jtalk Posted November 9, 2008 Report Share Posted November 9, 2008 Accordning to my PeerGuardian logs, IPFilter.dat is blocking IP addresses of inbound but not outbound connectionsI use PeerGuardian and noticed an IP address was regularly appearing in the PeerGuardian log with both inbound and outbound connection attempts. I decided to add this IP address to the uTorrent IPFIlter.dat file. I used BlockList Manager to add the IP address manually to a new IPFilter.dat file and put it in correct uTorrent directory. On restarting uTorrent, the uTorrent log shows the IP addresses being loaded from the IPFilter.dat file.However, on monitoring the PeerGuardian logs, I still see outbound connections to the IP Address I wanted blocked. This is a defect in uTorrent. I think what happens is that the IP address is included in the peer lists downloaded from torrent trackers. Then uTorrent makes an outbound connection without checking against the blocked IP addresses from the IPFilter.dat file. This makes the IPFilter.data file ineffective. Link to comment Share on other sites More sharing options...
moogly Posted November 9, 2008 Report Share Posted November 9, 2008 Because maybe it's not the function of ipfilter.dat... :/ Link to comment Share on other sites More sharing options...
Ultima Posted November 9, 2008 Report Share Posted November 9, 2008 @moogly: No, it should always be blocked/prevented, regardless of the direction in which the connection was initiated.@jtalk: If indeed it's occuring, then this is definitely something worth looking at. Link to comment Share on other sites More sharing options...
jtalk Posted November 9, 2008 Author Report Share Posted November 9, 2008 The details of this problem.I am using uTorrent 1.8.1. The IP address that I wanted to block was '209.50.48.13'. I see in the PeerGuardian logs that it blocked attempts for outbound connections to this IP address on ports 80 and 4315 (not that the ports matter).An extract from my IPFilter.dat file has the lines:209.050.024.176 - 209.050.024.183 , 000 , Merrill Lynch209.050.048.000 - 209.050.063.255 , 000 , Discovery Networks International Inc209.050.105.000 - 209.050.105.255 , 000 , Headland Digital MediaThis file was generated by BlockList Manager 2.7.7 and exported using the format 'eMule/Donk'. The uTorrent FAQ does not recommend leading '0's on IP addresses but says it is compatible with this format.On starting uTorrent, I get the first log file entry of:[2008-11-09 13:51:39] Loaded ipfilter.dat (242670 entries)So I expect that the IPFilter.dat file loaded correctly.Anything else I should check? Link to comment Share on other sites More sharing options...
Ultima Posted November 9, 2008 Report Share Posted November 9, 2008 Are you using DHT? IINM, communication over DHT is not filtered by ipfilter.dat. Link to comment Share on other sites More sharing options...
jtalk Posted November 9, 2008 Author Report Share Posted November 9, 2008 I am using DHT. The connections to the IP address that I wanted to block was using TCP (DHT uses both UDP and TCP?).But, similar to a firewall, I would expect an IP filter software module to filter independent of of the use of the IP connection. It should filter all connections of any IP protocol from any function in uTorrent if the destination IP address is included in the blocked list.Would you agree? Link to comment Share on other sites More sharing options...
Ultima Posted November 9, 2008 Report Share Posted November 9, 2008 Yes, I tend to agree. Can you try disabling DHT anyway to rule it out? Link to comment Share on other sites More sharing options...
thelittlefire Posted November 9, 2008 Report Share Posted November 9, 2008 I didn't think DHT was a part of the function. You have no control over what DHT nodes you connect to unless you could somehow change your I.D. Is that even possible?... DHT packets are transferred via UDP, and soon more traffic will go out on UDP. If this is a problem now, it should definitely be looked at before that happens. Link to comment Share on other sites More sharing options...
Ultima Posted November 9, 2008 Report Share Posted November 9, 2008 You have no control over who eventually receives your DHT query, but you can still control who you directly send the query to.For the purposes of plausible deniability (or whatever reason people use PG2 for), that seems okay to me, considering the fact that there is no guarantee that a packet not coming directly from you was not forged to make it seem as if you were querying something you in fact never queried for. So just because an undesirable node receives your query doesn't make you any more a target -- no more and no less than when they receive your IP in a tracker peer list.If it's not for privacy reasons, but just because you don't wish to connect to those IPs... well, there's nothing you can do about your own IPs reaching those unwanted IPs in any situation anyhow, so not being able to prevent it in the case of DHT queries propogating through the network won't make a difference anyhow.Knowing that µTorrent isn't talking directly to the IPs for any kind of peer communication, when you specifically tell it not to, is much (and as little) as anyone should expect. UDP vs TCP is not a non-issue in this respect. Link to comment Share on other sites More sharing options...
