application filtering problem

[paolo_italy]

hi,
my problem is with LnS 2.06 (17/05/2007) and the LnS window don't show and don't ask me anything.
:-[

Help me please.

Paolo

[Climenole]

Hi paolo_italy :)

Try first to upgrade to the most recent version:

A new 2.06p3 version is available (http://www.wilderssecurity.com/showthread.php?t=216027)


Hope this help: let us know.

:)

[paolo_italy]

many thanks,
but after upgrade i received error msg and application filtering don't work again.

Bye

[Climenole]

Hi paolo_italy :)

Check this article on the Official LnS FAQ:

problems with driver remove (http://www.looknstop.com/En/faq_problems.htm#driver_remove)

Follow exactly the procedure.

I suggest you to used this tools for Registry searching:
RegSeeker (http://www.hoverdesk.net/freeware.htm)

- Check the backup option before
- don't "clean" the registry but search with specific words
such as LnS, lnsfw, S4E_LNS...

I guess the best and easier solution for you is to make a clean install.

Hope this help: let us know.

:)

[Frederic]

Hi paolo_italy

This error indicates a problem in the registry which prevents the driver to run (and to be installed) properly.

Actually it is the lnsfw1 driver, so what suggested Climenole will not help (because the mentioned procedure is for lnsfw driver).

To identify the issue with the registry you should run the LoadOrder utility from Microsoft:
http://technet.microsoft.com/en-us/sysinternals/bb897416.aspx

Then highlight the PNP_TDI drivers like this:
202957

Thanks,

Frederic

[Climenole]

Hi Frederic :)

Oups !!! :-[

I hope paolo_italy will read your post before doing the "cleanup"...

:blink:

[paolo_italy]

Thank you to all,

this is log:


System PNP_TDI 31 lnsfw1
System PNP_TDI 27* NetBT NetBios su Tcpip
System PNP_TDI 26* Tcpip Driver protocollo TCP/IP

Automatic PNP_TDI n/a* WS2IFSL Ambiente di supporto del provider del Servizio Non-IFS di Windows Socket 2.0


Bye

[Frederic]

The order must be:
TcpIp
Lnsfw1
Netbt

So probably the problem is coming from the bad order you have.

This is configured through the registry with [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderList] key and the PNP_TDI value.
Could you export this key to a file, open it as a text file, and copy paste here, just the PNP_TDI value ?

Did you install/remove another application related to the network ? It seems someone has broken this key.

Regards,

Frederic

[paolo_italy]

"PNP_TDI"=hex:1e,00,00,00,02,00,00,00,1c,00,00,00,04,00,00,00,05,00,00,00,06,\
00,00,00,07,00,00,00,08,00,00,00,09,00,00,00,0a,00,00,00,01,00,00,00,0b,00,\
00,00,0c,00,00,00,0d,00,00,00,0e,00,00,00,0f,00,00,00,10,00,00,00,11,00,00,\
00,12,00,00,00,13,00,00,00,14,00,00,00,15,00,00,00,16,00,00,00,17,00,00,00,\
18,00,00,00,19,00,00,00,1d,00,00,00,1e,00,00,00,1f,00,00,00,20,00,00,00,21,\
00,00,00


thank you very much for your interest

Paolo

[Frederic]

The problem is the tags for TcpIp (26/1A) and NetBt (27/1B) are not in that list.
This is also why there is a * in LoadOrder for these drivers (and it is not normal).

You can try to fix that with the following entry (3 modifications in bold):
"PNP_TDI"=hex:20,00,00,00,02,00,00,00,1c,00,00,00,04,00,00,00,05,00,00,00,06,\
00,00,00,07,00,00,00,08,00,00,00,09,00,00,00,0a,00,00,00,01,00,00,00,0b,00,\
00,00,0c,00,00,00,0d,00,00,00,0e,00,00,00,0f,00,00,00,10,00,00,00,11,00,00,\
00,12,00,00,00,13,00,00,00,14,00,00,00,15,00,00,00,16,00,00,00,17,00,00,00,\
18,00,00,00,19,00,00,00,1d,00,00,00,1e,00,00,00,1a,00,00,00,1f,00,00,00,1b,00,00,00,20,00,00,00,21,\
00,00,00

Modify the .reg file, and execute it, to have it written to the registry.

