A few days ago i started getting this error in my event log and i have noticed very slow loading pages and hangs also at the time of the events.
Tcpip event id 4226-TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

I have search everywhere and found that it may be something to do with service pack 2, but i've had sp2 since i bought the comp in january. They also say to download a windows update to fix it, which i did, but that did nothing. Then the msn forums say that it may be a worm and you should check to see what program is doing it.
Well, i have firewalls, adaware, antivirus and have done all the scans possible and i found only the coulomb dialer, after scanning really deep. I deleted that. But the error still exists. The only other thing that occurred was that i got a message saying i was low on memeory or something to that sort, and that windows would increase the paging file . I am far from low on memory.
If anyone has any ideas or can enlighten me, i'd really appreciate it.

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

Changes to the Windows TCP/IP stack in XP sp2 include a limited number of simultaneous incomplete outbound TCP connection attempts. So your suspicion that this has "something" to do with SP2 is probably correct.

Are you running any peer-to-peer file sharing programs?

There is a limit on outbound connections with XP. It was introduced the lessen the effect of Trojans initiating DOS attacks from a hi-jacked computer.

So unless you are running a PtP application and don't have multiple applications trying to access the Internet at the same time, I would say you do have a Trojan.

You paging files probably has little do with it except that whatever is initiating connections is also taking up memory.

Have a look in your process list and see what is running there. Should give you a clue.

Stuart

I have no p2p programs running and there is nothing unusual in my processes. I ran my antivirus program and also did trendmicros online scan, both came up clean.
Any other suggestions?

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

Thanks for the additional info, sherryt. A couple of things:

1. You said you have "firewalls". Are you running multiple software firewalls concurrently? If so, which ones? If you disable one or more of them do you continue to get the same error message?

2. Do netstat -an at the command prompt. does it show a lot (more than a screenful) of ESATBLISHED, CLOSE_WAIT, or TIME_WAIT connections?

3. This may be overkill, but try running Rootkit revealer. See if it shows any running processes that the task manager doesn't. A hidden daemon process could be responsible for the apparent, and thus far inexplicable, high number of half-open connections to your system.

i ran netstat and found lots of time_wait.
i also ran rootkit revealer and the only thing it showed was a discrepancy- D: 0 bites. meaning what?

We have 3 computers on this router and mine is the only one showing the tcpip errors, i'm also losing my logins, when i go back i have to keep logging into sites and my home page. Also when i close internet explorer i get a memory cannot be read error. These are all strange. And i have no idea where else to look for anything odd.

I'm running the xp firewall and avast antivirus.

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

Can you paste some examples of the netstat TIME_WAIT entries? Each one of these represents a connection. If there are an excessive number of connections, we should find out what they are.