jtalk Posted November 9, 2008 Author Report Share Posted November 9, 2008 Hi UltimaThat was a comprehensive and fair comment on the expectations and limitations of IPFilter.dat filtering.I started uTorrent and disabled DHT in the BitTorrent options in the Preferences. I restarted uTorrent and found a couple of torrents. I added these torrents to uTorrent and monitored the PeerGuardian logs.Even without DHT, I am still seeing outbound connections to IP addresses that should be blocked. On the two torrents, DHT and Local Peer Discovery are disabled and one torrent has Peer Exchange as inactive. Both torrents have multiple trackers using 'http://'. Link to comment Share on other sites More sharing options...
thelittlefire Posted November 9, 2008 Report Share Posted November 9, 2008 If ipfilter.dat is supposed to work, it should work with DHT enabled. If placing an IP in the block list precludes all traffic to those IPs incoming and outgoing... I was assuming the problem was UDP was not included in this block. If this is indeed the case and it's only DHT, then ignore me Link to comment Share on other sites More sharing options...
Ultima Posted November 9, 2008 Report Share Posted November 9, 2008 From a sorta high level viewpoint, the only difference between UDP and TCP is that the latter has a bit more reliability checking built in, as well as having a sense of connectedness (in the form of a connection, naturally ). Both UDP and TCP need to have a originating address and destination address, right? If ipfilter.dat says not to "connect" (communicate) with a certain IP, then packets originating from that IP should be ignored, and packets destined for that IP should never be sent.@jtalk: Are you sure the connection is actually coming from µTorrent? It doesn't make sense to me that PG would stop logging incoming connections from the IP just because the IP was added to ipfilter.dat. ipfilter.dat does not stop the other IP from connecting. It only stops µTorrent from accepting such an incoming connection, so even if the IP is added to ipfilter.dat, you should very much expect that connections are still attempted from the remote IP -- just that µTorrent doesn't actually connect to it. Link to comment Share on other sites More sharing options...
jtalk Posted November 10, 2008 Author Report Share Posted November 10, 2008 @UltimaI am sure that the connections are coming from uTorrent. I started the computer and left it for a while. I used a few applications and shut them down. The IP address that I named before did not show up in the PeerGuardian logs.I started uTorrent and no problem. I add a torrent file and the IP address that I named showed in the PeerGuardian logs as outbound connections where the source was 192.168.x.x and the destination was 209.50.48.13:80.As for inbound connections from that address, I think I was wrong. I have since learnt to use the search logs of PeerGuardian rather than manually inspect them and I could not find where the above IP address was a source. Sorry for the confusion.I would still like uTorrent to not attempt to connect to IP addresses (source or destination) that a listed in the IPFilter.dat file. Link to comment Share on other sites More sharing options...
Meekrob Posted November 21, 2008 Report Share Posted November 21, 2008 Very interesting.I came across this topic when I did a google search for 209.50.48.13I'm having the same problem as you...except I'm using Azureus.I'm a long-time user of peerguardian, but today I decided to try running the IP filters directly through Azureus. I kept PG2 running, to see if it would catch anything that slipped by the IP filters. Sure enough, there are numerous outbound connection attempts to 209.50.48.13.I hope it's not inappropriate for me to post about this, given that it's not an issue with uTorrent (at least in my case). I'm just hoping to further the discussion and perhaps find a reason behind this rather puzzling problem. Link to comment Share on other sites More sharing options...
Ultima Posted November 21, 2008 Report Share Posted November 21, 2008 I suppose it would be pertinent for users affected to post diagnostics logs for investigation...a) get HijackThis from trendsecure.com, run it, view the log, and post the contents here get Process Explorer from sysinternals.com, run it, Ctrl+D (to show the lower DLL pane), select the µTorrent process from the list, Ctrl+S (and save the list somewhere you'll find easily -- like the Desktop), then post the contents of the saved process list in the .txt file hereIt may well be malware at work here (would explain the lack of sense I'm experiencing here).Perhaps Wireshark logs as well, so we can inspect the contents of the packet. Link to comment Share on other sites More sharing options...
