Detect what software is blocking connections

Jan 26, 2006 3 Replies
C

Hello all!



If this is offtopic, please advise of a better newsgroup, I thought this may be the right one.



Our customers download and install our client/server based software on their computer. Many of our customers use Norton Internet Security and other types of software that block ours from connecting to the Internet. Sometimes the users don't know to click "Allow" and they block it then call us wanting to know why it's not working.



My problem is that on some computers, we can find no software that is blocking connections but it is obviously happening. My question is does



anyone know of any software out there that will tell you what program in memory is blocking network connections or acting as a firewall?



Thanks so much!



Matthew



Vote
Twitter Facebook LinkedIn
J

on windows, these are usually Winsock hooks into the TCP stack as seen by spybot S&D:

Protocol 1: MSAFD Tcpip [TCP/IP] GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Filename: %SystemRoot%\\system32\\mswsock.dll Description: Microsoft Windows NT/2k/XP IP protocol DB filename: %SystemRoot%\\system32\\mswsock.dll DB protocol: MSAFD Tcpip [*]

Protocol 2: MSAFD Tcpip [UDP/IP] GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Filename: %SystemRoot%\\system32\\mswsock.dll Description: Microsoft Windows NT/2k/XP IP protocol DB filename: %SystemRoot%\\system32\\mswsock.dll DB protocol: MSAFD Tcpip [*]

Protocol 3: MSAFD Tcpip [RAW/IP] GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192} Filename: %SystemRoot%\\system32\\mswsock.dll Description: Microsoft Windows NT/2k/XP IP protocol DB filename: %SystemRoot%\\system32\\mswsock.dll DB protocol: MSAFD Tcpip [*]

Vote
Twitter Facebook LinkedIn
V

This is not as easy as expected.

One of the easiest ways is to try to detect the "Personal Firewalls" by having a list of signatures and finding them like a virus scanner finds viruses.

Yours, VB.

Vote
Twitter Facebook LinkedIn
C

Jeff, many thanks for your reply! I've spent a few days researching this and your answer is about what I have come to understand from what I have read and seems to make the most sense. Do you have any idea HOW SpyBot determines what is hooking the winsock DLLs? I know just enough about Windows hooking to get a basic grasp on things, but not enough to figure out how to determine what is hooking. Thanks!

Matthew

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required