I'm getting a Yellow triangle with a black exclamation point

[Atooraya]

When utorrent is running.

it looks like this:

I did some research and found this to be the cause:

Explanation
The TCP/IP stack in Windows XP with Service Pack 2 (SP2) installed limits the number of concurrent, incomplete outbound TCP connection attempts. When the limit is reached, subsequent connection attempts are put in a queue and resolved at a fixed rate so that there are only a limited number of connections in the incomplete state. During normal operation, when programs are connecting to available hosts at valid IP addresses, no limit is imposed on the number of connections in the incomplete state. When the number of incomplete connections exceeds the limit, for example, as a result of programs connecting to IP addresses that are not valid, connection-rate limitations are invoked, and this event is logged.

Establishing connection–rate limitations helps to limit the speed at which malicious programs, such as viruses and worms, spread to uninfected computers. Malicious programs often attempt to reach uninfected computers by opening simultaneous connections to random IP addresses. Most of these random addresses result in failed connections, so a burst of such activity on a computer is a signal that it may have been infected by a malicious program.

Connection-rate limitations may cause certain security tools, such as port scanners, to run more slowly.


User Action
This event is a warning that a malicious program or a virus might be running on the system. To troubleshoot the issue, find the program that is responsible for the failing connection attempts and, if the program might be malicious, close the program as follows.

To close the program

At the command prompt, type
Netstat –no
Find the process with a large number of open connections that are not yet established.
These connections are indicated by the TCP state SYN_SEND in the State column of the Active Connections information.
Note the process identification number (PID) of the process in the PID column.
Press CTRL+ALT+DELETE and then click Task Manager.
On the Processes tab, select the processes with the matching PID, and then click End Process.
If you need to select the option to view the PID for processes, on the View menu, click Select Columns, select the PID (Process Identifier) check box, and then click OK.

the question is, why did this start happening all of a sudden?

this error comes up like every 30 seconds, and disappears when you try to click it

[µtorrent-Guest]

unfortunately we can not see your picture!

use a host that is allows real hot linking; imageshack.us as example.

And DO NOT MESS(!) with the advanced settings if you do not know what they do!

(like causing this error when changing blindly values like net max half open)

[Atooraya]

i fixed the picture

i don't think i messed with the advanced settings at all

[Switeck]

"the question is, why did this start happening all of a sudden?"

A malicious piece of software is on your computer that is crippling your system's performance. It's a Microsoft Windows XP "upgrade" straight from Microsoft that cripples your system.

Anyway, you probably need to re-run the tcpip.sys patch from LvlLord.

Read here for more details:

http://www.utorrent.com/faq.php#Does_.C2.B5Torrent_work_well_on_Windows_XP_SP2_systems_with_an_unpatched_TCPIP.sys.3F

[Atooraya]

i patched it and it didnt work.

i did do an update the other day and i think thats when it started happening

[Firon]

So patch it again and set net.max_halfopen back to the default.

[µtorrent-Guest]

the original µtorrent (not messed with advanced settings!) will not try to open more then 8 connections at once! So if you get this warning message in very frequent times than either you DO have changed the net max half open value (aka. messed with advanced) or another programm that opens more then 10 connections at once is the cause. either that kind of programm named in your cite or another filesharing aplication.

[Atooraya]

i'm looking at advanced and the max_halfopen is at 8 still :-/

i don't have anything else that's open right now

[Firon]

Just ignore it then.

[Atooraya]

i'd like to but then i can't use utorrent because the warning pops up with a noise from XP every 20-30 secs

[µtorrent-Guest]

Atooraya

to cite myself:

"another programm that opens more then 10 connections at once is the cause. either that kind of programm named in your cite or another filesharing aplication."

In other words. you might have a virus running when you dont have another p2p thing running!

Do a professional search what is on your PC.

µtorrent is NOT the cause for that if you telling the truth 'bout "net max half open"

[Ultima]

@Atooraya: I'm not sure if you did already, but your responses don't indicate so, so I'll reiterate -- repatch the TCPIP.sys. If that doesn't help, then there's definitely something else wrong with your computer.

