Overlapped I/O operation [HTTP POST requests]

If I open the Spamcop reporting page and parse a spam message, then browse other stuff for a while and then submit on the Spamcop page, I get this consistently:

Winsock: (997) Overlapped I/O operation is in progress.
POST http://www.spamcop.net/sc
Winsock: (997) Overlapped I/O operation is in progress.

Is the problem reproducible? Do you have exact steps how we could simulate it here in our lab?
Thanks Vlk

I got this error a (very) few times as well (during ordinary browsing, e.g. this forum), but certainly nothing reproducible.

I cannot yet consistently reproduce the problem, but every time, it has been on the Spamcop page given after parsing a message but before sending the abuse e-mails. I do some browsing on other pages while it is parsing and eventually go back to it. When I submit, I get the winsock-related message from avast! websheild.

Browser: Mozilla Firefox 1.0 (default HTTP options, that is pipelining is off and HTTP connections don’t exceed HTTP specification limits using HTTP 1.1)

Firewall: ZoneAlarm 5.5.062.011

Antivirus: avast! Home 4.6.603 (VPS: 0508)

If a winsock programmer reads this, could you give a description of what overlapped i/o is in that context so I can have a better chance of reproducing this.

THE Winsock programmer is currently on the mountains but I can say that the dumped info (Overlapped I/O operation is in progress) does not have much relevance anyway… In short, this is how it should be (this is an expacted status code).

Some more questions:

  1. does the error display immediately after you click a link, or it takes some time (or a long time) to appear?
  2. what do you mean “while it is parsing”, exactly? Is it usually “parsing” for a long time (shouldn’t it be instantly)?

Thanks
Vlk

The message parsing usually takes a while and the message from avast is usually shown pretty quickly after clicking the submit button on the page generated while parsing.

Hi.

Not sure if my problem is the same but I also get

HTTP 502 - Gateway timeout

Winsock: (997) Overlapped I/O operation is in progress.
POST http://192.168.2.1/login.htm
Winsock: (997) Overlapped I/O operation is in progress.

when I submit the password for my Microsoft MN-500 router’s web interface at 192.168.2.1. The error screen comes up immediately the moment I click the submit button.

I can tell the router received my password as even though I get the Avast error screen, I can now directly link/go into the routers menus/pages directly using the address bar in my browser. Normally, if I link directly without my password entered first at some point, it would have kicked me back to the initial password screen.

I can consistently produce the problem. Seems to be browser independent as it happens on both IE and Firefox. Terminating the Web Shield fixes the problem but pausing it does not. On WinXP SP2 all Windows Updates done & Avast 4.6.603 but I never tried the beta though.

At least going into my router isn’t something I would do everyday.

wishiknew, great we have at least one page that has this problem, reproducibly.
To start, how does the logon message look like? Is it a standard Windows dialog box, or are the username/password boxes part of a web page?
Thanks Vlk

Hi VLK, I could email you the html code of the front page if you like. But I can see at the html header section it also has some javascript in a seperate files as well as use cascading style sheets too.

It is a web page with a single text box for the password, 2 buttons and some text for info.

Yeah, but this page doesn’t cause the problem, right? It’s the one that should be displayed as soon as your press the button on that page, right? :slight_smile:

I also have the same error when trying to enter my cable modem configuration page (192.168.100.1)

Here’s a screenshot of it:

http://img64.exs.cx/img64/738/untitled1zk.jpg

PS: Congratulations on the fine work you’ve put into Avast, it’s really great for a free anti-virus :slight_smile:

Yea I can’t get to the ‘next’ page. I just sent a zip of the initial password page. I’ll try to send a zip of the ‘next’ page after work. Maybe The_Unknown could help as I’m 8 hours away from doing anything.

The_Unknown, is the problem reproducible? Is the message displayed immediately when you access the address, or after a while (after it was trying to load)? What type of cable modem do you have?

Thanks Vlk

I would do that but I can’t even get past the first page.

I’ve just tried accessing my router’s interface and everything’s working fine with it. The problem resides only in the cable modem page.

