concurrent connections limit in avast

[lukor]

Hi Tech,
what is happening on your computer is, that some software installed (be it Comodo or other security or network related software) is changing the process from which the connections are established.

We have seen such behavior in several firewalls, it usually occurs when the firewall is unable to decide if the connection is valid or not and postpones it until it has more information. Later (and that may be after a millisecond or hundreds of them) it resumes the connection request (but this time the OS might be already executing any other process in the system - or if the firewall is scheduling the connection in certain way the OS is running in it's own process -- the SYSTEM process with PID=4).

This is the whole reason why Ignored processes were "invented" in avast! :-)

Now it remains to identify who is responsible for this.

Since Tech sort of hijacked this thread (  sorry Tech ) I have lost track if the original poster was successful with removing his rootkit - but in that case it was fairly easy - the rootkit was the cause of the problems there.

Tech, do you have Comodo still installed or is it already uninstalled?
What about Hijackthis log? Does it show anything suspicious?

Any rootkit? Gmer does not show anything?

Run Process Explorer and show us the list of loaded DLL in the Internet Mail process. Anything not signed by Microsoft there ?

Lukas

[lukor]

2. Disabling IM provider, with Comodo disabled also, same error.

Tech, this is somewhat strange. Are you suggesting that the "Concurrent connections limit is exceeded" error, which is generated by the Internet Mail provider in avast! is returned even when the Internet Mail provider is terminated???

[Lisandro]

Tech, this is somewhat strange. Are you suggesting that the "Concurrent connections limit is exceeded" error, which is generated by the Internet Mail provider in avast! is returned even when the Internet Mail provider is terminated???

IM provider is not Internet Mail but Instant Messaging
The suggestion was made by alanrf.

Since Tech sort of hijacked this thread

Sorry me...

Tech, do you have Comodo still installed or is it already uninstalled?

It is installed and running.

What about Hijackthis log? Does it show anything suspicious?

I'll do it later. But I'm quite sure I'm clean.

Any rootkit? Gmer does not show anything?

Maxx has already checked it. I'm clean for GMer.

Run Process Explorer and show us the list of loaded DLL in the Internet Mail process. Anything not signed by Microsoft there ?

I'll take a look later, maybe tonight... Thanks.

[lukor]

Tech,
I also believe your computer should be clean. However in this case, the most probable reason is the Comodo itself You are using the latest version (3.0) if I am not mistaken, aren't you. I'll try to search the comodo forum for similar errors.

L.

[Maxx_original]

only some "legal" hooks from Commodo driver were there.

[lukor]

Tech,
can you send me the log file from Internet Mail provider ? (maybe zipped, if it is really that huge) I'll have a look at it - perhaps I might be able to spot the very first connection, if it has in any way different "signature".
Thanks.
Lukas

[lukor]

only some "legal" hooks from Commodo driver were there.

If it is Comodo who is scheduling the connection to the system process - it is, I must admit, legal to do so. Firewall can do that, and we may say that if it does that in every it's configuration it is simply not compatible with our redirect system -- simply because we have no means of identifying the connections that should and that should not be redirected....

On the other hand, if Comodo would do this on every installation we would have already heard about that problem before ... so it must be something special.

[lukor]

As for testing with Wireshark ... I use Wireshark and it may be I do not configure the options correctly but I never see localhost traffic captured by it - perhaps Igor has fuller advice.

Wireshark does not see localhost -- only real packets arriving on the network adapter. (but virtual adapters should work as well - e.g. vmware's)

[Maxx_original]

Tech: can you post a current GMER log as attachment (or to lukor's mail) to let him see, which functions are hooked (and how)? i'm home now and don't have the previous log here..

[Lisandro]

You are using the latest version (3.0)

Yes. On Vista Business 32bits.

can you send me the log file from Internet Mail provider ?

I'll do it.

Tech: can you post a current GMER log as attachment (or to lukor's mail) to let him see, which functions are hooked (and how)? i'm home now and don't have the previous log here..

I'll do it too.

[lukor]

Tech, please see your email. I was able to reproduce the problem here, and I have a short modification in the startup order of aswrdr.sys (via registry) that seems to help here. Can you please test it?

Cheers,
Lukas

regfile.reg:
-----------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aswRdr]
"Start"=dword:00000003

[Lisandro]

Tech, please see your email. I was able to reproduce the problem here, and I have a short modification in the startup order of aswrdr.sys (via registry) that seems to help here. Can you please test it?

Cheers,
Lukas

regfile.reg:
-----------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aswRdr]
"Start"=dword:00000003

I'm about to uninstall Comodo. Do I do this first (before)?

[lukor]

Please test it, it takes you just one restart. It helps on my machine.

[Lisandro]

Please test it, it takes you just one restart. It helps on my machine.

Why we, users, hate to restart?
It did the trick. Solved. I could use Windows Mail & Gmail & avast & Stunnel & Comodo.
Lukas, you've got the day, my hero

[DavidR]

@ lukor
Now we know that works or appears to, exactly what does it do ?

Is it only something that happens with comodo firewall installed or possibly other applications ?

Finally will this registry fix be done in a VPS update or will it need to be added to the next program update ?