Meekrob Posted November 21, 2008 Report Share Posted November 21, 2008 Ok, I have HJT and procxp log files. Is there a way to attach the files, or should I just copy/paste the text?Also, here's some other information about my system, in case it's relevant:WinXP MCE SP3Peerguardian is version 2.0 beta 6bAzureus is version 4.0.0.0Java is version 6 update 7Background programs running:ZoneAlarm 7.0.483Symantec A/V 10.1.4.4000Folding@home 6.20 Link to comment Share on other sites More sharing options...
GTHK Posted November 21, 2008 Report Share Posted November 21, 2008 ZoneAlarm is a horrible firewall and screws up the operation of many programs.Yay at F@h :3 Link to comment Share on other sites More sharing options...
moogly Posted November 21, 2008 Report Share Posted November 21, 2008 Copy/paste your logs here without using tags. Link to comment Share on other sites More sharing options...
Switeck Posted November 21, 2008 Report Share Posted November 21, 2008 The ipfilter.dat file may be corrupted at some point and not parsing correctly.Try bare ips/ip ranges instead. Link to comment Share on other sites More sharing options...
Meekrob Posted November 22, 2008 Report Share Posted November 22, 2008 OK, here are my logfiles. Also, a potentially important detail I forgot to mention--I have Alcohol 120% installed. I know that sometimes causes strange issues. I'm going to do some testing (turning off ZoneAlarm, etc) and see if the problem still occurs.This is the HJT log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 3:56:58 PM, on 11/21/2008Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16735)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cisvc.exeC:\Utilities\Management\Symantec Antivirus\DefWatch.exeC:\WINDOWS\system32\svchost.exeC:\Utilities\Management\Symantec Antivirus\Rtvscan.exeC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\RTHDCPL.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\UTILIT~1\MANAGE~1\SYMANT~1\VPTray.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Utilities\Networking\ZoneAlarm\zlclient.exeC:\WINDOWS\system32\ctfmon.exeC:\Utilities\Networking\PeerGuardian2\pg2.exeC:\Program Files\Folding@home\Folding@home-x86\Folding@home.exeC:\Documents and Settings\Dave\Application Data\Folding@home-x86\FahCore_78.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\eHome\ehSched.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\cidaemon.exeC:\Utilities\Media\Winamp\winamp.exeC:\Utilities\Management\2xExplorer.exeC:\Utilities\Management\HiJackThis.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [vptray] C:\UTILIT~1\MANAGE~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunO4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Utilities\Networking\ZoneAlarm\zlclient.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [PeerGuardian] C:\Utilities\Networking\PeerGuardian2\pg2.exeO4 - Startup: Folding@home.lnk = ?O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224120113890O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Utilities\Management\Symantec Antivirus\DefWatch.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exeO23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Utilities\Management\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Utilities\Management\Symantec Antivirus\SavRoam.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Utilities\Management\Symantec Antivirus\Rtvscan.exeO23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe--End of file - 6289 bytesAnd the log from procxp:Process PID CPU Description Company NameSystem Idle Process 0 72.86 Interrupts n/a Hardware Interrupts DPCs n/a Deferred Procedure Calls System 4 smss.exe 732 Windows NT Session Manager Microsoft Corporation csrss.exe 780 Client Server Runtime Process Microsoft Corporation winlogon.exe 812 Windows NT Logon Application Microsoft Corporation services.exe 856 Services and Controller app Microsoft Corporation ati2evxx.exe 1048 ATI External Event Utility EXE Module ATI Technologies Inc. svchost.exe 1068 Generic Host Process for Win32 Services Microsoft Corporation ehmsas.exe 3328 Media Center Media Status Aggregator Service Microsoft Corporation svchost.exe 1132 Generic Host Process for Win32 Services Microsoft Corporation svchost.exe 1236 Generic Host Process for Win32 Services Microsoft Corporation svchost.exe 1328 Generic Host Process for Win32 Services Microsoft Corporation svchost.exe 1396 Generic Host Process