Well I have a strange one here with OpPro V2.0 that has me puzzled. I could not get my IE to work or my mail to work with OP in the Rules Wizard. It would let me get into both in allow most.
I rebooted my computer and it is working fine now. No problems accessing the net with IE or my e-mail.
I put a copy of my blocked logs below I am not sure if this will help.
6:43:56 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.177.145.51
6:39:31 PM explorer.exe UDP 239.255.255.250 1900 Learning Mode 169.254.5.9
6:30:07 PM iexplore.exe TCP www.outpostfirewall.com HTTP Internet Explorer HTTP connection 65.179.209.196
6:29:19 PM iexplore.exe TCP www.outpostfirewall.com HTTP Learning Mode 65.179.209.196
6:26:14 PM iexplore.exe TCP www.outpostfirewall.com HTTP Internet Explorer HTTP connection 65.179.209.196
6:16:39 PM SYSTEM TCP 68.46.51.99 3978 Reject Connection To Port Opened By System 65.179.209.196
6:14:14 PM iexplore.exe TCP www.outpostfirewall.com HTTP Internet Explorer HTTP connection 65.179.209.196
6:13:27 PM iexplore.exe TCP www.outpostfirewall.com HTTP Learning Mode 65.179.209.196
6:12:47 PM spyblocker.exe TCP 65.66.34.33 4349 Learning Mode 65.179.209.196
6:02:11 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.209.196
6:00:38 PM poproxy.exe TCP pop.sprynet.com POP3 Allow Once 65.179.209.196
5:57:58 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.209.196
5:57:18 PM iexplore.exe TCP start.earthlink.net HTTP Internet Explorer HTTP connection 65.179.209.196
5:56:56 PM iexplore.exe TCP start.earthlink.net HTTP Internet Explorer HTTP connection 65.179.209.196
5:56:35 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.209.196
5:56:35 PM iexplore.exe TCP start.earthlink.net HTTP Internet Explorer HTTP connection 65.179.209.196
5:56:06 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.209.196
5:54:06 PM iexplore.exe TCP www.outpostfirewall.com HTTP Internet Explorer HTTP connection 65.179.208.181
5:52:04 PM iexplore.exe TCP www.outpostfirewall.com HTTP Allow Once 65.179.208.181
5:51:43 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.208.181
5:51:43 PM iexplore.exe TCP www.outpostfirewall.com HTTP Allow Once 65.179.208.181
5:49:17 PM iexplore.exe TCP www.outpostfirewall.com HTTP IEXPLORE Rule #1 65.179.208.181
5:48:56 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.208.181
5:48:56 PM iexplore.exe TCP www.outpostfirewall.com HTTP IEXPLORE Rule #1 65.179.208.181
5:48:01 PM iexplore.exe TCP www.outpostfirewall.com HTTP IEXPLORE Rule #1 65.179.208.181
5:45:06 PM iexplore.exe TCP www.outpostfirewall.com HTTP IEXPLORE Rule #1 65.179.208.181
5:42:34 PM iexplore.exe TCP www.outpostfirewall.com HTTP Internet Explorer HTTP connection 65.179.208.181
5:42:13 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.208.181
5:42:13 PM iexplore.exe TCP www.outpostfirewall.com HTTP Internet Explorer HTTP connection 65.179.208.181
5:40:44 PM iexplore.exe TCP www.agnitum.com HTTP Internet Explorer HTTP connection 65.179.208.181
5:40:23 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.208.181
5:40:23 PM iexplore.exe TCP www.agnitum.com HTTP Internet Explorer HTTP connection 65.179.208.181
5:39:14 PM iexplore.exe TCP www.agnitum.com HTTP Internet Explorer HTTP connection 65.179.208.181
5:37:37 PM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic 65.179.208.181
4:15:12 PM explorer.exe UDP 239.255.255.250 1900 Learning Mode 169.254.5.9
4:08:32 PM SYSTEM TCP 81.77.116.5 1844 Reject Connection To Port Opened By System 65.177.145.169
4:04:45 PM SYSTEM TCP 204.1.226.229 52095 Block Hacker IP After Attack 65.177.145.169
4:04:45 PM SYSTEM TCP 204.1.226.229 52095 Block Hacker IP After Attack 65.177.145.169
4:04:45 PM SYSTEM TCP 204.1.226.229 52095 Block Hacker IP After Attack 65.177.145.169
4:04:45 PM SYSTEM TCP 204.1.226.229 52095 Block Hacker IP After Attack 65.177.145.169
4:04:45 PM SYSTEM TCP 204.1.226.229 52095 Block Hacker IP After Attack 65.177.145.169
I have a bug report in to Agnitum that is terribly vague about these problems that seem to come and go.
Much of it seems to do with DHCP, DNS, and Address ranges.
If you have some specific information about problems is these areas, please give me what information you can. I am trying to nail down the exact nature of the problem(s) and am having trouble doing that.
You can see my thread in the FAQ section about lans and DNS. This came about after trying to get my lan to work consistantly and not just part of the time.
I am still occasionally getting a popup asking for services.exe to access my DNS servers. I can block once, but DNS still works.
Strange:confused:
Time Stamp
Thanks cwbrowne you and I are fighting the same problems with ME and OpPro.
I have tried what I can for now and my fingers have gone tottally numb again so time for my meds and bed.
Take care all
Randy
Atleast the work around works for now and I now know that I can check mail and get online until I shutdown IE again.
BTW I sometimes get an explorer.exe and I also have iexplorer.exe I tried making them the same and it did not work for the blocked HTTP
The dialup was unlikely to be an issue - but some people have Firewire interfaces, integrated motherboard adapters and Fast IR showing up under Network Adapters - so it seemed an outside chance that this might make a difference.
