Cable modem constantly reset when Acronis is open.
George, the VM router log doesn't show any errors that are related to the UDP outbound ports 1900 & 5553 that need to be blocked to stop this issue with causing the cable modem to reboot itself.
My VM Super Hub has the same firmware (V2.39.02) and no longer reboots because I have configured my Comodo Firewall to block the above ports for the various ATIH programs, but mainly for TrueImage.exe and SystemReport.exe. I connect by both ethernet and wireless.
Bobbo,
I am US based. The problem was with my Comcast Cable modem. I am still experiencing Cloud backup failures. A supervisor tech is supposed to be getting back to me this evening on that one.
OK - good to know it's not just non-US issues. I didn't go back and look a the previous page againi - what AV are you using? The KB article creates the FW for Windows firewall, but if using third party, you have to enter them into those applications instead (until an update is released).
In Steve's case, when he resolved it, he also had to make sure the blocks were above the allows as well.
Chaps,
Regarding my last post about my router; I know that by using the BAT file to block specific ports the bug can be circumvented and that's what I am doing. However, I thought it would be useful to see if I could find out why my cable modem/router reboots itself every time ATI 2017 is started when the specified ports are not blocked as a possible aid to problem diagnosis.
If I reboot the modem (via a browser using the reboot option) without ATI running or being started it logs an error associated with port 80. Thus this can be ignored.
If I run ATI - which results in an unwanted reboot - I get the additional error logged:
Sat 10 Sep 10:47 194.168.4.100 Target port no = 59548 1 TCP- or UDP-based Port Scan
I know that Steve said that it cannot be related because it is the UDP outbound ports 1900 & 5553 that need to be blocked, but I'm only reporting what is logged by the router and it is clearly related because it happens every time - and only then. It would be interesting to see if users with different modems/routers see similar things in their cable modem's firewall logs.
George, just to clarify, it is the remote UDP ports 1900 & 5553 which are blocked in my firewall rules.
From your Firewall log screen capture, the source IP address for the remote port 59548 is one of the Virgin Media DNS servers at 194.168.4.100 so this is not an outbound activity but an inbound port scan from the VM DNS Server.
VM uses two DNS servers at 194.168.4.100 and 194.168.8.100 - an outbound address from your local system would be coming from a 192.168.0.? ip address such as 192.168.0.3 as shown in your screen shot. You can see the same events being logged in my own Super Hub Firewall log attached below.
My Virgin SuperHub is the oldest type, there are later Superhubs types 2, 2ac and 3.0.
The hubs can be operated in Router mode (the default) which allows several cable devices to be connected and also allows it to be used for WiFi.
Alternatively if can be used in Modem mode which allows only one cable device to be connected and no WiFi capability. The one cable device can be a computer or a router.
When I changed to Modem mode with only my desktop computer connected the problem with the cable modem/router rebooting does not occur. When I reverted to Router mode the problem came back.
I plan to ask Virgin for a later model Cable Modem/Router.
Bobbo,
I'm using windows defender.
George, my Super Hub shows a hardware version of 2.0 and was replaced around 6 months or less ago due to a different fault. I haven't tried changing it to work only in Modem mode as I use the router / wireless connectivity a lot, but I suspect that even the latest type 3.0 hub would probably have the same issue.
The good news from KB 58630 is that Acronis have openly acknowledged that this is a bug as per:
Cause
Issue in the product, occurring in specific (not all) environments.
More information
The issue is expected to be resolved in the next update for Acronis True Image 2017. Make sure to enable automatic check for updates at program startup so that you do not miss it when it becomes available:
Ditto to Steve.
I did find that the provided script did not add the firewall blocks for me (I use Windows defender too) - like it didn't have the necessary rights, it just flashed the black command prompt window for a brief moment and closed, but didn't add the firewall rules. You can check your Windows firewall logs to make sure the Block Acronis etnries were added after running the fix script. If not, just open an elevated command prompt (right click and "run as administrator" on command prompt) and copy paste the following and the refresh the outbound firewall rules page and check again.
netsh advfirewall firewall add rule name=BlockTrueImage dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\TrueImage.exe" protocol=udp remoteport=5353
netsh advfirewall firewall add rule name=BlockTrueImageMediaBuilder dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\MediaBuilder.exe" protocol=udp remoteport=5353
netsh advfirewall firewall add rule name=BlockTrueImagePrlStat dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\prl_stat.exe" protocol=udp remoteport=5353
netsh advfirewall firewall add rule name=BlockTrueImagePrlReport dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\prl_report.exe" protocol=udp remoteport=5353
netsh advfirewall firewall add rule name=BlockTrueImageTrueImageTools dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\TrueImageTools.exe" protocol=udp remoteport=5353
netsh advfirewall firewall add rule name=BlockTrueImagePlus dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\TrueImage.exe" protocol=udp remoteport=1900
netsh advfirewall firewall add rule name=BlockTrueImageMediaBuilderPlus dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\MediaBuilder.exe" protocol=udp remoteport=1900
netsh advfirewall firewall add rule name=BlockTrueImagePrlStatPlus dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\prl_stat.exe" protocol=udp remoteport=1900
netsh advfirewall firewall add rule name=BlockTrueImagePrlReportPlus dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\prl_report.exe" protocol=udp remoteport=1900
netsh advfirewall firewall add rule name=BlockTrueImageTrueImageToolsPlus dir=out action=block program="%PROGRAMFILES(x86)%\Acronis\TrueImageHome\TrueImageTools.exe" protocol=udp remoteport=1900
Screenshots attached
I was seriously considering upgrading to 2017 until I read about this problem. Maybe I'd better wait. But I think this particular problem has big implications that go beyond Acronis. TI 2017 is (apparently) sending a data stream that can take down cable modems - a local DoS attack! And what TI 2017 is doing accidentally, malware could do on purpose. Has there been a description of what is actually going on?
