µTorrent wont recognise that ports are forwarded

Big Sniff · December 30, 2008

Help with this would be great as this is the straw that is going to break the camels back.

I have forwarded my ports on my TP Link TD-W8920G as per the instructions in portsforward.com but can not get a green light in µTorrent, only orange and then red with a very artificial looking download speed of 25kb/s (my max dl speed is about 650kb/s), on any torrent.

Now the strange thing is, when I test if ports are forwarded properly I get this:

Checking port 62484 on 203.59.xxx.xxx...

OK! Port 62484 is open and accepting connections.

You will be able to receive incoming BitTorrent connections.

So whats going on here? Is it forwarded or not? I'm guessing not.

Sidenote: I have FULLY disabled A/V and firewall while testing.

Switeck · December 30, 2008

Many software firewalls are VERY poorly designed and must be completely uninstalled to remove their interference with uTorrent.

Big Sniff · December 31, 2008

Then I think I'll give uTorrent a miss if it can't work with Windows firewall.

DreadWingKnight · December 31, 2008

Post a hijackthis log and process explorer process list with the dll list for the utorrent.exe process

Switeck · December 31, 2008

Your modem may be acting as a router/firewall as well.

Was it on the list at www.portforward.com ROUTERS section?

Big Sniff · December 31, 2008

Problem solved with version 1.7.7

All I needed to do was enter port 62484 in uTorrent, which I'm guessing means I setup the modem correctly, and have been maxing my connection all day.

FYI, I tested versions from 1.6 and 1.7.7 was the latest that would work without being a moody cow. I know 1.8.1 works but it just wouldn't this time.

Side note: I noticed a sticky saying you will not help find older versions of uTorrent. Well I think that will just force people to use other apps if they have the same issues I had. Something to consider maybe? Maybe not by the tone of posts about the subject.

moogly · December 31, 2008

Only 1.8.1 supported.

DreadWingKnight · December 31, 2008

So you basically want to go back to versions with security holes and other problems rather than troubleshoot the real issue?

Big Sniff · December 31, 2008

I never had an issue with any previous version regarding security so I'm not really sure what that's about, I'll have a Google in a minute.

As for not wanting to troubleshoot, this is not the only forum I posted in about this. I have a local (Australian) forum that I post in also and the thread in there was like 4 pages long with input from about 20 different people that also know a hell of a lot about this type of thing. Downgrading to 1.7.7 was a last resort believe me.

"Only 1.8.1 supported"

I kind of got that impression already moogly.

Ultima · January 1, 2009

a) get HijackThis from trendsecure.com, run it, view the log, and post the contents here

get Process Explorer from sysinternals.com, run it, Ctrl+D (to show the lower DLL pane), select the µTorrent process from the list, Ctrl+S (and save the list somewhere you'll find easily -- like the Desktop), then post the contents of the saved process list in the .txt file here

As well, have you tried removing the rule for µTorrent in Windows Firewall and letting µTorrent recreate the rule? When the network status light goes red, what does its tooltip say?

Edit: As for security issues... http://secunia.com/advisories/product/13466/?task=advisories

I'm not even sure whether that's a complete list of the old vulnerabilities. The point is, in older versions of µTorrent, maliciously-crafted .torrent files can cause exploitable buffer overflows that lead to arbitrary code execution. Some other vulnerabilities leave µTorrent pre-1.8 open to DoS attacks (crashes from remote peers).

Big Sniff · January 1, 2009

On it now. Will post in a minute

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:18:18 AM, on 2/01/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Microsoft Windows OneCare Live\winssnotify.exe

C:\Program Files (x86)\NETGEAR\WPN311\wlancfg5.exe

C:\Users\Shane\Desktop\Web Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll

O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files (x86)\NETGEAR\WPN311\wlancfg5.exe

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files (x86)\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files (x86)\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files (x86)\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dllink.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~1.0_0\bin\ssv.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll

O13 - Gopher Prefix:

O17 - HKLM\System\CCS\Services\Tcpip\..\{D919EAE8-4296-4F53-9E91-D1E38DBF745D}: NameServer = 203.0.178.191,203.215.29.191

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSer64.exe

O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NMIndexingService - Unknown owner - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 7506 bytes

Ultima · January 1, 2009

Process Explorer list? And how about the remaining 2 questions?

(BTW, it would be best if these logs are provided around the same time you get the port forwarding error in µTorrent)

Edit: Heh

Big Sniff · January 1, 2009

Ahh crap. I'm on 1.7.7 now. I'll update it again to 1.8.1 and run these.

To the first question, I deleted the rules each time I uninstalled 1.8.1 so I guess it made its own rule after that.

To the second, I dont know about tooltip.

I hope this is what you need.

These should be the right ones. Both run while uTorrent showing red stutus.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:34:42 AM, on 2/01/2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Microsoft Windows OneCare Live\winssnotify.exe

C:\Program Files (x86)\NETGEAR\WPN311\wlancfg5.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\uTorrent\uTorrent.exe

c:\Users\Shane\Desktop\Web Downloads\HiJackThis.exe