for Win32 Services Microsoft Corporation vsmon.exe 1436 TrueVector Service Zone Labs, LLC ccSetMgr.exe 620 Symantec Settings Manager Service Symantec Corporation ccEvtMgr.exe 752 Symantec Event Manager Service Symantec Corporation SPBBCSvc.exe 1284 SPBBC Service Symantec Corporation spoolsv.exe 1364 Spooler SubSystem App Microsoft Corporation cisvc.exe 244 Content Index service Microsoft Corporation cidaemon.exe 2660 Indexing Service filter daemon Microsoft Corporation DefWatch.exe 428 Virus Definition Daemon Symantec Corporation svchost.exe 1728 Generic Host Process for Win32 Services Microsoft Corporation svchost.exe 1972 Generic Host Process for Win32 Services Microsoft Corporation Rtvscan.exe 2092 Symantec AntiVirus Symantec Corporation mcrdsvc.exe 2340 MCRD Device Service Microsoft Corporation ehSched.exe 3444 Media Center Scheduler Service Microsoft Corporation alg.exe 3560 Application Layer Gateway Service Microsoft Corporation svchost.exe 1884 Generic Host Process for Win32 Services Microsoft Corporation dllhost.exe 3284 COM Surrogate Microsoft Corporation lsass.exe 868 LSA Shell (Export Version) Microsoft Corporation ati2evxx.exe 1484 ATI External Event Utility EXE Module ATI Technologies Inc.explorer.exe 300 Windows Explorer Microsoft Corporation ehtray.exe 1324 Media Center Tray Applet Microsoft Corporation RTHDCPL.exe 1764 Realtek HD Audio Control Panel Realtek Semiconductor Corp. ccApp.exe 1780 Symantec User Session Symantec Corporation VPTray.exe 1788 Symantec AntiVirus Symantec Corporation zlclient.exe 1808 ZoneAlarm Client Zone Labs, LLC ctfmon.exe 1816 CTF Loader Microsoft Corporation pg2.exe 1824 PeerGuardian 2 Methlabs Folding@home.exe 1876 FahCore_78.exe 2164 25.00 firefox.exe 2752 Firefox Mozilla Corporation thunderbird.exe 2732 Mozilla Thunderbird Mozilla Corporation Azureus.exe 2560 Vuze Inc. procexp.exe 2796 2.14 Sysinternals Process Explorer Sysinternals - www.sysinternals.comMOM.exe 1840 Catalyst Control Center: Monitoring program Advanced Micro Devices Inc. CCC.exe 2912 Catalyst Control Centre: Host application ATI Technologies Inc.Process: Azureus.exe Pid: 2560Name Description Company Name Version2560 ACTIVEDS.dll ADs Router Layer DLL Microsoft Corporation 5.01.2600.5512adsldpc.dll ADs LDAP Provider C DLL Microsoft Corporation 5.01.2600.5512ADVAPI32.DLL Advanced Windows 32 Base API Microsoft Corporation 5.01.2600.5512aereg.dll appHelp.dll Application Compatibility Client Library Microsoft Corporation 5.01.2600.5512ATL.DLL ATL Module for Windows XP (Unicode) Microsoft Corporation 3.05.2284.0001Azureus.exe Vuze Inc. 4.00.0000.0000classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa classes.jsa CLBCATQ.DLL Microsoft Corporation 2001.12.4414.0700COMCTL32.DLL User Experience Controls Library Microsoft Corporation 6.00.2900.5512comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.00.2900.5512COMRes.dll Microsoft Corporation 2001.12.4414.0700CRYPT32.dll Crypto API32 Microsoft Corporation 5.131.2600.5512CSCDLL.dll Offline Network Agent Microsoft Corporation 5.01.2600.5512cscui.dll Client Side Caching UI Microsoft Corporation 5.01.2600.5512ctype.nls DNSAPI.dll DNS Client API DLL Microsoft Corporation 5.01.2600.5625GDI32.dll GDI Client DLL Microsoft Corporation 5.01.2600.5512hnetcfg.dll Home Networking Configuration Manager Microsoft Corporation 5.01.2600.5512hpi.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006iertutil.dll Run time utility for Internet Explorer Microsoft Corporation 7.00.6000.16735IMM32.DLL Windows XP IMM32 API Client DLL Microsoft Corporation 5.01.2600.5512iphlpapi.dll IP Helper API Microsoft Corporation 5.01.2600.5512java.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006jvm.dll Java HotSpot Client VM Sun Microsystems, Inc. 10.00.0000.0023kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 5.01.2600.5512locale.nls management.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006mdnsNSP.dll Bonjour Namespace Provider Apple Inc. 1.00.0005.0011MPRAPI.dll Windows NT MP Router Administration DLL Microsoft Corporation 5.01.2600.5512MSASN1.dll ASN.1 Runtime APIs Microsoft Corporation 5.01.2600.5512MSCTF.dll MSCTF Server DLL Microsoft Corporation 5.01.2600.5512msctfime.ime Microsoft Text Frame Work Service IME Microsoft Corporation 5.01.2600.5512msimg32.dll GDIEXT Client DLL Microsoft Corporation 5.01.2600.5512MSVCP60.dll Microsoft ® C++ Runtime Library Microsoft Corporation 6.02.3104.0000MSVCR71.dll Microsoft® C Runtime Library Microsoft Corporation 7.10.3052.0004msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.00.2600.5512mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 5.01.2600.5625net.