firewall blocked sfp from accessing web

andrew · Post by **andrew** » Tue Dec 07, 2004 5:08 pm

I've just rebooted my machine and my firewall has faithfully reported to me that SFP.exe has changed since the last time i used it and that it was trying to access 224.0.0.22... strange - I didn't know scope accessed the net .. any ideas?

Thanks

Andrew

marcuspocus · Post by **marcuspocus** » Tue Dec 07, 2004 6:55 pm

Virus? Worm?

are you protected?

andrew · Post by **andrew** » Tue Dec 07, 2004 7:09 pm

sure i am. I've got sygate firewall on and avg virus scanner fully up to date

marcuspocus · Post by **marcuspocus** » Tue Dec 07, 2004 7:12 pm

Well, i don't think scope access the net, normally.

andrew · Post by **andrew** » Wed Dec 08, 2004 4:31 am

hmmmm... I'll do a full virus scan when i get home

Counterparts · Post by **Counterparts** » Wed Dec 08, 2004 4:45 am

andrew wrote:
I've got sygate firewall

Is that the free version? I can't vouch for the commercial one, but my opinion of the Sygate one after trying it out was that it was somewhat flaky.

I now use a "proper" SPI/NAT Open Source (GPL) combination running on my router (a lot of routers use GPL licenced software ... sometimes without declaring the licence!)

I'm fortunate in that our company uses Sophos AV software, which allows all its employees to install a "home" version. Sophos is IMO te best AV out there, but unfortunately, it's only licenced out to businesses, not to home users.

Unless the Sygate FW is confused, it does sound likely that your SFP.exe has been infected. If your AV software doesn't detect anything and you want to be absolutely sure, feel free to zip it up and send it to me and I'll check it with Sophos.

Royston

astroman · Post by **astroman** » Wed Dec 08, 2004 5:01 am

that reminds me: the SFP.exe isn't necessarily the Scope one - it was mentioned here (quite) some time ago in context with network activity.

cheers, Tom

andrew · Post by **andrew** » Wed Dec 08, 2004 6:48 am

thanks royston, and astroman

I'll do the scan when i get home - will also check which .exe my desktop shortcut to scope 4.0 is pointing to.

Andrew

Rob van Berkel · Post by **Rob van Berkel** » Wed Dec 08, 2004 9:47 am

SFP.EXE might be the System File Protection utility. Can't see why it would try to connect to what I believe is a multicast address.

andrew · Post by **andrew** » Wed Dec 08, 2004 2:47 pm

okay -

just checked - it was indeed c:sfp\app\bin\sfp.exe that sygate reported trying to access the internet.

Whether this is sygate getting confused or not I'm not sure. I've done a virus scan with avg virus scanner (free edition) with the latest updates, and found no viri

I'll zip it and send it to Counterparts in Bath for detailed analysis.

Thanks guys!

Andrew

<font size=-1>[ This Message was edited by: andrew on 2004-12-08 14:48 ]</font>

Rob van Berkel · Post by **Rob van Berkel** » Wed Dec 08, 2004 4:47 pm

On 2004-12-08 14:47, andrew wrote:
, and found no viri

I'll zip it and send it to Counterparts in Bath

Andrew

Will Counterparts drown the executable in his Bath?

Cheers,
Rob

camed · Post by **camed** » Wed Dec 08, 2004 7:00 pm

Hi Andrew,
I'm a user of Sygate Pro, and I can confirm that sometimes it gets confused and doesn't report the correct program name.
It doesn't happen a lot (once a week for me maybe?), but when it does the problem seems to disappear after a reboot.
It's quite annoying, but usually I'm reassured by the fact that the program is trying to access a site that I know about. For example most of the times some random program is reported as attempting to contact the McAfee site, and I know it's actually just the mcafee daemon trying to check for an update..
Voila!
Camed

andrew · Post by **andrew** » Thu Dec 09, 2004 4:32 am

hmmmmm... thankyou camed!

I guess if the pro version does that then the 'amateur' version must do too!!!

nice one guys!! big up planet z!

Andrew

Counterparts · Post by **Counterparts** » Thu Dec 09, 2004 4:54 am

If you would like to send me the file, zip it up and post to:

rday at mpc hyphen data dot co dot uk

Royston

andrew · Post by **andrew** » Thu Dec 09, 2004 5:02 am

I did last night mate.

I got your email from the little icon under your post

Andrew

Counterparts · Post by **Counterparts** » Thu Dec 09, 2004 5:44 am

Oddness, I didn't see it, but it could be that my rather harsh Spam Assassin settings clobbered it! Quite likely...

Was the attachment zipped up by the way? I know that .exe attachments will get blocked before they reach me.

If you put "SFP" in the subject line, and try again, I'll filter it into a folder where I'll spot it

Royston

andrew · Post by **andrew** » Thu Dec 09, 2004 8:26 am

okay - i try again later

smiley!

Stubbe · Post by **Stubbe** » Fri Dec 10, 2004 3:10 pm

Had the same issue some time ago, go here to see the responses I got back then, he says shamelessly adverting his own threads

.

Issue persisted but was not a showstopper, and just as I changed from Symantec to Norman, I got a hunch that SFP tried to reach an internal port in my own PC. Norman does not seem to be responsing to this phenomenon, but that might as well be some configuration issue ?

Anyone ?
Stubbe

Post by **garyb** » Fri Dec 10, 2004 4:05 pm

just keep your computer off the net when making music and you can turn the firewall off................

Post by **hubird** » Fri Dec 10, 2004 10:42 pm

enjoying MSN or surfing the net while Cubase/Scope is playing my song, without any firewall or virus scanner active or even installed...

What a fun