[Switeck]

Get TCPview from www.sysinternals.com

Use it while µTorrent is shut down!

That will tell you if/what is using all the connections on a Win XP box.

[splintax]

A malicious piece of software is on your computer that is crippling your system's performance. It's a Microsoft Windows XP "upgrade" straight from Microsoft that cripples your system.

Stop with the anti-MS FUD. So they re-patch your system incase it was patched by a virus.. eh. Sure, it would be nice if you could disable this, but for 99% of users (many of them clueless) this is a good thing.

[Switeck]

The Microsoft repatching the person's TCPIP.sys was the likely cause.

Am I not allowed to make fun of a crappy OS?

[µtorrent-Guest]

Am I not allowed to make fun of a crappy OS?

Yes you are, imho!

BUT: to tell some DAU that answer will just confuse him without anyxkind of help at all. Furthermore your answer could be extremely misinterpreted by such user. In this case he have not even has patched it to a higher allowance before and µtorrent could never ever be the cause due to the fact that it did not produce such warning message in its default configuration.

So such an answer as yours is contraproductive when we deal with "non geeky default values"-users that might have a serious security problem with its PCs

[Atooraya]

Alrite, i tried patching and made the connections 50, but it still comes up.

I dl'ed the TCP View and here's what i see:

I also haven't messed around with the advanced settings in utorrent because if i did, there would be an asterik next to the changed fields, and there are none.

[bellicose]

it looks like outlook and firefox that's making a problem. They're making way too much open connections

[µtorrent-Guest]

So, why do you have so much Outlook conections and why is remote control software running on your machine?!

[Atooraya]

i don't know why outlook has that many questions to be honest.

also, i use the VNC because i take my laptop with me around the house, and this way i can check thinks on my desktop when i work on my xbox in the basement. it also makes for a nifty remote control if i'm watching a movie in bed :-x

how do i limit the amount of connections that these programs can use?

[Atooraya]

that's a view when utorrent is open

Thumbnail big pics next time.

[Atooraya]

i've run the patch and made the connections 100

i went to the settings thru utorrent and changed it to max global connections of 80

even when i close outlook and just use firefox and utorrent, the error comes up, but it ONLY comes up when i open utorrent

[Atooraya]

Atooraya

to cite myself:

"another programm that opens more then 10 connections at once is the cause. either that kind of programm named in your cite or another filesharing aplication."

In other words. you might have a virus running when you dont have another p2p thing running!

Do a professional search what is on your PC.

µtorrent is NOT the cause for that if you telling the truth 'bout "net max half open"

if i did change the net max half open, or ANYTHING in advanced, i'd have a little asterisk next to it, right?

[Atooraya]

after checking the event log in system tools, this is what i found!

Application popup: utorrent.exe - Corrupt File : The file or directory C:\DOCUME~1\Robert\Application Data\uTorrent\resume.dat.old is corrupt and unreadable. Please run the Chkdsk utility.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

[µtorrent-Guest]

Atooraya

there is something you did not get at all i think.

the patching with this lvlord.de version of the TCPIP.sys file is theirfor that you can have the number of halfopen connections higher than 10.

If you have not changed the number in the advanced settings from µtorrent "net max half open" to more than the default 8, than you will NEVER EVER get the warning message as a result of what µtorrent is doing.

Some other programm on your PC is responseable for having many half open connetions. And when you start µtorrent it puts his 8 (that will NOT trigger the warning on its own) on top of it and then you get it.

When you said you Did patch to 100 concurretn connection attemps allowed and the error still comes up when µtorrent is active, than there is something very wrong with your PC. But it is not µtorrents fault when net max half open is on default 8!!

as for the application popup:

so check your HDD for errors with checkdisk than.

And maybe you should boot your system with a Linux based Malwarescanning- Antivirus CD. So you can be shure that your Tests for Malware will not be manipulated by running the test under an OS that might be under the influence of that Malware and so faking reports of scannign tools like spybot S&D, Antivirus or Rootkitscanners.