Solved Some apps unable to access the Internet

[dma5m561]

Hello Ray, I'm afraid my previous posting was rather misleading - installing the Draytek router in place of the apparently-faulty Billion simply enabled me to get back on-line but it didn't have any effect on the inability of IE 11, the Macrium updater and other apps to access the Internet. Their behaviour was exactly as it had been before with the Billion router installed, so that's eliminated the router as the cause of the problem.

It turns out that my Billion router wasn't faulty at all - it just needed a full factory reset to get the ADSL connectivity working again. This was suggested to me by the helpful support folks at Billion UK. I've done the reset, and upgraded the router's firmware at the same time, and the Billion is now re-installed and working fine again. Apparently there have been some occasions when power-cycling a Billion router has caused its config to get corrupted; I've been assured by Billion support that after it's happened once it never happens again - time will tell! Good job I've got my router on a UPS!

So, it looks like I'm going to have to do the Win 7 re-install to get round the problem with the PC after all; all I need to do is summon up the time and enthusiasm for doing it...

--
Martin

 

[dma5m561]

Well, I'm pleased to report that the problem has finally been resolved and it turned out to be something completely unexpected and out of left-field!

I spent several tedious hours on Mon 22nd Sept doing a complete re-install of Win7 Pro on the C: drive on my Dell OptiPlex 780; fortunately most of the apps I use and their associated log and data files etc are installed on a separate partition. The Win7 install itself, including reformatting the C: drive and installing all the system-specific Dell drivers after the O/S, went smoothly enough and didn't take unduly long but then waiting for the large number (around 200) of Win7 updates to download and install was exceedingly time-consuming and boring...

Anyway, after a while the system was up and running as I wanted it, so I installed a few essential apps - Firefox, Macrium Reflect and Microsoft Security Essentials - and found that other apps such as IE 11 and the Macrium updater could happily connect to the Internet. Great, I thought - problem solved, so I took a full image of the C: drive using Macrium so that I've got a clean install that can be restored if necessary in the future.

I then installed a couple of utilities that I've used for some years, including one called Prio - this is a Task Manager enhancement (supposedly fully Win7-compatible) that, amongst other things, enables you to set and save the priorities of processes. I used this utility on the old WinXP machine that the Win7 machine is replacing as a means of slightly elevating (to Above Normal) the priority of an app that generates and sends data in real-time - the data stream sent by the app on the WinXP machine (1.7GHz P4 with 1G RAM) used to 'stutter' and have gaps when its process priority was normal and slightly raising the app's priority overcame this.

After installing Prio, and a couple of other small utilities, I found that IE 11 and the Macrium updater were no longer able to access the Internet, ie. the symptoms were exactly the same as before the O/S re-install - gulp, sinking feeling, oh no...

Anyway, as soon as I uninstalled the Prio utility everything began to work properly again, so it was clearly the cause of the problem - quite why a Task Manager enhancement that wasn't even running should have such an effect on connectivity is quite beyond my comprehension! Presumably some part of Prio sits running in the background even when Task Manager and Prio themselves aren't up and running, and it was this background Prio process that was causing the problem.

I've now got the system pretty much back to where I want it; I haven't yet checked fully whether the real-time app performs as desired on the Win7 machine (3.0GHz E8400 dual-core CPU & 4G RAM, so much faster than the old WinXP machine!) when its process priority is set at normal - hopefully it will! If it doesn't then I've have to find a utility other than Prio that will let me tweak process priorities.

My thanks go to both Ray and Tookeri for your help and support - it was absolutely invaluable having someone else to share the problem with, and you've also given me some excellent suggestions about alternatives to using Comodo Firewall on not only this Win7 machine but also another one I'm going to start building shortly!

Best wishes,

--
Martin

 

[Tookeri]

That was one of the more stranger things I've heard of I think. Great detective work

It's possible to create/modify a shortcut to start a program with a certain priority. See option two in this Tutorial:
http://www.sevenforums.com/tutorials/83361-priority-level-set-applications-processes.html

 

[dma5m561]

Hi again Tookeri, yes it was a bit of a strange problem, wasn't it??!! At least I've got it sorted.

Many thanks for the link to the Tutorial; I've had a quick look at it and at how to alter a process's priority via Task Manager - the WinXP Task Manager didn't include the ability to change priorities which was why I had to resort to using the Prio utility. It's good to see that priorities *can* be changed through the Win7 Task Manager; I'll also take a closer look at how to create a shortcut that starts my real-time app at 'AboveNormal' priority.

In one of your earlier posts you referred to the Windows Firewall Control add-on for the inbuilt Win7 firewall; I've followed the link in your signature block and it goes to the BiniSoft.org website for WFC. However, a Google search has also revealed another app called Windows Firewall Control from an organisation called Sphinx Software; were you aware of this one and have you tried it and compared it against the BiniSoft app?

Thanks again for all the help,

--
Martin

 

[Tookeri]

Hi Martin,

Yes, that was super weird!!

Regarding WFC, I did compare them once plus tried to find other alternative GUI application for Windows Firewall. I don't remember exactly why I chose BiniSoft but I do remember after comparing that BiniSoft was the only option I could go for. Besides that, they have great support both through email and at the forum site WildersSecurity, you can find a link from the home page. A lot of users have suggested great new features there that have been included in later versions so it's keep getting even better than when I first started using it. I think it's an excellent program that can do exactly everything I need (and more).

