Screensaver needs to broadcast packets?

Avast Free Antivirus / Premium Security
1

I came back to my computer after the avast screen saver had been running for a while and I was quite surprised to see that that sygate (firewall) had caught some packets that avastss.scr (avast screensaver) was trying to send to 224.0.0.22 and I am quite curious as to why it would need to send anything. The only meaningful thing pulled out of the hex was SUBSCRIBE /Lay so I don’t know if it is an anti-crack thing or something checking to verify it’s register or something. Anyways I’m going to block it until I know more information, if any of you know anything about this, as I couldn’t google any good info. Thanks in advanced to anybody who knows what this’s for.

Adam

2

So none of the devs know why it needs to broadcast?

3

I don’t think the screensaver needs, or even should, send anything out.
Are you sure it’s really the screensaver process? (could it be e.g. some hook loaded into the process?)

4

Hmm not sure, in retrospect I probably should have saved my firewall log for future reference :/. I’ve only seen it once and when it did come up I just looked at the IP and process broadcasting. Next time it comes up I’ll post an update, I just initially thought it was some sort of update thing or something maybe, or like I said before checking to make sure it was registered or something.

5

While updating yes, avast! will connect (even to check against piracy)
But the screensaver module? In fact, I have never seen this in my firewall.

Which is your screensaver (set into avast screensaver module)?
Some screensavers send packets…

6

224.0.0.22 is not a broadcast address, it is a multicast address. It is an address used by IGMP, or Internet Group Management Protocol. Some process on your machine is trying to join a multicast group and is sending an IGMP report to the address to which all IGMP-capable routers must listen.

I have no idea why Avast screensaver would be participating in IGMP. It’s most likely something else.

John

7

I have just the defualt xp pic slideshow as my screensaver combined with the avast screensaver. Yeah I guess I should have realized that it was a multicast address, perhaps I should pay more attention in my networking class :confused: lol. Still kinda wondering why it was sending it though, but like I said it only happened once and I was just kinda taken back by it and posted here… without saving the log :(… so maybe I mis-read it or something.