One other thing to try - use msconfig (Start Menu/Run...) to remove any entries for Outpost in the startup tab. Then reboot, start Outpost manually (via the Start Menu or by running outpost.exe directly) and see what happens. If this gives better results, copying the Outpost entry into the Startup group will do this automatically in future (basically with this method, you would be running Outpost as an application, rather than a service).
I'm afraid I can't think of anything further for the time being - other than suggest that you include a reference to this thread in your bug report to Agnitum if you have not already done so.
Before you reinstall again, let me get Paranoid to look at this.
You have a lot of crap loading at boot that I don't think is doing you any good.
Go ahead and install the new MDAC and Jet files and see if that helps though.
QSection, see This thread (http://www.outpostfirewall.com/forum/showthread.php?s=&threadid=7380)
Looks like you're saying the same thing TimB said, and changing the DNS rules like I suggested fixed his problem.
Have you tried it?
Also, GoonMan, what rules do you have for DNS and DHCP?
Application and global both?
Originally posted by Paranoid2000
Goonman, if you believe that running Outpost in Service Mode is the problem then removing the entries for Outpost in the Startup tab of msconfig and instead copying the Outpost shortcut to the Start Menu/Programs/Startup group (so it starts when you log on) would be worth trying.
For Poproxy, I had to set up rules manually (although I tend to do this will all my apps now) - if you have not already tried this, delete the existing entry and create a new one (it should only need access to POP3-port 110 to your ISP's mail server).
Thanks Paranoid. I had added a short cut to my start up file for OP to start on reboot instead of in the normal mode, well it did not like that either. OP on my computer does not like to be started on reboot period. The only thing I could do is check my mail. I also tried to use the workaround for OP and IE it would not work either so now I am here on Allow most. I checked the Blocked log and one of the reasons it gave is one I had not seen before, here it is below.
10:18:48 AM iexplore.exe TCP eimg.net HTTP Reject Connection To Port Opened By System ******** (I removed the addy)
I am still experimenting with this thing and I also have some cfg files saved to turn in to Agnitum so maybe they can creat the same mess I have on my computer.;) The more I do the more I learn about my computer and OP.:p :D
As far as POPROXY goes I will be glad when Norton runs out because it will be gone from my system.
I have deleted Poproxy, Outlook and IE several times from the Partially Allowed Apps area. I have actually got both mail and IE to work after deleting them from the Partially allowed area. Dragging apps into the Allowed Apps area does not do any good either. Where it did work with V1.
I will give it a try in removing the apps again and writing a new rule for it. Now I also noticed that when a App pops up if you click on ok right away it will only allow it once. I have had to click on one of the other, then click on the Partially Allow.
I also think the log file goes crazy and does not properly report what the problem is.
I have several different cfg files saved to turn in on a ticket. When I get through experimenting with my computer and OP. (That is if I do not deep 6 it) ROFLMAO :D
I am hoping that some of this info that I am gathering will help some one figure out their computer and OpProV2. I atleast hope it will help me LMAO (So do not take a hammer to computer yet)
Virtual Private Server Solutions from Verio::
E-mail Offers. Hot Topics. •Microsoft Access: Customize Forms and Reports With VPS v2 we allow true root access so administrators can install applications
http://www.smallbusinesscomputing.com/webmaster/article.php/2222221HOME |
:D :cool: :p
I wonder if I delete the iexplorer from this if it would solve some of my problems.
[DisableNetworkForHiddenProcesses]
iexplore.exe
explorer.exe
Any thoughts or ideals on this or which one to delete. I know that at one time explorer.exe was being blocked and not even showing up in the blocked folder.
GoonMan, cw could surf after disabling NAV.
How about you?
Then I did a new full download and installation. I am still getting the System allowed Icon showing up and not sure what is causing it.
I don't understand. Can you get me a screenshot?
(quote from root) (For your Outpost rules, you should not have services.exe or svchost.exe allowed or partially allowed) Not sure what you are talking about here I do not have either of these allowed as far as I see.
These are services that some OSs use that are part of the system . Not sure what ME calls these files.
2:36:20 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP 2:36:20 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP 2:35:51 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP 2:35:51 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP 2:30:09 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP 2:30:09 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP 2:29:42 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP 2:29:42 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP
What log are these entries from?
So far so good with OpProV2 Everything seems to be working ok.
Having Nav2001, OpProV2 starting manually did not make any difference but I will leave it like this for a few days and test it.
I think the biggest thing with OpProV2 is getting my rules set right for Dial-up and also this crazy ME system. (Any one have a large hammer for it, Oh I better wait till I get another one)
MegaHertz I can now start OpProV2 with out having my dialup connected first. I can check mail and surf, so things lookingt great here. :D
:cool:
Thanks again to all of the Mods and testers here for your time and Patience. ^5s Green Apple News::
Creating And Installing A Homepage. Posting Items On Netscape Navigator v2.x, v3.x. Microsoft Internet News v4.x (inc. with IE v3.x) Forte Agent v1.8
http://www.greenapple.com/general/news/12-12-00.htmHOME |
spam :: free :: freeware :: shareware::
Treo and handheld device plug-ins for spam-free remote access. Free trial. NUCEM uses an e-mail classifier to quarantine spam and then with one click, you
http://www.softcab.com/spam_165.freewareHOME |
Time Stamp
Ok Randy, those rules look good. I deleted the attachment with your DNS IPs. Don't want someone leeching off them.
Have you installed the new MCAC and Jet files yet? I'm hoping this may help.