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Compaq_Owner>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 192.168.1.100:1228 ESTABLISHED
TCP 127.0.0.1:1025 192.168.1.100:1237 ESTABLISHED
TCP 127.0.0.1:1025 192.168.1.100:1437 ESTABLISHED
TCP 127.0.0.1:1025 192.168.1.100:1450 ESTABLISHED
TCP 127.0.0.1:1721 127.0.0.1:12080 TIME_WAIT
TCP 127.0.0.1:1753 127.0.0.1:12080 TIME_WAIT
TCP 127.0.0.1:5180 0.0.0.0:0 LISTENING
TCP 127.0.0.1:5180 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12080 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12080 127.0.0.1:1696 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1706 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1712 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1714 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1720 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1726 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1733 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1755 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1765 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1767 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:1777 TIME_WAIT
TCP 127.0.0.1:12110 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12119 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12143 0.0.0.0:0 LISTENING
TCP 192.168.1.100:139 0.0.0.0:0 LISTENING
TCP 192.168.1.100:1228 64.12.28.104:21 ESTABLISHED
TCP 192.168.1.100:1230 64.12.28.104:21 ESTABLISHED
TCP 192.168.1.100:1237 205.188.210.132:21 ESTABLISHED
TCP 192.168.1.100:1241 205.188.210.132:21 ESTABLISHED
TCP 192.168.1.100:1437 64.12.28.72:21 ESTABLISHED
TCP 192.168.1.100:1439 64.12.28.72:21 ESTABLISHED
TCP 192.168.1.100:1450 205.188.248.115:21 ESTABLISHED
TCP 192.168.1.100:1453 205.188.248.115:21 ESTABLISHED
TCP 192.168.1.100:1539 69.89.74.186:80 TIME_WAIT
TCP 192.168.1.100:1558 69.89.74.107:80 TIME_WAIT
TCP 192.168.1.100:1658 209.189.225.130:80 TIME_WAIT
TCP 192.168.1.100:1700 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1701 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1704 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1717 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1725 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1731 66.179.48.111:80 TIME_WAIT
TCP 192.168.1.100:1738 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1742 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1759 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1760 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1774 216.34.207.71:80 TIME_WAIT
TCP 192.168.1.100:1780 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1782 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1786 209.18.34.39:80 TIME_WAIT
TCP 192.168.1.100:1788 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1790 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1794 64.233.167.104:80 TIME_WAIT
TCP 192.168.1.100:1796 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1798 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:1803 64.12.174.185:80 ESTABLISHED
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1032 *:*
UDP 0.0.0.0:1066 *:*
UDP 0.0.0.0:1099 *:*
UDP 0.0.0.0:1110 *:*
UDP 0.0.0.0:1623 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1047 *:*
UDP 127.0.0.1:1231 *:*
UDP 127.0.0.1:1440 *:*
UDP 127.0.0.1:1900 *:*
UDP 192.168.1.100:123 *:*
UDP 192.168.1.100:137 *:*
UDP 192.168.1.100:138 *:*
UDP 192.168.1.100:1900 *:*

C:\Documents and Settings\Compaq_Owner>

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

You have a number of questionable items there. Specifically, the "LISTENING" items other than the first two. Those are normal.

Run tcpview and see what processes are listening on those ports.

i didnt have time last night so today i ran netstat-n again and tehn ran tcpview. I didnt see anything out of the ordinary. Maybe you can take a look.?