Run again LoadOrder and you should get:

System PNP_TDI 26 Tcpip Driver protocollo TCP/IP
System PNP_TDI 31 lnsfw1
System PNP_TDI 27 NetBT NetBios su Tcpip

Then reboot, and normally the application filtering should be working again.

Regards,

Frederic

[paolo_italy]

You've been fantastic
I resolved

:D

I would give you a kiss but unfortunately I have "classic" taste

;D

See you soon

Paolo

[Climenole]

Hi Frederic :)

Wow ! You're a Genius! :o Thank you for these posts. I learned a lot today.

:thumb:

:)

[Frederic]

Thanks Paolo and Climenole :)

What I would like to know is how the registry could be corrupted that way ???
I don't think it is caused by Look 'n' Stop.

Paolo, how the problem appeared exactly:
1- just after the very first installation of Look 'n' Stop
2- Look 'n' Stop was working properly for a while, and you installed/uninstalled some other application (or you used an uninstall tool, or you did a restoration) and then the Application Filtering stopped to work
3- Look 'n' Stop was working properly for a while, and the problem appeared suddenly, with no special event that could be the cause of the issue

Thanks,

Frederic

[nuser]

Hi, Frederic,
1, what's the difference between lnsfw1 and lnsfw? (lnsfw1=TDI filter, lnsfw=NDIS filter?)
2, in your snapshot, tcpip6 is loaded after lnsfw1. Does it mean that lns can't filter ipv6?

[Frederic]

Hi nuser,
-{ Quote: "Hi, Frederic,
1, what's the difference between lnsfw1 and lnsfw? (lnsfw1=TDI filter, lnsfw=NDIS filter?)
" }-
Lnsfw1 is for the Application filtering.
Lnsfw is for the Internet Filtering.
-{ Quote: "
2, in your snapshot, tcpip6 is loaded after lnsfw1. Does it mean that lns can't filter ipv6?" }-
This screenshot comes from an XP machine, and it is true the application filtering doesn't support IPV6 for XP but only for Vista (this is in the 2.06 changelog).
Now, I'm not sure the reason it doesn't work for XP is simply the load order.

Frederic

[Frederic]

-{ Quote: "Now, I'm not sure the reason it doesn't work for XP is simply the load order." }-
I've just checked that and it seems modifying the load order to have Tcpip6 driver loaded before lnsfw1 is finally sufficient to have an IPV6 connection detected by the application filtering (at least a "telnet IPV6@" was detected).

Frederic

[nuser]

-{ Quote: "I've just checked that and it seems modifying the load order to have Tcpip6 driver loaded before lnsfw1 is finally sufficient to have an IPV6 connection detected by the application filtering (at least a "telnet IPV6@" was detected).

Frederic" }-
Hi, Frederic,
To rearrange the load order of drivers, is the only way to manually reset the registry entries? Seems Loadorder can only display the loading order, not resetting.

In Loadorder, I don't find lnsfw.sys, only lnssvc.exe. Is this normal?

thanks:)

[Frederic]

-{ Quote: "Hi, Frederic,
To rearrange the load order of drivers, is the only way to manually reset the registry entries?
" }-
Yes, this is the only way I know. Maybe some applications are doing that, but I don't know them.
-{ Quote: "
Seems Loadorder can only display the loading order, not resetting.
" }-
Yes, LoadOrder just reads the registry and shows the driver order in a friendly way.
-{ Quote: "
In Loadorder, I don't find lnsfw.sys, only lnssvc.exe. Is this normal?
" }-
I don't know why the other driver (note that the registry key is "SFilter" instead of lnsfw) is not in that list.
Since all entries from [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services] are not there, probably LoadOrder is using another information.

Frederic

[paolo_italy]

-{ Quote: "Thanks Paolo and Climenole :)

What I would like to know is how the registry could be corrupted that way ???
I don't think it is caused by Look 'n' Stop.

Paolo, how the problem appeared exactly:
1- just after the very first installation of Look 'n' Stop
2- Look 'n' Stop was working properly for a while, and you installed/uninstalled some other application (or you used an uninstall tool, or you did a restoration) and then the Application Filtering stopped to work
3- Look 'n' Stop was working properly for a while, and the problem appeared suddenly, with no special event that could be the cause of the issue

Thanks,

Frederic" }-


The problem has been since the first installation but had given no weight

[paolo_italy]

Bye, Paolo