If you install them and you still have the problem, please give me a blow by blow description of everything that happens after you boot up, log onto the net and try to surf with IE. Look at the allowed log, the blocked log and the attack detection log.
Also, please go here, (http://www.lurkhere.com/~nicefiles/) and download startup list, run it and copy the log file it produces and post it here.
Thanks for your help root and have a good nite. I am still racking my brains the swim did not help LOL. This has got me puzzled from here to Canada. Oh well we will find a solution soon or a large hammer. ROFL (maybe I need the hammer for my hard head)
I figure what ever it is that is wrong, it probabily is very simple and easy to fix and we are over looking it.
Something I did notice in the rules area when u go in and change a rule like for DNS under Global I believe it is 53 if you look at the example it tells u to put in a number then a coma for each number u add. Could there be a rules understanding problem with OpProV2 Loaded on Win98SE and WinMe. So it blocks it. Just a thought.
I tried changing them to numbers but they automaticly change back to DNS or UDP. What I may try to do is set a new rule for IE and see if I can add the numbers only and make it work. Oh Well I will check back later I have to let my son check his mail.
Thanks for everyones help
Randy
Thanks Paranoid2000. I think it was the way I had my poproxy and Outlook setup. It is now working, sometimes it works and sometimes it does not.
MegaHertz again thanks for all of your help I will let you know how things are going with this sometimes working and sometimes not working program. Like I said earlier this morning I think maybe ME may be some of the problem. Or OpPro is flaky on ME system.
Randy
Thanks Paranoid2000 I disabled the system restore.
I am on dial up and my IP number changes all of the time or everytime I get on line. I will wait to see what cwbrowne comes up with.
Some of this is more than I understand. Sometimes I needs to borrow a hammer for this hard head of mine. LOL
I found out this after noon that I could not get online even after shuttingdown OpPro then starting IE 5.5 I could not access the net or mail unless I rebooted. Then do the work around and it is now working. Something I did notice is that even if I put it in the trusted it will not let me go online. If I remove my IE or my Outlook from the Partially allowed I still cannot access the internet.
I appoligize if anyone is offended by the laughing comments. But it is just the way I am getting through this mess. :D
Time Stamp
Time Stamp
root sorry I did not get back to you sooner. I tried what you suggested for on this Windows ME and it still would not access either one unless I went to allow most. I had also tried everything that I could remember from the V1 and it still would not let me do what I needed to. I have found WinMe to be a strange system but it has worked good for me so far. I do know it does not like some things I have tried on it LOL. So now it is back to school. Thanks for your help. I am not sure how long what I have will last but for now it is working.
So I did a uninstall and a complete removal of all of the OutPost ProV2.0 upgrade I could find and used my Registery Cleaner to remove any of the remnants.
Then I did a new full download and installation. I am still getting the System allowed Icon showing up and not sure what is causing it.
(quote from root)
(For your Outpost rules, you should not have services.exe or svchost.exe allowed or partially allowed)
Not sure what you are talking about here I do not have either of these allowed as far as I see.
2:36:20 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP
2:36:20 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP
2:35:51 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP
2:35:51 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP
2:30:09 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP
2:30:09 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP
2:29:42 AM SYSTEM UDP 0.0.0.0 BOOTPC Allow Outgoing DHCP
2:29:42 AM SYSTEM UDP 255.255.255.255 BOOTPS Allow Outgoing DHCP:confused:
Hello all I am going to try a complete clean and disable my restore/go back and see if I can get this thing to work then I am going to download V2 again and install it I will post back here and see what happens.
What really puzzles me is if I put IE, Outlook and poproxy in the trusted apps then it should work, Or that is what lodgic tells me.
I may have lost the logic part with my fried brain cells. ROFL.
Wish me luck
Randy
cwbrowne, do you have your global DNS set up to allow UDP, no direction, remote port 53 with your IPs of the DNS servers in the remote host section?
No other rules anywhere for DNS?
Ok here is a screen shot of my DNS Rules Under Global and I will put another screen shot up of my DHCP.
Randy
PS I hope you can open this zipped Document.
Thanks for the update. Can you now try doing a ping and a tracert to a couple of websites (using the DOS box) just to see if ICMP packets are allowed by Outpost? (I did have a problem with a beta build where at one point Outpost would block all applications but allowed ICMPs, so would be interested to see if you may have the same).
Originally posted by root
cwbrowne, do you have your global DNS set up to allow UDP, no direction, remote port 53 with your IPs of the DNS servers in the remote host section?
No other rules anywhere for DNS?
Well root we did this also and it did not make any difference. If we boot (having OP in startup) and then open IE - IE cannot connect to the net If we then Exit & Shutdown OP and then restart just OP while leaving IE up then we have IE access.
Time Stamp
Hello all, here is an update:
I find this funny in a way even though it is not. I am now receiving mail and surfing the internet and not having very many problems, (keeping fingers crossed) one thing that happens every other reboot is I get a shutdown error on reboot with OP (the reason for error is unknown in the message), and I have to shut down OP after a web page is started because it will not load and then restart OP again (this is what I call the work around). I also sometimes have to Allow most to send mail because OP some times does not recognize that it is suppose to allow SMTP connection to send mail.
I do not let OP start on reboot and I do not any longer have it in my start-up folder. I have 2 of my plug-ins stopped. Domain Name Cache and Content Filtering. I also have in View > Advanced > Resolve checked never. Now I have been working with this and playing with it and it seems to work about 95% of the time with out any problems with my mail or surfing.
So I do not know what is going on but it is working for now and I am patiently waiting for Agnitum to get another version sent out out to us.
