1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Vista TCP/IP AutoPatch doesn't work anymore

Discussion in 'General Internet' started by broni, 2008/07/12.

  1. 2008/07/12
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Vista SP1 here.
    As you know, Windows limit half-open connection to 10, which slows down any P2P program.

    When the limit is hit, You will recieve a Notice in Event Viewer Saying:
    EventID 4226: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
    This means Vista Has maxed out our connect attempts.

    There are patches for XP, and Vista, which actually work around that limit.
    Vista patch: http://www.softpedia.com/get/Tweak/Network-Tweak/TCP-IP-Limit-AutoPatch.shtml is a simple script:
    Code:
    @echo off
    TITLE Windows Vista Event ID 4226 AutoPatch and UAC Disabler
    echo.
    echo Windows Vista Concurrent TCP/IP Connection Attempt Limit Auto Patcher
    echo Event ID 4226 Fix for 32-bit version of Windows Vista 
    echo and UAC Auto Disabler
    echo.
    echo.
    echo Made by defcon http://securevista.net
    echo.
    echo.
    echo Do you Want to Disable UAC?
    echo.
    echo Press Y to continue or Press Ctrl-C and answer Y to terminate
    pause
    echo Disabling UAC....
    reg import uac_admin_off.reg
    echo UAC Disabled.
    echo Install TCP patch? Press Y to continue or Press Ctrl-C and answer Y to terminate
    pause
    takeown /f %Systemroot%\System32\drivers\
    takeown /f %Systemroot%\System32\drivers\tcpip.sys
    icacls %Systemroot%\System32\drivers\tcpip.sys /grant  "%username% ":f
    echo y | cacls %Systemroot%\System32\drivers\tcpip.sys /g  "%username% ":f
    netsh int tcp set global autotuninglevel=disable
    copy %Systemroot%\system32\drivers\tcpip.sys %Systemroot%\system32\drivers\tcpip.original 
    echo.
    echo Original tcpip.sys driver has been renamed to  "tcpip.original" in its original folder.
    echo.
    copy tcpip32.sys %Systemroot%\system32\drivers\tcpip.sys /y
    reg import Vista_TCPIP_Limit_70000.reg
    echo.
    echo *** TCP/IP Connections are now at 70000
    echo.
    echo.
    echo.
    echo *** Save all work, will ask if you want to reboot to finish installation.
    echo.
    echo Reboot? Press Y to continue or Press Ctrl-C and answer Y to terminate
    pause
    shutdown /r
    which basically replaces existing tcpip.sys file with a new one, where default limit (which can be changed) is set to 70000.

    The above patch worked perfectly fine for me for several months, and I didn't have any EventID 4226 errors.
    However, after last Tuesday updates EventID errors came back.
    Surely, some update did something to tcpip.sys file, setting the limit back.

    I thought, that simply re-applying the patch will fix things back to normal, but, no.
    When I apply the patch, it needs to restart Windows, but after restart, Windows reports unspecified error, and runs System Restore.
    After repair, Windows starts perfectly fine, but obviously patch is gone, since I can see EventID 4226 error back.

    Any thoughts?
     
  2. 2008/07/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116

  3. to hide this advert.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.