nod32 + utorrent = dead router

[napouser]

so this is propably something simple and already mentioned but since i am too retarded to find here it goes

eset internet security with nod32 3.667 business and utorrent 1.8.1 installed and working perfectly
no ports problems no browsing problems or anything else

exept every couple days or so internet goes down completely (lan still working) and i cant even access the router
so after couple of tries i just pull the plug and restart the router

everything works fine again for couple of days (or hours)

friend of mine had the same problem when installed nod32 so he immidietly went back the old 2.7 version something that i am unable to do since it doesnt have firewall. he mentioned that utorrent may cauze "utp flood" or something like that to the router

uninstalling eset security both firewall and antivirus solves the problem
id rather use eset though its faster than most other products

[doktornotor]

Limit the number of connections in uTorrent to more reasonable values. This is a HW limitation issue with the router, not a NOD32 bug.

[napouser]

connections are limited to very low values along with halfmaxopen at 4
besides this only happening with 3.0667 the moment u uninstall it problem stops

[doktornotor]

Originally Posted by napouser

along with halfmaxopen at 4

Uhm... Am I missing something or have you patched TCPIP.SYS to allow 4 half-open connections?!?! Well, that's completely unusable for BT.

Originally Posted by napouser

the moment u uninstall it problem stops

Not really sure what "the moment" means, you've said the issue takes "a couple of days" to reproduce in the previous post.

[napouser]

some times it takes minutes some times up to 20 hours
result is always the same 192.168.1.1 is not responding

problem started 1 month ago - guess how much time i am using 3.667

problem occured 3 times within 2 hours on a friend's pc the day he upgraded to 3.667 obviusly never happened before


tcpip.sys is patched indeed couple years now in order for utorrent to run properly and the router never stopped responding with it - until now

[agoretsky]

Hello,

Try using ESET Smart Security v3.0.672.0 with an unpatched version of the TCPIP.SYS file and see if that makes any difference.

Regards,

Aryeh Goretsky

[napouser]

formatted system
unpatched tcpip
672 eset
not detection of unwated apps
no filtering of most stuff
excluded utorrent and some other stuff


couple days now no issues
seems something of the above did the trick
i bet the tcpip.sys lets see how many versions can utorrent last without patching

thanks for help tho couldnt stand with a different antivirus prog than nod

[agoretsky]

Hello,

You may want to check with the manufacturer of your residential gateway router device. It seems you have uncovered some sort of resource exhaustion bug in their router firmware.

Regards,

Aryeh Goretsky

[Marcin_K]

using uTorrent + ess672 + patched tcp + d-link dsl 524t router/modem and no problem here. same was with d-link 804hv router. as you said, the problem lays somewhere else.

[napouser]

finally after a whole week problem started again
fresh system unpatched tcpip 672 eset utorrent excluded from http scanning

and yes every couple of hours boom router goes dead!!!

11/24/2008 7:58:25 AM Detected TCP Desynchronization attack

many of those in the firewall log before the internet down happened

the moment eset was uninstalled things are smooth again !!!

some1 help me plz

[funkydude]

Originally Posted by napouser

some1 help me plz

Buy a new router. Preferably not the same model.

[napouser]

spend some time reading the above posts before u suggest something stupid

the same problem accurs at a friend of mine reported as utp flood
and both cases resolve the problem when eset security is uninstalled

so let me get this straight, if installing an other security like bitdefender solves the problem why do i have to waste 100$ on a router to experience the same issue again?

[Krank]

Setup > Enter entire advanced setup tree > Web access protection > http, https > Web Browsers > Uncheck uTorrent from the list and click OK.

[napouser]

both utorrent and svchost are excluded by having cross next to them
still issue exists

i might add that issue happens with http filter disabled web access protection disabled , email antivirus antispam protocol filtering and antispyware modules all disabled

also right clicking on system tray icon and disabling both antivirus and firewall doesnt help either!!!!!

seems eset is hardcoded into the system with its stupid system device virtual proxy that probly cauzes the problem

i will leave them all disabled until tomorrow, if without even having security this **** happens again i give up and go back to 2.7 or something

[funkydude]

Originally Posted by napouser

spend some time reading the above posts before u suggest something stupid

It's quite sensible. If you're using Vista SP1 you can uninstall ESS and install the ESS beta v4 since it doesn't use a proxy if you want to prove it to yourself.