I recently decided to learn how to block network connections with my firewall - Kaspersky Internet Security 2016 - but have not looked into it yet. Maybe I'd better get on it.
Just an FYI,
Acronis Sr. Engineer did not return my call at the designated time on Friday and as a result, I have gone through another weekend with the product not working. Supposedly, I will hear from them tomorrow evening.
At this moment, cloud is a no go.
I've just discovered that there is a know issue where some cable modems reset when an external source attempts to connect to SNMP (UDP port 161) on the device - usually a router - beyond the modem. Is that what is going on here? Is something at remote ports 1900 or 5553 trying to access SNMP data? I don't know if that is considered a bug in the modem or sort of a brutal security feature.
I don't mean to hijack this thread. I'm just trying to determine if I'm vulnerable. There is an external test site that will try to establish and SNMP connection (and yes, I know UDP is actually connectionless). That test would reset any vulnerable modem if then Acronis problem is related to the SNMP issue.
Patrick, thank you for your interest in this thread. I have just tried running a port scan for port 161 against the external address of my cable modem, and got back the immediate response:
Scanning ports on 8X.X.XX.XX
8X.XX.XXX.XX isn't responding on port 161 (snmp).
This was done via website: http://www.t1shopper.com/tools/port-scan/
I did find a report about a Remote Reboot Attack at Charter Spectrum Ubee Modem Remote Reboot Attack where one model of cable modem was vulnerable to this type of attack but solved by replacing with a different model.
Note: a broader scan of a range of ports for my cable modem got the same response, which to me supports the premise that this issue is being caused by the way ATIH 2017 is presenting data on the cable modem internal ports (1900 & 5553) when searching for NAS devices, which should normally only be found on the local network.
[quote=Steve Smith]
Patrick, thank you for your interest in this thread. I have just tried running a port scan for port 161 against the external address of my cable modem, and got back the immediate response:
Scanning ports on 8X.X.XX.XX
8X.XX.XXX.XX isn't responding on port 161 (snmp).
This was done via website: http://www.t1shopper.com/tools/port-scan/
[quote=Steve Smith]
I also found that and ran the test. But now I know it proved nothing (except that my router is not responding to external SNMP requests).
I did find a report about a Remote Reboot Attack at Charter Spectrum Ubee Modem Remote Reboot Attack where one model of cable modem was vulnerable to this type of attack but solved by replacing with a different model.
I saw that, too. But it is a pretty specific vulernability. It allows an external user to log into the modem as an admin. That certainly can't be whatever is going on in this Acronis / modem problem.
Note: a broader scan of a range of ports for my cable modem got the same response, which to me supports the premise that this issue is being caused by the way ATIH 2017 is presenting data on the cable modem internal ports (1900 & 5553) when searching for NAS devices, which should normally only be found on the local network.
It could equally be the way the remote site is responding, but you are probably right about it being the outbound stream. UDP port 1900 is normally for UPnP (which was never intended for use outside of the LAN). I normally have UPnP blocked by my router. I have no idea what port 5553 is for. It is used for "SGI Eventmond", whatever that is. (SGI event monitor daemon, perhaps? That still tells me nothing.)
In any case, it worries me greatly that a cable modem would be sensitive that way to a data stream. I've posted a question on the Kaspersky forum asking if this is a well know problem? It feels to me like it could be exploited by malware.
I'm almost tempted to get TI 2017 just so I can help collect data on this. Almost, but not quite.
Patrick, I agree that it is worrying that some cable modems can be reset by simply starting an unrelated application - I didn't pick up on ATIH 2017 being the cause straight away and had the cable modem replaced followed by stripping down my home network and removing any components that I could live without before I discovered that just starting ATIH was the cause!
If you want to test this out then you could always download a 30-day Trial copy of 2017 without committing to going with this permanently.
When I encountered this problem I was using a Virgin Media SuperHub, the original one, a VMDG-480 made by Netgear. Since then they (Virgin Media UK) have had a SuperHub V2, SuperHub V2ac and most recently a Hub V3.0.
I told Virgin Media about the problem and they shipped me the latest Hub V3.0. This hub, made by Arris does not exhibit the problem. It is a VMDG505/TG2492LG-VM.
Hope this helps someone.
George, thanks for that update, my VM Super Hub is a V2 one but I may keep it in the hope that Acronis will produce a fix for this issue soon so that I can test that it works. Dialling 150 and playing pick a number with the VM voice response system is a sure way to spend a long time listening to mind numbing musaz before you eventually get to speak to a real person!
Steve,
Just to close out my last comment on this thread, I chose to request the refund on 2017 the other day, and I have completely removed the program from all computers, as well as having also cleared out my cloud storage.
The engineers failed to return calls at designated dates/times and I was constantly asked for second chances. I know that you made a recommendation somewhere in another string as far as who to contact and I believe that I will do so. It is, however, telling that no one from the company, i.e. a paid representative at a higher level than the support engineers, has attempted to reach out in any way to mitigate or apologize for the double problems that I had experienced, both with the modem and then the failed cloud backups.