P2P client?

avast, under normal circumstances knows nothing about the ports used by P2P clients and certainly does nothing to deliberately intercept those ports.

You may have a point when it comes to P2P clients using the well known ports usually associated with other functions (for example port 80 typically used for http, ports 110, 25 and 143 usually used for email and port 119 for NNTP).  If the avast providers for these services (Webshield and Internet Mail) are running they may be involved.

What is a much more likely source of problems is the incomplete removal of an earlier antivirus product that is causing a repetitive loop condition.

What was your previous antivirus - and how did you remove it?   

[nitram_cero]

Fresh install (WinXP SP1 patched to SP2), and then Avast Home! (Free).
I've been using it for a long time now (two years to say the least) and I really like it.

This never happened before, maybe a newer release is doing so.
It's most likely to happen when I leave uTorrent, Firefox & aMSN open for long periods of time (days, a week, etc.).

The port use is normal right now. Sorry, when this issue happens to me again, I'll post more info and screen captures.

I was just reporting it, maybe someone else is having the same problems.

EDIT: Maybe it has something to do with UPNP or Windows Firewall?

Regards
-Martín

[Lisandro]

If you pause WebShield, does it solve the problem?
Did you change the default ports into WebShield settings (redirection)?

[nitram_cero]

I haven't tried. As soon as it happens again, I'll try.
Thanks!

[nitram_cero]

Yes, it solves it.

Apparently it was something with Firefox 3 instead of uTorrent, I had a lot of opened tabs and they kept their connections alive for some weird reason.

The weird thing is that "out of ports" message. I'm of course not using the 64k ports... maybe Win XP has something to do with it

Sorry for the trouble and thanks for your quick answers.
-Martín

[Lisandro]

Apparently it was something with Firefox 3 instead of uTorrent, I had a lot of opened tabs and they kept their connections alive for some weird reason.

Sometimes, closed connections in Firefox are kept by some "seconds"... Strange uh?