Crashing like mad

[Jason J. Ellingson]

eWall 2.0 is just not happy.

1) checked for any *.dat files... didn't have any (never used the
trusted/banned lists)
2) uninstalled LSP 1
3) uninstalled eWall 1 (program files only)
4) rebooted
5) installed eWall 2
6) installed LSP 2
7) ran eWall 2
8) told it to update the filters

Won't run at all. So I:

1) Deleted the agents and servers (which were all wrong - it tried to bind
to everything and then duplicated the same server twice for that one agent).
Put in the IPs to respond to and the server to send it to.

It seemed to run and accept connections, but drop them right away. So I:

1) Deleted all the "respond to client" stuff (554 - Virus in email) as
that's not supported anymore

didn't work.

1) Went into options and removed the "allow trusted ips to connect"
checkmark

Success! Started getting connections and email.

After about 50 connections, it stopped taking connections from the external
IP, but worked fine for the loopback ip (127.0.0.1). So now, I have
ServersAlive monitor the external IP (connects via external IP). But it
never seems to go more than about a dozen or two connections and again
doesn't accept anything anymore. It just sits there.

This is not good.

Logs show NOTHING. They show normal activity with last activity being a
normal "Disconnected" and then NOTHING more.... it is not hanging on a
filter or anything.... just doesn't accept a connection.

- Jason

[Dave Taylor]

had similar problems with my trial of 2.0 under win2000 pro. worked fine
for a while then just stopped taking connections, no message or log entry or
anything, just sitting there.
Gone back to 1.0 on a different machine.
Dave

[Cozmo]

same problem here - runs for max about 1/2 hour...then quits - doesnt say
its quit, just doesnt work - no log entries, no event log entries,
nothing...

Is anyone actually using this version successfully ?

[Rick Mogstad]

does anyone else have the guts to try? Im waiting for the bugs to be worked out...... I wish I
could tell my router to try one machine, and if no response, then forward to another. Then I
could put EW2.0 on my workstation, but if it failed, it would fail over to the other one.

[Alexander Telegin [SSS]]

Let's fix it! Guys, what options do you use?

TrustedIPs
BannedIPs
Country Blocking
DNS Black Lists
Harvesters Blocking
Misc -> Inactivity timeout
Misc -> Message size
Misc -> Reject connection...
Misc -> Drop connection...

Also, can somebody give me access to theirs host where I can test EW?

- Alex

[Jason J. Ellingson]

Alex, I can give you anything you need.

I don't used trusted or banned IPs. They are both unchecked.
I don't use country, DNSBL, or Harvester blocking either... all unchecked.
Inactivity is set at default 30 seconds.
Message size set to 0 (unlimited)

I have no "reject connection" or "drop connection" stuff in Misc tab.

Basically, I don't reject, block or ANYTHING. I just do virus checking
(delete if infected), spam checking (allow spam assassin to rewrite message
if spam), and add a few headers (antivirus name and version, received
headers, etc).

If you want access to my machine, I'll let you have at it with me watching.
You can access it until 00:00 GMT. Do you use Yahoo! Messenger or something
similar that I can give you a VPN username/password along with the VNC
password?

- Jason

[Steve Pierce]

Alex you can have access to mine, contact me off line

- Steve

[James Robertson]

I will test over the weekend... if there are problems Alex you will be more
than welcome to connect.

cheers,
James

[Bob Escher]

Same problems I had
I am back down to 1.52

Bob E

[Cozmo]

alex,
i think it might be, on mine at least, a problem with ewlsp (v1) - i cannot
unregister the dll, i cant delete the file, i think that may be the
problem...

as i said before, would gladly give you access to my server, but obviously
not posting in this newsgroup.

[Jason J. Ellingson]

Alex has been on my server for a couple hours today. But alas, no solution
yet.

To remove EWLSP 1, you need to uninstall it from Control Panel (add/remove
program) and then reboot your computer.

I think an "Uninstall" link in the "eWall" Start Menu would be nice... but
in the meantime, this is how you do it.

- Jason

[Jason J. Ellingson]

For now, we've reverted my server back to 1.0.152

Hopefully Alex can figure out the problem without having to rewrite eWall.

Anyone get it to work stable? I think Alex has been using NT4 SP6 to test
on. My server is Windows 2000 Server w/ 2 CPUs...

- Jason

[Bob Escher]

Gee that makes a few of us that have reverted

Bob E

[Cozmo]

Boy cant tell you how id love to uninstall it from add/remove programs - but
i dont have that option.

[Cozmo]

ok, i went through registry and found an ewlsp entry under WINSOCK2 - i
removed the reference, rebooted (15th time now ?) and it seems finally ewlsp
is uninstalled.

I have no reinstalled ewall 2 - i no longer get the floating point error on
the ip lists....now to see if the proxy stays running for more than a few
minutes...

[Rick Mogstad]

how is this working out for you?

[Cozmo]

OK, i did this at 12:25 am as you can see on my last post (thats PDT)

It ran all the way through to this morning.

I had EVERYTHING turned off in options, but had my filters for spam and
virus running.

Interesting thing was, i stopped it, and it stopped fine...