I still get brave and will try some thing that I see here in the forum and see if it works. Sometimes it does and sometimes it does not work.:D
Oh well just wanted to pass this along.
Take care all
I have not given up on OpProV2.
Randy
PS Keeping my fingers crossed with OpProV2 and Windows ME the GrandParent to Windows XP ROFLMAO :D :D :p
The only way I could get here was togo to allowed most. So I could post this. I will e-mail you my configuration. I am going to go try one other thing and I will let you know the results.
Hey here is my Blocked Logs
2:25:53 AM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic
2:23:57 AM iexplore.exe TCP www.outpostfirewall.com HTTP Internet Explorer HTTP connection
2:22:57 AM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic
2:19:03 AM explorer.exe UDP 239.255.255.250 1900 Learning Mode
2:04:47 AM NETBIOS UDP 155.239.131.138 1026 Block NetBIOS Traffic
12:51:06 AM NETBIOS UDP 65.255.255.255 NETBIOS_NS Block NetBIOS Traffic
Time Stamp
Sorry. Check your PMs
See ya tomorrow. :)
Cwbrowne,
Another thing to try if the previous suggestions did not work - disable all other network interfaces. To do this, right-click on My Computer, select Properties, click on Device Manager tab and check the Network Adapters section (you may need to double-click on this to expand it to show the individual devices). For each one (other than your network card), double-click on it and select Disable - it should then be shown with a red X in the Device Manager.
Originally posted by GoonMan
Well that did not work, I could not surf or access mail.
Back to the drawing board.
Randy Randy,
Did you disable NAV from starting with the PC and then reboot? Also because of the way that NAV 2001 sets up your email client you will not be able to get email unless you go in and reconfigure your email client first. Mainly need to know if you can surf after you reboot.
Thanks root I did not think about the DNS file. I just finished downloading the last file that Qsection had suggested. I also noticed that it said the jet file was shipped with ME but I am going to install anyway after supper.
Then I will post back here. I am going to get screen shots of both my allowed and blocked logs and also post back here what the startup log will show.
Thanks for all of the help
Randy.
Thanks root that is a nice web site. Earth link also has a nice one too.
Paranoid2000, all I know at this point is that nothing is making sense.
It does not seem that everyone using NAV 2003 is experiencing this, at least I don't think so. Also, it comes and goes. :confused:
I am open for suggestions, information, guesses, anything.
I'm still waiting to hear from Randy.
Time Stamp
Sounds like another one of the "randomly works / doesn't work" problems - looks like this is a problem in 98 and ME.
I wonder, anyone with NO problems in 98/ME - are you using Internet Explorer 6 or above ?
Anyone WITH problems - are you using IE 5.5 or below ?
And I seem to observe a higher than expected rate of DHCP calls as well - working or nor working, 3-5 minutes apart, and maybe even bursts of 2 or 3 - almost as if the system is not able to process the response - beginning to wonder if they're connected?
Originally posted by root
You know Paranoid2000, what's really strange is that some people have almost exactly the same problem can solve the problem by updating the MDAC and Jet files and setting up the Global DNS with no direction or SPI but using the IPs of the DNS servers.
Obviously Outpost is reporting the reason all wrong. There is a bug or some bugs for sure, yet I, bassbag and some others got around it.
Something else really wierd. I have no rules for services.exe or svchost.exe and when I go to BBC news, I get a popup for services.exe asking to allow DNS. I block once and the page loads anyway.
This stuff is very strange to say the least. This may be affected by whether you have the DNS client service running or not. I have disabled mine - but I understand that it may do DNS lookups on behalf of applications if you keep it running.
Welllllllllllllllllll as usual I do not have any luck left. Everything I tried does not work. Except the work around still works sometimes. I give up for today, time for me to crash and leave V2 to the experts here. LOL;)
Take care all time for my ugly sleep.:D :p
Randy
Lets see if Paranoid has any ideas.
I'm done for the night.
root I have not disabled Nav 2001. I do not know how too sorry. But it has been one of my suspicins all along. If some one could tell me how I will do it and let you know the results. Sorry I did not get back here sooner. After being up 28 hours I had to go to sleep.
Randy
A common theme with these problems is that Outpost is listing the normal IE rule (which should define which connections to allow) as a reason for blocking - this is something I have not seen before and implies a rules issue. What I would suggest is deleting the existing rules (go to Options/Application... and delete the iexplore.exe entry) and then create a rules entry manually for Internet Explorer (click on Partially Allowed, Add, find iexplore.exe and use the Preset button to apply the Browser rule). If this does not appear to make a difference, drag the iexplore.exe entry to the Trusted Applications section (not recommended for general use, but OK for troubleshooting).
If you have difficulty finding iexplore.exe, it may be hidden (MS tends to be protective about their security-flaw-ridden darling :) ) so fire up a DOS box, go to the C:Program FilesInternet Explorer directory and type attrib -h -s -r *.* - this should remove any hidden, system or read-only flags and make iexplore.exe appear if it is being bashful.
GoonMan, I cannot see anything in your system setup that would be causing a problem of this nature. However you do appear to be running GoBack and System Restore, both of which do a similar thing. You may therefore find it worthwhile disabling System Restore and reclaiming the disk space it uses (which can be in the gigabytes). Check this MS Knowledgebase Article (http://support.microsoft.com:80/support/kb/articles/q264/8/87.ASP) for details. To fully reclaim the space used by System Restore, I found that I had to use a boot floppy to start up with the command prompt only, then delete the C:_RESTORE directory - only bother if this is taking a significant amount of space though.
