LnS repeats requests to allow apps to connect

Using 2.05p3

Every couple of days or so, LnS starts asking me about all my apps that connect to the internet as if for the first time.

This is a little annoying, especially since my AVG scheduled update happens in the wee hours when I'm asleep. For the last 2 days, I've gotten up in the morning to find LnS waiting for me to authorize the AVG Updater to connect to the internet.

Why do I have to keep doing this over and over again?

 

Hi,

When this happens, could you confirm the list of applications is empty ?

If it is not empty, you have to check if the application for which LnS is asking are still in the list or not.

If it is empty, it would be important to know if this happens after a reboot or when Look 'n' Stop is running.

Thanks,

Frederic

 

The application list is not empty.

There is a BIG problem which I just identified.

EVERY TIME my antivirus wants to check for an update, LnS stops it from connecting. For some reason, LnS sees the request as coming from an unknown application that wants to launch the updater which in turn accesses the internet.

Please see the attached screen capture for an illustration of what I'm about to describe. I actually have 2 small jpgs for upload but your system will only allow one.

Right now I have *SEVEN* "? UNKNOWN" entries in my application filtering window, which occur each time my antivirus wants to check for an update (I discovered this by repeatedly asking AVG to check for an update).

The window that pops up says something like "? UNKNOWN This software has started the following application which connects to Internet. Do you authorize it to do that?" Then follows the full path to the AVG Updater (AVGINET.EXE) and the 3 checkboxes.

No matter whether I allow the first connection or not, each one is treated as a new application.

This issue supercedes the original one I reported here, as if it is not resolved I will be forced to stop using LnS -- which I would regret as I was just about to register it :-( - or else reschedule my AVG update for a time when I know I will be at the computer. I usually update just before my nightly scan which takes place in the wee hours of the morning.

All of the AVG testing has been done without rebooting. As I have seen this particular problem over successive Windows sessions, I surmise that rebooting has no effect on the issue.

I really like LnS so far, so I really hope this problem can be resolved.

 

I'm attaching the second screen capture to this message. No matter which of the 3 options I choose, the same prompt returns the next time AVG Updater wants to run.

 

Could you check (without Look 'n' Stop) the real exe filename that starts AVGINET.exe.
If this filename uses a non standard extension (something different from .exe, .com, .bat...) then it is normal Look 'n' Stop doesn't detect properly the name of the parent process.
If this is the problem, at this time there is only a fix to have Look 'n' Stop reminds "Known" is allowed to start an application.

Frederic

 

How would you suggest I find out what ? is? I have no idea what to look for.

The problem seems to be not with AVGINET.EXE (which is in the application list as allowed) but in the method by which it gets launched. I right-clicked on the AVG icon in the system tray and selected "Check for Update". AVGINET.EXE launched, and LnS did not object.

The ? - UNKNOWN entries occur when I click on the Update icon from the AVG Test Center GUI. I have now changed the scheduler and hopefully an update check will be performed automatically within a few minutes. I suspect the problem will also be triggered by the unattended update request, as I have been greeted every morning for the last few days with a prompt from LnS to allow "?" to launch AVGINET.EXE.

Further testing has confirmed that if I can start AVGINET.EXE directly, LnS does not complain. I have therefore scheduled a system task to run AVGINET.EXE just before my scheduled test. I hope it works.

I also went back to the AVG Test Center GUI and, with Task Manager opened, I clicked the update icon. Task Manager showed AVGINET.EXE starting, even though LnS was still waiting for authorization.

I am completely at a loss to find out what the ? is. It's probably some routine called from within the resident portion of AVG, and therefore might not have a name. This is just a guess, mind you.

 

I don't understand your last statement. What exactly are you suggesting I do?

 

You should confirm first a non-standard application extension is used.

Yes, the problem is not with AVGINET.EXE itself but with the application starting it.

What you can do is checking the process list with the Task System Monitor (press CTRL+ALT+DEL to get it), to see if you see something like AVGSched.xxx.

Otherwise you have to get another system application like TaskInfo2000 which will display you the full path of any running exe. Of course, you need to use it only when Look 'n' Stop is displaying the Unknown alert.

Frederic

 

When the AVG Test Center GUI is launched (AVGW.EXE), a file called AVGWB.DAT also appears in Task Manager, and is identifed as part of the AVG Update Service, but I have no idea if this is the culprit or not.

A moment later, AVGW.EXE (the first process to appear) disappears, leaving only AVGWB.DAT. I've never seen a DAT file appear in Task Manager before.

Assuming AVGWB.DAT is the launcher for AVGINET.EXE, is there any way LnP can be told to identify this process instead of calling it UNKNOWN?

 

Yes, AVGWB.DAT is probably the issue.
I think we already covered that in another thread but I don't retrieve it.

Unfortunately, no, with the current version there is no way to have it detected properly. ".DAT" are not supposed to be executable.
What I did sometime ago is a fix to have "Unknown" remembered in case you decide to allow it.

Frederic

 

Too bad you decided to do away with that feature. It would have saved me a whole bunch of trouble.

I have turned off automatic updates in AVG and replaced it with what I hope will be a workable external routine calling AVGINET.EXE from another program which so far hasn't caused LnS to prompt me.

If you could restore "UNKNOWN" being remembered, I would immediately register your program


Tom

 

It is only adding .DAT as usual process I'm a bit reluctant to do.

For the "Unknown" not remembered this is a real bug (just an uppercase issue actually).
The driver mentioned here:
https://www.wilderssecurity.com/showthread.php?t=120052
is supposed to display "UNKNOWN" instead of "Unknown" and this one will be remembered.

Frederic

 

This DLL seems to fix my problem. Thanks!

Do you expect to release another update to LnS anytime soon?


Tom

 

Hi I am having this same issue. Only it is now with the extension .des starting another application. It is a file of gameguard and is required to play certain games. If you could tell me how to fix this it would be great.

I am running 2.05p3 with the 3.0.0.5p1 driver already.

 

Hi,

Sorry, no real solution for that with the current version.
If you are running this driver normally "UNKNOWN" will be remembered.

Otherwise you need to wait for the 2.06, there will be a way to add non-standard extensions.

Frederic

 

Will you notify registered users when the new version is available?


Tom

 

Any idea why UNKNOWN is not remember even though I am using the neset driver?

By the way the driver I am using says something along the lines of chinese c3. I found it in the beta folder on looknstop.com but maybe its not that correct version?

EDIT: The reason I opted for the c3 was the original link for p1 was down. If you could send the correct driver that would be great.

 

The beta version will be announced in this forum.
The official version (after the beta phase) will be detected by Look 'n' Stop (if you have enabled the "New version available" check in the options).

Frederic

 

Yes, the c3 version is for Chinese character set.
The p1 version is no longer there because the experimental features are no longer supported. Yes, unfortunately only this version fixed the Unknown/UNKNOWN problem

Frederic

 

I don't foresee any problems with the p1 version as I am running the c3 fine. If you could please send the p1 version to mike.za@gmail.com I'd be very grateful, as this problem occurs in more than one of my applications and could force me to switch firewalls, which I'd hate to do as I not only already registered, but this is my favorite firewall so far. Thanks.