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006netapi32.dll Net Win32 API DLL Microsoft Corporation 5.01.2600.5694nio.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006Normaliz.dll Unicode Normalization DLL Microsoft Corporation 6.00.5441.0000ntdll.dll NT Layer DLL Microsoft Corporation 5.01.2600.5512ole32.dll Microsoft OLE for Windows Microsoft Corporation 5.01.2600.5512oleacc.dll Active Accessibility Core Component Microsoft Corporation 4.02.5406.0000oleaccrc.dll Active Accessibility Resource DLL Microsoft Corporation 4.02.5406.0000OLEAUT32.dll Microsoft Corporation 5.01.2600.5512PSAPI.DLL Process Status Helper Microsoft Corporation 5.01.2600.5512rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 5.01.2600.5512RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 5.01.2600.5512rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation 5.01.2600.5507rtutils.dll Routing Utilities Microsoft Corporation 5.01.2600.5512SAMLIB.dll SAM Library DLL Microsoft Corporation 5.01.2600.5512Secur32.dll Security Support Provider Interface Microsoft Corporation 5.01.2600.5512SETUPAPI.dll Windows Setup API Microsoft Corporation 5.01.2600.5512SHELL32.DLL Windows Shell Common Dll Microsoft Corporation 6.00.2900.5512SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation 6.00.2900.5512sortkey.nls sorttbls.nls sunmscapi.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006swt-win32-3448.dll SWT for Windows native library Eclipse Foundation 3.04.0004.0008unicode.nls USER32.dll Windows XP USER API Client DLL Microsoft Corporation 5.01.2600.5512USERENV.dll Userenv Microsoft Corporation 5.01.2600.5512USP10.dll Uniscribe Unicode script processor Microsoft Corporation 1.420.2600.5512uxtheme.dll Microsoft UxTheme Library Microsoft Corporation 6.00.2900.5512verify.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 5.01.2600.5512WININET.dll Internet Extensions for Win32 Microsoft Corporation 7.00.6000.16735WINMM.dll MCI API DLL Microsoft Corporation 5.01.2600.5512winrnr.dll LDAP RnR Provider DLL Microsoft Corporation 5.01.2600.5512WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 5.01.2600.5512WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 5.01.2600.5512WS2HELP.dll Windows Socket 2.0 Helper for Windows NT Microsoft Corporation 5.01.2600.5512wshtcpip.dll Windows Sockets Helper DLL Microsoft Corporation 5.01.2600.5512xpsp2res.dll Service Pack 2 Messages Microsoft Corporation 5.01.2600.5512zip.dll Java Platform SE binary Sun Microsystems, Inc. 6.00.0070.0006 Link to comment Share on other sites More sharing options...
GTHK Posted November 22, 2008 Report Share Posted November 22, 2008 ZA doesn't actually turn off when you tell it too, it's a complete failure. Link to comment Share on other sites More sharing options...
Firon Posted November 22, 2008 Report Share Posted November 22, 2008 You have to uninstall it to disable it. Link to comment Share on other sites More sharing options...
Ultima Posted November 22, 2008 Report Share Posted November 22, 2008 Hm, the logs don't look suspicious. I suppose a Wireshark log would probably be more revealing in this situation. Link to comment Share on other sites More sharing options...
thelittlefire Posted November 22, 2008 Report Share Posted November 22, 2008 Create a utorrent.exe logfile. We are not azureus support. Link to comment Share on other sites More sharing options...
Meekrob Posted November 22, 2008 Report Share Posted November 22, 2008 I'm not currently running uTorrent. I am not the OP of this topic. As I've said multiple times, I'm not interested in Azureus support, I'm simply trying to contribute in a constructive manner, since I've experienced the same (apparently rare) problem as the OP. Feel free to ignore my posts if you want to blame the problem on Azureus. Given that this is the only place on the internet where a discussion of the particular IPs in question is occurring, I thought it would be helpful to post my findings.If it comes down to it, I could get uTorrent, load the same torrents and IPfilters, and see if the problem still occurs. Right now, though, I'm more interested to find out more about the OP's configuration, to see what we have in common. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.