Congratulations Root - this looks like one for the FAQ. :)
Randy,
That should work, but if not you may need to use another tool like Start Up control panel to disable it from starting. Remember because of the proxy for email you will not be able to retrieve email, but I think that once you reboot without Norton running things will start working as expected (as far as surfing goes). If not I would like to have you email me a copy of your config so I can look through it.
Time Stamp
Cw, please do a save as with todays date for your configuration and email it to me.
Sometimes we assume too much and do not ask the right questions.
You can do the same thing GoonMan.
GoonMan, I asked cw to try surfing with Norton disabled from loading at bootup.
Would you try surfing after disabling Nortons and rebooting?
Ok I think I have found how to unload it be back soon.
Randy
Here's my log Screen shots.
Time Stamp
Time Stamp
Time Stamp
Originally posted by QSection
Well root we did this also and it did not make any difference. If we boot (having OP in startup) and then open IE - IE cannot connect to teh net If we then Exit & Shutdown OP and then restart just OP while leaving IE up then we have IE access.
QSection I did take your advice and shutdown OP then started IE 5.5 and then started OP. I can surf the net and check my mail. At least I have a temporary work around for now.
I did do another clean uninstall and install and it gave me the same problems as before.
It keeps blocking my HTTP connection. I thinks we may have a program bug.:stunned: :confused:
Yeeeeeeeee Hawwwwwwwww
Here is the other one of DHCP.
cwbrowne we have some great mods here to work with. I am hanging in here and my frustration has gotten less now or not bad at all now that I have my system semi working I am a happy camper. It also has to do with me half way understanding how OpProV2 is working.:D
I am doing some testing on ME now to see if it will make things rosey and/or peachy.:D Or if it will make it worse.
I have now disabled OpProV2 and Nav2001 auto protect from starting on reboot.
I am going to start both of these manually.:D Going to let the Pigeons fly and see what happens.
ROFLMAO
Well that did not work, I could not surf or access mail.
Back to the drawing board.
Randy
root
We viewed the thread you pointed out and followed the suggestions. We will let you know how it goes. :cool:
Time Stamp
Well I am at a loss now. Here is my startup list. I will post a screen shots of my Allowed Logs and Blocked Logs. Next. I may try to Uninstall and reinstall OpProV2 soon again after installing the Mdac2.7
StartupList report, 5/28/2003, 8:07:49 PM
StartupList version: 1.52
Started from : C:WINDOWSTEMPSTARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v5.51 SP2 (5.51.4807.2300)
* Using default options
==================================================
Running processes:
C:WINDOWSSYSTEMKERNEL32.DLL
C:WINDOWSSYSTEMMSGSRV32.EXE
C:WINDOWSSYSTEMMPREXE.EXE
C:WINDOWSSYSTEMMSTASK.EXE
C:PROGRAM FILESADAPTECGOBACKGBPOLL.EXE
C:WINDOWSSYSTEMSTIMON.EXE
C:PROGRAM FILESAGNITUMOUTPOST FIREWALLOUTPOST.EXE
C:WINDOWSSYSTEMRESTORESTMGR.EXE
C:WINDOWSBCMDMMSG.EXE
C:WINDOWSSYSTEMmmtask.tsk
C:WINDOWSSYSTEMDEVLDR16.EXE
C:WINDOWSEXPLORER.EXE
C:WINDOWSTASKMON.EXE
C:WINDOWSSYSTEMSYSTRAY.EXE
C:PROGRAM FILESADAPTECDIRECTCDDIRECTCD.EXE
C:WINDOWSSYSTEMWMIEXE.EXE
C:PROGRAM FILESNORTON ANTIVIRUSNAVAPW32.EXE
C:WINDOWSSYSTEMHPHA1MON.EXE
C:PROGRAM FILESAGNITUMTAUSCAN 1.6TAUMON.EXE
C:PROGRAM FILESSPYBLOCKER SOFTWARESPYBLOCKER.EXE
C:PROGRAM FILESMICROSOFT HARDWAREMOUSEPOINT32.EXE
C:WINDOWSSYSTEMSPOOL32.EXE
C:PROGRAM FILESNORTON ANTIVIRUSPOPROXY.EXE
C:WINDOWSSYSTEMDDHELP.EXE
C:WINDOWSSYSTEMHPHIPM07.EXE
C:PROGRAM FILESWINZIPWINZIP32.EXE
C:WINDOWSTEMPSTARTUPLIST.EXE
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:WINDOWSStart MenuProgramsStartUp]
GOBACK.LNK = C:Program FilesAdaptecGoBackGBMenu.exe
--------------------------------------------------
Autorun entries from Registry:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
ScanRegistry = C:WINDOWSscanregw.exe /autorun
TaskMonitor = C:WINDOWStaskmon.exe
PCHealth = C:WINDOWSPCHealthSupportPCHSchd.exe -s
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
OEMRUNONCE = c:windowsoptionscabsoemrun.exe
BCMDMMSG = BCMDMMSG.exe
InkWatch = C:PROGRA~1GATEWAYGATEWA~1InkWatch.exe
Adaptec DirectCD = C:PROGRA~1ADAPTECDIRECTCDDIRECTCD.EXE
Norton Auto-Protect = C:PROGRA~1NORTON~1NAVAPW32.EXE /LOADQUIET
HPHA1MON = C:WINDOWSSYSTEMHPHA1MON.EXE
Tau Monitor = C:PROGRAM FILESAGNITUMTAUSCAN 1.6TAUMON.EXE
SpyBlocker = C:PROGRAM FILESSPYBLOCKER SOFTWAREspyblocker.exe
POINTER = point32.exe
GRA = C:CabsgrainstallGRA.exe
NvCplDaemon = RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
nwiz = nwiz.exe /install
NAV DefAlert = C:PROGRA~1NORTON~1DEFALERT.EXE
Norton eMail Protect = C:Program FilesNorton AntiVirusPOPROXY.EXE
Outpost Firewall = C:PROGRAM FILESAGNITUMOUTPOST FIREWALLOUTPOST.EXE /waitservice