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Compaq_Owner>netstat -an

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1025 192.168.1.100:1237 ESTABLISHED
TCP 127.0.0.1:1025 192.168.1.100:1450 ESTABLISHED
TCP 127.0.0.1:1025 192.168.1.100:2660 ESTABLISHED
TCP 127.0.0.1:1025 192.168.1.100:2664 ESTABLISHED
TCP 127.0.0.1:2934 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:2942 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:2944 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:2952 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:2966 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:2974 127.0.0.1:12080 TIME_WAIT
TCP 127.0.0.1:2994 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:3003 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:3005 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:3009 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:3011 127.0.0.1:12080 ESTABLISHED
TCP 127.0.0.1:3015 127.0.0.1:12080 TIME_WAIT
TCP 127.0.0.1:3918 127.0.0.1:12080 CLOSE_WAIT
TCP 127.0.0.1:5180 0.0.0.0:0 LISTENING
TCP 127.0.0.1:5180 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12080 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12080 127.0.0.1:2904 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2918 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2920 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2926 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2934 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:2942 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:2944 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:2952 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:2954 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2956 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2966 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:2968 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2970 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2984 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2988 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:2994 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:2998 TIME_WAIT
TCP 127.0.0.1:12080 127.0.0.1:3003 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:3005 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:3009 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:3011 ESTABLISHED
TCP 127.0.0.1:12080 127.0.0.1:3013 TIME_WAIT
TCP 127.0.0.1:12110 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12119 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12143 0.0.0.0:0 LISTENING
TCP 192.168.1.100:139 0.0.0.0:0 LISTENING
TCP 192.168.1.100:1237 205.188.210.132:21 ESTABLISHED
TCP 192.168.1.100:1241 205.188.210.132:21 ESTABLISHED
TCP 192.168.1.100:1450 205.188.248.115:21 ESTABLISHED
TCP 192.168.1.100:1453 205.188.248.115:21 ESTABLISHED
TCP 192.168.1.100:2660 64.12.26.84:21 ESTABLISHED
TCP 192.168.1.100:2662 64.12.26.84:21 ESTABLISHED
TCP 192.168.1.100:2664 64.12.28.64:21 ESTABLISHED
TCP 192.168.1.100:2666 64.12.28.64:21 ESTABLISHED
TCP 192.168.1.100:2902 66.193.254.46:80 TIME_WAIT
TCP 192.168.1.100:2907 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2909 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2913 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2917 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2923 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2931 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2933 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2935 66.179.48.111:80 ESTABLISHED
TCP 192.168.1.100:2939 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2941 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2945 64.15.251.221:80 CLOSE_WAIT
TCP 192.168.1.100:2951 63.211.210.229:80 TIME_WAIT
TCP 192.168.1.100:2953 64.156.240.46:80 CLOSE_WAIT
TCP 192.168.1.100:2962 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2963 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2980 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2981 216.34.207.71:80 TIME_WAIT
TCP 192.168.1.100:2991 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:2995 209.18.34.41:80 ESTABLISHED
TCP 192.168.1.100:2997 69.93.141.100:80 TIME_WAIT
TCP 192.168.1.100:3002 208.184.39.144:80 CLOSE_WAIT
TCP 192.168.1.100:3004 208.184.39.144:80 CLOSE_WAIT
TCP 192.168.1.100:3006 209.18.34.39:80 ESTABLISHED
TCP 192.168.1.100:3010 69.90.227.105:80 ESTABLISHED
TCP 192.168.1.100:3012 209.18.34.39:80 ESTABLISHED
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1032 *:*
UDP 0.0.0.0:1066 *:*
UDP 0.0.0.0:1099 *:*
UDP 0.0.0.0:1110 *:*
UDP 0.0.0.0:1623 *:*
UDP 0.0.0.0:4906 *:*
UDP 0.0.0.0:4907 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1047 *:*
UDP 127.0.0.1:1231 *:*
UDP 127.0.0.1:1440 *:*
UDP 127.0.0.1:1900 *:*
UDP 192.168.1.100:123 *:*
UDP 192.168.1.100:137 *:*
UDP 192.168.1.100:138 *:*
UDP 192.168.1.100:1900 *:*
---------------
aim.exe:2280 TCP mynightmare:5180 mynightmare:0 LISTENING
aim.exe:2280 TCP mynightmare.agstme.adelphia.net:1237 oam-d17b.blue.aol.com:ftp ESTABLISHED
aim.exe:2280 TCP mynightmare.agstme.adelphia.net:2664 64.12.28.64:ftp ESTABLISHED
aim.exe:2280 UDP mynightmare:1231 *:*
aim.exe:3060 TCP mynightmare:5180 mynightmare:0 LISTENING
aim.exe:3060 TCP mynightmare.agstme.adelphia.net:1450 oam-d19c.blue.aol.com:ftp ESTABLISHED
aim.exe:3060 TCP mynightmare.agstme.adelphia.net:2660 64.12.26.84:ftp ESTABLISHED
aim.exe:3060 UDP mynightmare:1440 *:*
alg.exe:1436 TCP mynightmare:1025 mynightmare:0 LISTENING
alg.exe:1436 TCP mynightmare:1025 mynightmare.agstme.adelphia.net:1450 ESTABLISHED
alg.exe:1436 TCP mynightmare:1025 mynightmare.agstme.adelphia.net:1237 ESTABLISHED
alg.exe:1436 TCP mynightmare:1025 mynightmare.agstme.adelphia.net:2664 ESTABLISHED
alg.exe:1436 TCP mynightmare:1025 mynightmare.agstme.adelphia.net:2660 ESTABLISHED
alg.exe:1436 TCP mynightmare.agstme.adelphia.net:1241 oam-d17b.blue.aol.com:ftp ESTABLISHED
alg.exe:1436 TCP mynightmare.agstme.adelphia.net:1453 oam-d19c.blue.aol.com:ftp ESTABLISHED
alg.exe:1436 TCP mynightmare.agstme.adelphia.net:2662 64.12.26.84:ftp ESTABLISHED
alg.exe:1436 TCP mynightmare.agstme.adelphia.net:2666 64.12.28.64:ftp ESTABLISHED
ashMaiSv.exe:912 TCP mynightmare:12025 mynightmare:0 LISTENING
ashMaiSv.exe:912 TCP mynightmare:12110 mynightmare:0 LISTENING
ashMaiSv.exe:912 TCP mynightmare:12119 mynightmare:0 LISTENING
ashMaiSv.exe:912 TCP mynightmare:12143 mynightmare:0 LISTENING
ashWebSv.exe:1244 TCP mynightmare:12080 mynightmare:0 LISTENING
ashWebSv.exe:1244 TCP mynightmare:12080 localhost:2901 ESTABLISHED
ashWebSv.exe:1244 TCP mynightmare.agstme.adelphia.net:2902 66-193-254-46.gen.twtelecom.net:http ESTABLISHED
IEXPLORE.EXE:3124 TCP mynightmare:2901 localhost:12080 ESTABLISHED
IEXPLORE.EXE:3124 TCP mynightmare:3918 localhost:12080 CLOSE_WAIT
IEXPLORE.EXE:3124 UDP mynightmare:1047 *:*
svchost.exe:1052 UDP mynightmare:ntp *:*
svchost.exe:1052 UDP mynightmare.agstme.adelphia.net:ntp *:*
svchost.exe:1096 UDP mynightmare:1066 *:*
svchost.exe:1096 UDP mynightmare:4907 *:*
svchost.exe:1096 UDP mynightmare:1623 *:*
svchost.exe:1096 UDP mynightmare:1032 *:*
svchost.exe:1096 UDP mynightmare:1110 *:*
svchost.exe:1096 UDP mynightmare:1099 *:*
svchost.exe:1096 UDP mynightmare:4906 *:*
svchost.exe:1196 UDP mynightmare:1900 *:*
svchost.exe:1196 UDP mynightmare.agstme.adelphia.net:1900 *:*
svchost.exe:960 TCP mynightmare:epmap mynightmare:0 LISTENING
System:4 TCP mynightmare:microsoft-ds mynightmare:0 LISTENING
System:4 TCP mynightmare.agstme.adelphia.net:netbios-ssn mynightmare:0 LISTENING
System:4 UDP mynightmare:microsoft-ds *:*
System:4 UDP mynightmare.agstme.adelphia.net:netbios-dgm *:*
System:4 UDP mynightmare.agstme.adelphia.net:netbios-ns *:*