The log interface is very nice with search function and you can easily choose to log allowed and/or blocked connections if you want.
You can create temporary rules for example for 5 minutes.
If you run an Installer that uses temp files so it's hard to define rules, for example Adobe Flash, you can temporarily switch to a different setting for example one that automatically allows digitally signed programs with a valid signature. And then switch back.

Note that you need to be a registered user (small donation) to get all features including pop-ups when something is blocked.

I use it almost every day to add/modify rules or to track connections from the log interface.

Well, you'll never have to go into "Windows Firewall with Advanced Security again", that's for sure. That's a terrible GUI if you ask me! The WFC developers has really covered everything that's bad or lacking in the Windows Firewall GUI. I often see posts from new users at WildersSecurity forum saying thanks for a great program.

 

[dma5m561]

Hi Tookeri, thanks for all the info about the BiniSoft variant of WFC.

I downloaded and installed it, but for some reason couldn't get fully to grips with it - for example, after I'd installed WFC my NTP client s/ware (from Meinberg) was unable to connect to any NTP servers and no matter what I tried I couldn't see how to get the firewall to allow the NTP daemon 'ntpd.exe' through. I suspect this was largely due to my unfamiliarity with the Windows firewall and how it does things, whereas I'm pretty familiar with configuring Comodo Firewall and how to respond to its alerts.

So, after quite a lot of unsuccessful fiddling around with WFC I decided to uninstall it and to go back to something I knew worked with the NTP client (and the other specialist apps I use), so I've now (successfully!) installed a version of Comodo Firewall again. It's an earlier version that I've got running under WinXP on another PC, and it does exactly what I need - it alerts me if anything new or different tries to make an outbound connection from the Win7 PC to anything either on my LAN or in the outside world. In the several (probably at least 6 or 7) years that I've used Comodo I don't recall ever having seen any alerts of 'unauthorised' inbound connection attempts, other than when I've mis-configured a machine on the LAN, so I believe my router is doing a good job at blocking stuff coming from the Internet - its firewall log shows lots of ICMP Packer attacks from numerous IP addresses getting blocked.

So, the Win7 machine is now fully up and running and doing what it's supposed to, and hopefully the connectivity issues with it are gone for good!!

Cheers, and thanks again,

--
Martin

 

[Tookeri]

Hi Martin,

I'm glad you find a solution that works for you and that all seems well.

And just to explain: I should've been more clear about WFC as it's not a firewall itself and shouldn't be compared to 3rd party firewalls. Users usually get WFC to control outbound connections and when using the recommended settings the Windows firewall setting for outbound will change from Allow to Block. This requires the user himself to properly configure and add all necessary outbound rules which might be too much and too complicated for some. It has nothing to do with WFC, but is all about how Windows Firewall works. WFC can help with alerts, depending on the notification settings, even for blocked connections for svchost and System.

Routers get attacked all the time. What's important is to have a router with firewall turned on, which you have. I don't even check my router logs anymore as I see no point with it.

 

[dma5m561]

Hi Tookeri, all understood re: WFC - I was aware that it wasn't a firewall in its own right but simply a means of managing the rules on Windows Firewall, but although I fiddled around with WFC for a while I couldn't work out how to get it to set a rule that would allow the NTP daemon to have outbound access to the Internet. I did however get WFC to allow some other apps, including Firefox, IE and the puTTY telnet client, to get through the firewall, but the NTP daemon doesn't run as an app in the conventional sense - it has no GUI but just runs as a process with real-time priority - so I couldn't just click on something to get WFC to allow it through. Perhaps I should have persevered and spent more time understanding Windows Firewall and working out how to use WFC!!

Re: routers being attacked, although over the years I've always enabled as much protection as possible on my routers I've only very recently enabled the logging on my current Billion 7800N router so am only now aware of just how many attacks there are! As you say, there's little point in checking the logs regularly - it's mildly interesting to know about the attacks but there's nothing I can do to stop them!!

--
Martin

 

[Tookeri]

If you in the future would decide to try it again:

I use the Connections Log to find any blocked connections, and add rules from there. I think that's the easiest way for programs without a GUI. This includes some Windows internal programs too for example Windows Update (svchost.exe) and Windows Activation Technologies Service (watadminsvc.exe)

User friendly 3rd party firewalls automatically allows known applications including Windows own, while using Windows Firewall and WFC you basically start from scratch except for the default rules.

 

[KEiGHT]

For Windows 7

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters]
"DeadGWDetectDefault"=dword:00000001
"DisableTaskOffload"=dword:00000000
"DefaultTTL"=dword:00000040
"EnablePMTUDiscovery"=dword:00000001
"EnableICMPRedirect"=dword:00000000
"EnableWsd"=dword:00000000
"QualifyingDestinationThreshold"=dword:00000003
"StrictTimeWaitSeqCheck"=dword:00000001
"Tcp1323Opts"=dword:00000001
"TcpMaxPortsExhausted"=dword:00000005
"TcpTimedWaitDelay"=dword:0000001e
"TcpMaxDataRetransmissions"=dword:00000003