devldr16.exe = C:WINDOWSSYSTEMdevldr16.exe
--------------------------------------------------
Autorun entries from Registry:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun Services
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
*StateMgr = C:WINDOWSSystemRestoreStateMgr.exe
GoBack Polling Service = C:Program FilesAdaptecGoBackGBPoll.exe
StillImageMonitor = C:WINDOWSSYSTEMSTIMON.EXE
ScriptBlocking = "C:Program FilesCommon FilesSymantec SharedScript BlockingSBServ.exe" -reg
Outpost Firewall = C:PROGRAM FILESAGNITUMOUTPOST FIREWALLOUTPOST.EXE /service
--------------------------------------------------
Load/Run keys from C:WINDOWSWIN.INI:
load=
run=hpfsched
--------------------------------------------------
Shell & screensaver key from C:WINDOWSSYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------
C:WINDOWSWININIT.BAK listing:
(Created 28/5/2003, 0:31:12)
[rename]
NUL=C:WINDOWSTEMPGLB1A2B.EXE
NUL=C:PROGRA~1AGNITUMOUTPOS~1UNWISE.EXE
NUL=C:PROGRA~1AGNITUMOUTPOS~1UNWISE.EXE
--------------------------------------------------
C:AUTOEXEC.BAT listing:
SET windir=C:WINDOWS
SET winbootdir=C:WINDOWS
SET COMSPEC=C:WINDOWSCOMMAND.COM
SET PATH=C:WINDOWS;C:WINDOWSCOMMAND;C:WINDOWSSYST EM
SET PROMPT=$p$g
SET TEMP=C:WINDOWSTEMP
SET TMP=C:WINDOWSTEMP
--------------------------------------------------
C:WINDOWSWINSTART.BAT listing:
C:WINDOWStmpcpyis.bat
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:PROGRAM FILESADOBEACROBAT 5.0READERACTIVEXACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Symantec NetDetect.job
My Computer Scan.job
--------------------------------------------------
Enumerating Download Program Files:
[CV3 Class]
InProcServer32 = C:WINDOWSSYSTEMWUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1024/V31Controls/x86/mil/en/actsetup.cab
[Video Class]
InProcServer32 = C:WINDOWSDOWNLOADED PROGRAM FILESVIDEOX.DLL
CODEBASE = http://stream10k.redhotnetworks.com/cabs/videox.cab
[Symantec RuFSI Registry Information Class]
InProcServer32 = C:WINDOWSDOWNLOADED PROGRAM FILESRUFSI.DLL
CODEBASE = http://security2.norton.com/SSC/SharedContent/sc/bin/cabsa.cab
[Symantec AntiVirus scanner]
InProcServer32 = C:WINDOWSDOWNLOADED PROGRAM FILESAVSNIFF.DLL
CODEBASE = http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
[Shockwave Flash Object]
InProcServer32 = C:WINDOWSSYSTEMMACROMEDFLASHFLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[ActiveDataObj Class]
InProcServer32 = C:WINDOWSDOWNLOADED PROGRAM FILESACTIVEDATA.DLL
CODEBASE = https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
[MSN Chat Control 4.5]
InProcServer32 = C:WINDOWSDOWNLOADED PROGRAM FILESMSNCHAT45.OCX
CODEBASE = http://fdl.msn.com/public/chat/msnchat45.cab
[Update Class]
InProcServer32 = C:WINDOWSSYSTEMIUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37609.7634837963
[Shockwave ActiveX Control]
InProcServer32 = C:WINDOWSSYSTEMMACROMEDDIRECTORSWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
[OPUCatalog Class]
InProcServer32 = C:WINDOWSSYSTEMOPUC.DLL
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab
[HouseCall Control]
InProcServer32 = C:WINDOWSDOWNLO~1XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2003050501/housecall.antivirus.com/housecall/xscan53.cab
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:WINDOWSSYSTEMWEBCHECK.DLL
UPnPMonitor: C:WINDOWSSYSTEMUPNPUI.DLL
AUHook: C:WINDOWSSYSTEMAUHOOK.DLL
--------------------------------------------------
End of report, 7,602 bytes
Report generated in 0.236 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Time Stamp
I see the learning mode mentioned there and I have a theory as to what is causing that.
Try going to Network Connections for your internet connection and right mouse click it and select properties. Then select networking,highlight TCP/IP and select properties. Check obtain ip automatically and check obtain DNS servers automatically.
If you are concerned about changing these settings, then you can probably leave them alone, but setting them like this helped me. I have Win 2K and am on dial up.
For your Outpost rules, you should not have services.exe or svchost.exe allowed or partially allowed. Instead, under options, system, global system rules, double click Allow DNS and set it up to allow UDP to remote port 53, no direction, no Stateful inspection, and put in the remote host section the IPs of your DNS servers.
You can find the IPs of your DNS servers by going to the command prompt and typing either ipconfig /all or winipcfg /all and hitting enter. The bottom section should show two IPS for DNS.
I'm hoping that by doing this, it will solve the problems of some people having similar events like you described.
It's always best to backup things before making changes like this to make it easier to switch back if you need to.
I was afraid that was going to happen.
Please make sure you have a ticket in to Agnitum support referencing this thread and telling them it has been narrowed down to NAV 2003.
