Dod wrote: > You said "disabled", one thing I learned by experience about FWs and > AVs is that they are never 100% "disabled", you MUST uninstall them to > be sure they are not causing the problem because disabling keep low > level drivers loaded.
That's my experience as well and the only reliable method. If they used user mode hooking one could also check the list of libraries loaded either in debugger event log or by Sysinternal's Process Explorer. In the sample below there is a suspicious SSSensor.dll which is injected into each process by an old version of Sygate Personal Firewall. Those injected DLLs may hook the API calls they are interested in. They could be injected by many different applications including a virus or other stuff. If they are buggy it looks like a bug in your application :( Btw: The error might not happen with blocking winsock API since most internet applications use blocking winsock so they are more carefully tested. -- Arno Garrels Module Load: Project1.exe. Has Debug Info. Base Address: $00400000. Process Project1.exe (640) Module Load: ntdll.dll. No Debug Info. Base Address: $7C910000. Process Project1.exe (640) Module Load: KERNEL32.dll. No Debug Info. Base Address: $7C800000. Process Project1.exe (640) Module Load: OLEAUT32.dll. No Debug Info. Base Address: $770F0000. Process Project1.exe (640) Module Load: ADVAPI32.dll. No Debug Info. Base Address: $77DA0000. Process Project1.exe (640) Module Load: RPCRT4.dll. No Debug Info. Base Address: $77E50000. Process Project1.exe (640) Module Load: Secur32.dll. No Debug Info. Base Address: $77FC0000. Process Project1.exe (640) Module Load: GDI32.dll. No Debug Info. Base Address: $77EF0000. Process Project1.exe (640) Module Load: USER32.dll. No Debug Info. Base Address: $7E360000. Process Project1.exe (640) Module Load: msvcrt.dll. No Debug Info. Base Address: $77BE0000. Process Project1.exe (640) Module Load: ole32.dll. No Debug Info. Base Address: $774B0000. Process Project1.exe (640) Module Load: VERSION.dll. No Debug Info. Base Address: $77BD0000. Process Project1.exe (640) Module Load: COMCTL32.dll. No Debug Info. Base Address: $773A0000. Process Project1.exe (640) Module Load: SHLWAPI.dll. No Debug Info. Base Address: $77F40000. Process Project1.exe (640) Module Load: SHELL32.dll. No Debug Info. Base Address: $7E670000. Process Project1.exe (640) Module Load: ShimEng.dll. No Debug Info. Base Address: $5CF00000. Process Project1.exe (640) Module Load: IMM32.dll. No Debug Info. Base Address: $76330000. Process Project1.exe (640) Module Load: LPK.dll. No Debug Info. Base Address: $62E10000. Process Project1.exe (640) Module Load: USP10.dll. No Debug Info. Base Address: $75790000. Process Project1.exe (640) Module Unload: ShimEng.dll. Process Project1.exe (640) Module Load: UxTheme.dll. No Debug Info. Base Address: $5B0F0000. Process Project1.exe (640) Module Load: MSCTF.dll. No Debug Info. Base Address: $746A0000. Process Project1.exe (640) Module Load: appHelp.dll. No Debug Info. Base Address: $77B10000. Process Project1.exe (640) Module Load: msctfime.ime. No Debug Info. Base Address: $75250000. Process Project1.exe (640) Module Load: SSSensor.dll. No Debug Info. Base Address: $061F0000. Process Project1.exe (640) -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