One other thing i just found was that my 1394 connection was on, for some unknown reason. Ive always had that disabled. Dont know if that may have caused some weird stuff or not?

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

I don't see anything too unusual either.

It does look like avast is making a large number of loopback connections. Try disabling avast (or at least, disable the web proxy) and see if that makes a difference.

well, i disabled the web proxy and things seem to be running alot smoother today. still getting the tcpip error, and an occassional w32time error. but much fewer hangs and not getting logged out. So far.
i ran tcpview again and the list was alot shorter and had less waits and listens.
I'll lrt it go a few days and see how things run.
Thanks you all for your help. this forum has always been a life saver or stress saver for me.
i'll let you know how things go.

sherry

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

well things are better but i'm still getting really bad hangs in internet explorer and also i have found that i cannot defrag my drive d, it says i only have 2% available space, last week it said 14%, and you have to have 15%?
Why is my hard drive so full and how do i clean it up?
Other than that all the other issues seemed to have straightened out. *crosses fingers*

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

Use spacemonger to get a bird's eye view of disk usage on D:\. That should help you identify anything obviously oversized or unexpected.

i ran the program on drive d and the page file is huge, im not sure what the other stuff is. can i shut off paging?

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

>>can i shut off paging?

I wouldn't recommend it

i reset the paging file size to a custom size. i set my system restore lower. i have removed all unwanted programs. but how do i gain space on my D drive? i'm still at 2%.

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN

Um....remove stuff you don't want? How big is your D: drive? What - according to spacemonger - is using up space?

my d drive is 5.25 gb and 5.13 is used. 124 mb free space. i know to delete stuff i dont want, but i cant access it. when i try to open it, alls i get is a warning. and a lock symbol.
pagefile=670 mb
all the other are called i386 apps and numbered, so i dont know what they are. but the pagefile is the largest.

XP Home sp2., Compaq Presario SR1330NX, 512mb ram, AMD Athlon, LAN