Agnitum does not work from the posts on this board, rather they rely on submitted tickets.
MDac is installed but the jet is already on my ME machine. According to what I had already read before.
cwbrowne thanks for the info I am here on Allow Most because even if I shut down Outpost and restart after I am on line I cannot surf. This is weird and flukie for ME but of course ME is the GrandParent to XP LMAO.
Oh well going for a swim and will be back here soon. My mind and numb fingers are shot, so time to relax.
Randy
BTW I cannot access my mail either unless I use allow most. I am starting to wonder Norton or one of my other programs is causing some of this.
[QUOTE]Originally posted by Paranoid2000
[B]GoonMan,
Pity about the dial-up - the configuration change could be done but then WinME wants to reboot and that pretty much guarantees you'll have a new IP address.
When you shut down Outpost though - did you select Exit or Exit and Shutdown Outpost? The second option would normally do the trick (but not, I suspect, in this case :( ). Also were you able to ping or tracert any sites, showing that Outpost was at least allowing ICMP packets?
-----------------------------------------------------------------------------------
Paranoid2000 when I shutdown OpPro I use the Exit and Shutdown Outpost.
Also as far a doing a ping or tracert that is one thing I do not know how to do.
Hey root and Paranoid I appreciate all of your help.
I have one more thing I want to try and do then if it does not work I am going to try and find a copy of OpProV1 and reinstall it.
I cannot access my e-mail now with OpProV2 running unless I reboot or shut it down.
Something I noticed is when I drag a program into the Trusted applications it still blocks it and it should not do that at all.
cwbrowne have you tried shutting down your Go Back or system restore in ME after you uninstall OpProV2 then clean everything out that has to do with outpost then reboot and allow System Restore or Go Back to Start then reinstall V2? I have not tried that but I may soon if no solution turns up soon.
cwbrowne thanks for your help here also. I hope we both get our problems fixed soon.
root I do not have your e-mail address but I will save the confuguration that I have now. I did not get a PM from you.
I have not given up yet but the frustation is building with V2. Sorry
Take care root and have a good nite. :) :cool:
Time Stamp
GoonMan - have you tried the downloads here?
http://www.outpostfirewall.com/forum/showthread.php?threadid=7221
This has completely eliminated our SYSTEM logging problem. Now every entry says the proper application.
root - although in our signature below it says IE5.5 we are temporarily using IE6.0 SP1. Also it seems that one of the problems in 98SE relates to timing. We have OP set to start at bootup. Sometimes if we turn on the computer and then try to use IE - IE does not work. Leaving IE up if we then exit and shutdown OP then restart OP it seems IE then works. Sometimes when we start the computer everything works all right. We try to delete the log file via the OP gui about twice a day so it does not get too large. We will try to nail down more detailed information and pass it to you as we can. Thank you for your work.
GoonMan, you can use msconfig (from Start Menu/Run...) to disable (temporarily) any startups - click on the Startup tab and you should see a list of entries with checkboxes - clear the boxes of any items you wish to disable. More information on using msconfig is given here (http://www.pacs-portal.co.uk/startup_content.htm). It may be worth also downloading TaskInfo (http://www.iarsn.com/) to check what processes you have running - if all else fails try terminating unnecessary ones and see if that makes a difference.
I use NAV2001 myself and have Poproxy running. If NAV is the suspect, checking its logs may give some pointers (held in ACTIVITY.LOG in the Norton Antivirus program directory - or viewable through the Reports option on the main Antivirus/Systemworks screen).
You know Paranoid2000, what's really strange is that some people have almost exactly the same problem can solve the problem by updating the MDAC and Jet files and setting up the Global DNS with no direction or SPI but using the IPs of the DNS servers.
Obviously Outpost is reporting the reason all wrong. There is a bug or some bugs for sure, yet I, bassbag and some others got around it.
Something else really wierd. I have no rules for services.exe or svchost.exe and when I go to BBC news, I get a popup for services.exe asking to allow DNS. I block once and the page loads anyway.
This stuff is very strange to say the least.
Okey-dokey. I have a sneaking suspicion that this may be a "Transit Packet" problem in another guise (in my case I received a "Transit Packet Blocked" on all applications while ICMPs breezed through).
Cwbrowne, is your Internet access via a dial-up account or do you have a cable/dsl connection? (what I am going to suggest is not going to be possible with dialup). If you do have cable/dsl, is it through a router using Network Address Translation or a modem (a router would supply your PC with an IP address like 192.168.x.x - typing ipconfig in a DOS box or winipcfg from the Start Menu/Run.. will show your current IP address).
If you have a router (with an IP address of 192.168.x.x) then the following step should present no problem. If you have a modem (and are getting a different IP address from your ISP) then you need to check to see if the IP address stays constant - type ipconfig /renew a couple of times to see if any change happens - and only continue if you get the same IP address returned each time. If you have multiple network cards on your machine, each will have an IP address so check that you have the right card. Type ipconfig -all and note the IP address/subnet mask for the appropriate network card and also the IP addresses given for the DNS servers (there will be 2 addresses listed near the end).
If so, then try disabling DHCP (Dynamic Host Configuration Protocol - this is responsible for allocating you an available IP address). Instructions for enabling DHCP for a few versions of Windows (including ME) are given here (http://www.more.net/technical/win/dhcp.html) - what you need to do is the opposite, select "Specify an IP address" in the IP address tab and give the IP address and subnet mask you noted earlier. In the DNS configuration tab, select "Use the following DNS server addresses" and enter the DNS server addresses you noted earlier.
When you click OK, Windows ME will want to reboot for this to take effect - do so and let us know if it makes a difference.