[napouser]

oh yea sorry to forgot to mention that i am using xp sp3 not vista

and no i dont find it sensible to install a beta security software into my server


also forgot to mention that firewall is full of logs like 11/24/2008 9:07:05 AM Detected TCP Desynchronization attack xxxxxxxx xxxxxx TCP


might this be the problem?

[doktornotor]

Sigh... Your router is a buggy piece of junk, end of story. If any SW can cause the syndromes you are describing, anyone can DoS you. Go think about this and figure this out with your router manufactures, ktnxbye...

[napouser]

" If any SW can cause the syndromes you are describing"

obviusly u havent read anything before thinking to respond
the only software cauzing this is eset
so let me spell it for ya for the 483920th time:

BITDEFENDER DOES NOT
2.7 ESET DOES NOT
NO SECURITY SOFTWARE AT ALL DOES NOT

SYNDROMES STARTED SEPTEMBER 2008 ABOUT THE TIME I INSTALL ESET 3.0
(so wait my buggy piece of junk (and my friends) was working for 2 years)

is that clear for u?

[doktornotor]

Originally Posted by napouser

obviusly u havent read anything before thinking to respond
the only software cauzing this is eset

So what? Anyone can install ESET and DoS your router; also anyone can write an application simulating the ESET proxy behaviour and DoS your router. You have a router issue to be solved, not a NOD32 one. Screaming in all caps won't make your claims more true, it's just plain rude. Stubbornly refusing to take issues where they belong won't really help you either.

And as a final note, please stop messing with critical OS files if you have no clue how that could affect you. Those TCPIP.SYS patches are there to increase the allowed number of half-open connections for users that need it (workstations used for ICS, heavy torrent users etc.); instead you are decreasing the limit to a completely ridiculous value.

[napouser]

"You have a router issue to be solved, not a NOD32 one"

and that comes from what exactly??
from the fact that a friend of mine has the same issue with different router ?
from the fact that bitdefender firewall works fine without mentioning any dos atacks?
from the fact that 2 years now i never had a problem ?

"So what? Anyone can install ESET and DoS your router; "

i dont mind other people installing eset. i am sure installing eset wont help u more invade my network


"also anyone can write an application simulating the ESET proxy behaviour and DoS your router. "

why on earth would some1 do such a thing and pause his atacks when i uninstall the god damn thing?

"And as a final note, please stop messing with critical OS files if you have no clue how that could affect you"

i am pretty sure i do know how this could affect me since i am bothering with those files 2 years now due to utorrent beta testing issues.
but wait since i do not have a modified one atm why on earth a tcpip.sys would be the reason behind the issue
i managed to isolate the problem after numerus tries and u trying to get me back to square one when i told u again "fresh install" sp3 !!!!

[doktornotor]

Originally Posted by napouser

and that comes from what exactly??

I've already explained to you multiple times that if you are able to crash your router with an application running on attached PCs, then you have a router firmware issue that needs to be solved because otherwise you can be DoSed by anyone who is able to connect to that router...

Since you plain refuse to listen and sound like a scratched record I'll leave it at that, good luck beating the dead horse here and buy a better HW next time.

[napouser]

what gurrantee can u give me and to my friend that by paying 100$ for a new router will solve our problems?

if i wanted easy solutions i would just went back to bitdefender wich costs me free

what is important atm is to stop those dos attacks from eset, we can worry about everyone when this "everyone" tries to attack me
or should i say it better running torrents 24/7 is priority 1, security comes 2nd

so if someone knows a way to disable them and still have the basic security features thats good
changing router is something i cant afford to do atm

[xms]

Originally Posted by Krank

Setup > Enter entire advanced setup tree > Web access protection > http, https > Web Browsers > Uncheck uTorrent from the list and click OK.

Thanks for that
I have been having similar problems since yesterday morning (smart security+vista+utorrent 1.8.1). Not sure what could have caused the problems since I have been running the software trio without issues until yesterday.
With Krank's suggestion everything seems back to normal.
By the way I don't have a router, just a Home Access Gateway.

[elementsofdance]

Just upgrade the firmware on the router if it isn't upgraded already, and try!

[napouser]

router firmware wag200g at latest version already 1.00.09

cant stress enough that the problem lies on firewall of eset not my firmware or my friends firmware

nod32 just cant handle the excessive flood of connections of utorrent
thats why my other system on the network also eset equiped does not rape the router unless i start torrents on it of cource