Then i added bl.spamcop.net, and sbl.spamhaus.org to my dnsbl. Since doing
that, when i hit 'stop' (or is it 'pause'), i am back to getting a dr watson
error..

but at least ewall seems to be working !!

I am not sure what ewlsp is or how it works, but it doesnt show on task
manager or using pview or anything else. When i tried to deregister the dll
i got a bunch of cryptic error messages (typical microsoft 000x8575400
...blah blah). At some point it said "ewlsp is installed but no
uninstallpoint was found" or something like that ??

Not hearing anything in this thread from alex, i can only offer up what i
know and what seems to be working for me !

[Rick Mogstad]

great. Ill try to install at lunch!

[Cozmo]

I should recap i guess..

Based on my problems with ewall stopping, i :

uninstalled ewall 2
tried deleting all files in ewall directory, but ewlsp would not delete
tried 1000 things to get rid of it, finally finding a key in the registry
under WINSOCK2 and deleting that
rebooted the server after this and then deleted the file
then rebooted again
then installed ewall2
now it SEEMS to be working.

[Rick Mogstad]

that was EWLSP 1.0 and not 2.0 though right? It kinda seems like it may have a problem running
with the old version of EWLSP.

[Alexander Telegin [SSS]]

> that was EWLSP 1.0 and not 2.0 though right? It kinda seems like it may
have a problem running
> with the old version of EWLSP.

Yes, EWLSP1.0 won't work with EW2.0b.

- Alex

[Cozmo]

Yes, that was the ewlsp 1 that i had installed with ewall 1.52 (or whatever
the last one was called...)

[Rick Mogstad]

Do you think it is the cause of all of these problems? It seems like removing it has made quite a
difference for Coz.

[Rick Mogstad]

have you installed EWLSP 2 yet? :)

[Alexander Telegin [SSS]]

Using EWLSP1.0 with EW2.0 may cause crashes, but there can be other bugs.

- Alex

[Cozmo]

I have not put ewlsp 2.0 on yet - im going to let it run on its own for a
while to see if the problem is gone.

Alex -the 'long and short of this' is that others are having the problem,
maybe because they have not, or cannot, uninstall ewlsp 1.0 - some advice on
HOW to remove it might be an asset !

[Alexander Telegin [SSS]]

It can be uninstalled using standart uninstaller from Control Panel amd
rebooting. I recall, I've installed EWLSP1.0 on your PC manually, that's why
it doesn't have uninstaller.

- Alex

[Cozmo]

I installed it from the download on your website, and it is NOT on the
uninstall list on control panel - it also isnt in the registry anywhere
except for that winsock2 category, and it also does not show up in task
manager, or deregister using regsvr32 /u - but the file is locked/in use and
cant be deleted - so i think there's more to this than just 'uninstalling'.

[Eric Garnice]

So why not just install it again, then it should show up in Uninstall in the
Control Panel?

[Alexander Telegin [SSS]]

Mike have tried uninstall it manually. He removed some obvious registry
record from Winsock key but didn't unregister it from LSP chain because it's
possible only using Winsock API. Installing/uninstalling won't help because
install will register it as just one more LSP in chain.

- Alex

[Bob Escher]

I don't even have it in my folder let alone installed
that wasn't part of my problems


Bob e

[Cozmo]

I HAD to uninstall it manually because there was no option to uninstall it
any other way !!

I KNOW this was causing my problem, as, making this change, my problem has
gone away !! I figure that other people likely have the same problem, as
there was no way to see if ewlsp is running as it binds to the winsock and
shows up NOWHERE.

Again - my problem was - ewall would work for 3-5 minutes and just stop. No
indication it had stopped, no errors, no log -it would just sit there, said
RUNNING but was in fact not working.

The source of the problem EWLSP v1 with EWALL 2 (yes, obviously, these two
should not be together, but again, was no way of knowing that my EWLSP v1
remained on my system - it does not show up in task manager or pview or
anywhere else.) My only indication that ewlsp was still running was that i
could not delete the file from the ewall directory, it said "in use or
permissions error".

I reinstalled ewall 1.0 but still did not have the uninstall option on
control panel or anywhere else.

I then manually removed the key in WINSOCK2 called EWLSP and a key below it
that had one of the big {xxxxxxx-xxxxxx-xxx} type numbers.
Rebooted my machine and then ewall 2.0 would work.

HOWEVER - if i ran the utility SPORDER which alex gave me before, - this
shows the LSP chain that alex references below - i would still see ewlsp
bound to the winsock. Alex says this is bad. When we installed ewlsp 2.0,
we then had ewlsp in the list twice. Again, alex says "this is bad"

Then alex logged into my computer and using a modified version of his
installer, and manually editing the registry, was able to uninstall ewlsp
v1. You would need to get full details on what he did from him, but i
believe most of his trouble with this was because i manually deleted the
registry key....sorry alex, but i had to , as my mail server was not running
!

My server is now continuing to run since last night midnite so i am quite
confident this was the problem - no , change that, im SURE this was the
problem.

If you are having the problem with the server just not responding, but
saying it is running, then i recommend you check the status of your ewlsp if
you had it installed with v1, and if you dont have the uninstall option, and
you cannot rename or delete the .dll file because it is in use, you need to
contact alex to get some help having it removed - it definitely does NOT
work with ewall 2.0 and cause the problem for me.