The message is displayed immediately after inserting the address.

My cable modem is a Joohong Superlink 2800 (link → http://www.joohong.co.kr/eng/products/cablemodem/2800.htm)

Thanks for the info. It would be helpful if you could turn on verbose WebShield logging. To do this, open the file \data\avast4.ini, and add the following line to the [WebScanner] section

EnableLogging=1

Next, restart the WebShield provider and retry accessing the modem web interface. After it fails, stop the WebShield provider again, and post the contents of the file \data\log\ashWebSv.log.

Thanks!
Vlk

Thanks for your attention Vlk

Here’s the content of the ashWebsv.log after following those steps:

22-02-2005 16:24:43,“http://fxfeeds.mozilla.org/rss20.xml","text/html; charset=iso-8859-1”,“GET”,302,0,344,678,491,457,678,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0
22-02-2005 16:24:44,“http://news.bbc.co.uk/rss/newsonline_world_edition/front_page/rss091.xml",“text/xml”,"GET”,200,0,10338,10690,758,726,10640,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0
22-02-2005 16:24:44,“http://192.168.100.1/",“text/html”,"GET”,502,0,1993,2130,431,0,0,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0
22-02-2005 16:24:44,“http://192.168.100.1/favicon.ico",“text/html”,"GET”,502,0,2004,2141,362,0,0,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0
22-02-2005 16:24:49,“http://212.58.226.30”,“text/xml”,“”,200,0,10338,32070,2274,2178,31920,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,1
22-02-2005 16:24:49,“http://sand.mozilla.org”,“text/html; charset=iso-8859-1”,“”,302,0,344,2034,1473,1371,2034,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,1

OK, and when you turn off the WebShield, you can access http://192.168.100.1/ without any problems, right? :o

Yeah, flawlessly :-\

Hi Vlk. Here is my set of logs. First 2 lines is the loading of the page and 5 seconds later is when I click the button for after entering the password.

2/22/2005 7:03:00 PM,“http://192.168.2.1/",“text/html”,"GET”,200,0,4620,4693,427,397,4693,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0
2/22/2005 7:03:00 PM,“http://192.168.2.1/favicon.ico",“text/html”,"GET”,404,0,54,105,358,328,105,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0
2/22/2005 7:03:05 PM,“http://192.168.2.1/login.htm",“text/html”,"POST”,502,40,2001,2138,576,0,0,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0
2/22/2005 7:03:05 PM,“http://192.168.2.1/favicon.ico",“text/html”,"GET”,404,0,54,105,358,328,105,\Device\HarddiskVolume1\Program Files\Mozilla Firefox\firefox.exe,0

I did a save link as for the 192.168.2.1 and 192.168.2.1/login.htm and I’m finding the 2 pages are the same. Guess the ‘server’ default for no page is to ‘serve’ the login.htm I guess.

Just sent the zip for the ‘next’ page that I can get to only by direct linking as the first page was not able to forward if webshield is on.

I see this behaviour as well if I try to access my router on 192.168.1.1 . I just followed the earlier instructions to get a log, and here it is if it’s of any help :-

23/02/2005 00:28:13,“http://192.168.1.1/",“text/html”,"GET”,200,0,1759,1840,437,407,1840,UNKNOWN PROCESS,0
23/02/2005 00:28:13,“http://192.168.1.1/favicon.ico",“text/html”,"GET”,404,0,54,105,368,338,105,UNKNOWN PROCESS,0
23/02/2005 00:28:14,“http://192.168.1.1/login.htm",“text/html”,"POST”,502,15,1991,2128,561,0,0,UNKNOWN PROCESS,0
23/02/2005 00:28:14,“http://192.168.1.1/favicon.ico",“text/html”,"GET”,404,0,54,105,368,338,105,UNKNOWN PROCESS,0

I’m using Mozilla Firefox btw, on Win2k. I’ve also seen the same thing happening on a friends computer with the new Avast, if they try to access their router page.

Martin Farmilo