If you are on dial-up, trying the above will almost certainly prevent you from connecting successfully to your ISP (since your ISP will be trying to assign you a different IP address). Nevertheless, you may wish to try - but make sure that you keep a hard-copy of the web page link above so that you can regain Internet access afterwards.
Time Stamp
Originally posted by GoonMan
MegaHertz I can now start OpProV2 with out having my dialup connected first. I can check mail and surf, so things lookingt great here. :D
:cool:
Thanks again to all of the Mods and testers here for your time and Patience. ^5s That's great news! Keep us updated.
GoonMan,
Pity about the dial-up - the configuration change could be done but then WinME wants to reboot and that pretty much guarantees you'll have a new IP address.
When you shut down Outpost though - did you select Exit or Exit and Shutdown Outpost? The second option would normally do the trick (but not, I suspect, in this case :( ). Also were you able to ping or tracert any sites, showing that Outpost was at least allowing ICMP packets?
Cwbrowne,
Host and domain should not be needed, just the IP addresses for the 2 DNS servers your ISP runs. If you do not put these in then you will get "Unable to find..." errors - in this case you can try an IP address directly like http://212.58.224.115/ (this should take you to a BBCi webpage).
Did WinME reboot after you made the changes?
Goonman, if you believe that running Outpost in Service Mode is the problem then removing the entries for Outpost in the Startup tab of msconfig and instead copying the Outpost shortcut to the Start Menu/Programs/Startup group (so it starts when you log on) would be worth trying.
For Poproxy, I had to set up rules manually (although I tend to do this will all my apps now) - if you have not already tried this, delete the existing entry and create a new one (it should only need access to POP3-port 110 to your ISP's mail server).
MegaHertz thanks for all of your help. I am not sure what is going on but mail stopped working so we are back to square 1 again. It looks like ME is being a pain for sure.
Atleast I have my work arounds for Mail and IE, I am not starting OpProV2 on Reboot it seems to do better if I don't.
Again thanks for your help and may be we can get the bugs out soon.
Randy.
PS atleast we had everything working for about 3 or 4 reboots.
Time to crash here.
MegaHertz OpProV2 does not like to be started on reboot on my computer I could not access mail or Internet. When it boots into Service Mode and even after I changed back to my good cfg file I still could not get mail or get on the net. It seems to me that it corrupts the cfg files or goes flaky.
I finally was able to get my mail to work but after loading my cfg1 again and starting OP after establishing Dial up with my IE I had to do the work around to get on line.
I will do some more playing with OP later today when I get up time for my numb mind and fingers to crash.
I hope this info can help some one.
Randy
Very interesting. Thanks for letting us know. :)
Hello all, sorry I did not get back here sooner, 5 am caught up with me this morning and it was time to get my ugly sleep. After I posted what I had done with OpPro V2 had quit working on me again after a reboot so I tried everything over again and still no work.
root those logs were from my Allowed Today logs. If I could remember how to do a screen shot I would.
No QSection I had not tried the downloads yet but going to do so as soon as I let the boss check her mail she was a little mad about computer not working when she woke me up. LOL (I got a few words of wisdom from her too about OutpostPro but I cannot post those here) ROFL
I am here on the Allow Most mode This is the only way I could go on line unless I shut down OutPostPro. I also have a weird log from my blocked for today.
Blocked from today
3:05:59 PM lucomserver.exe TCP 208.184.139.121 FTP Symantec LiveUpdate FTP
3:05:38 PM lucomserver.exe TCP 63.218.7.138 FTP Symantec LiveUpdate FTP
3:05:17 PM lucomserver.exe TCP 63.215.198.31 HTTP Symantec LiveUpdate HTTP
3:04:56 PM lucomserver.exe TCP 63.215.198.7 HTTP Symantec LiveUpdate HTTP
3:04:35 PM lucomserver.exe TCP 63.215.198.31 HTTP Symantec LiveUpdate HTTP
3:04:14 PM lucomserver.exe TCP 63.215.198.7 HTTP Symantec LiveUpdate HTTP
3:03:44 PM iexplore.exe TCP www.outpostfirewall.com HTTP Learning Mode
3:00:16 PM NETBIOS UDP 63.255.255.255 NETBIOS_NS Block NetBIOS Traffic
2:52:11 PM explorer.exe UDP 239.255.255.250 1900 Learning Mode
1:05:18 PM iexplore.exe TCP webmail.pas.earthlink.net HTTP Internet Explorer HTTP connection
1:05:16 PM iexplore.exe TCP webmail.pas.earthlink.net HTTP Internet Explorer HTTP connection
OpProV2 226, I got it to work for a little while it made it through 4,5, or 6 reboots with it starting in my Startup folder, not in Service Mode/Normal Startup. I could get most of everything to work right. It was fun while it Lasted :D
It is almost like OP decided to quit working. Sending mail or getting IE to access the Internet.
Take care all
Randy
I turned in a bug report.:cool:
Hey I owe every one an apoligy I thought I had shut everything down to Nav 2001 and I had spoke too soon, I went back and checked my logs and found that the poproxy for Nav was still working.
Megahertz I thought I had disabled everything before I even stopped it from loading with a reboot. But it was still showing up in the logs. Let me try it again and I will report back here.
Sorry for the confusion I think my pain meds get too me some times.
I hope I am doing it right. By going to Nav 2001 screen and disabling it from starting on reboot. If not please tell how else to do it.
Randy
Time Stamp
 Red Hat's Rough Recovery From CFO Exit
 Windows Live Finds a New, Pre-installed Home
|
V2 Access with IE and e-mail access