Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: dford3772 on April 05, 2007, 04:54:48 PM
-
I'm using WinXP, SVC Pl 2 and Comodo 2.0 Firewall. I have removed every scrap of Norton IS and Spycatcher Express. Avast does not show in my Security panel but I know it is working so I guess I don't mind about that.
As a new user I'm very confused about the mail wizard but I suppose with the latest version of Avast I don't need it. How to deal with mail problems then like the above error 10049. Everything else is working fine and it does scan outgoing mail so I'm happy with that.
Please advise what to do.
Donna in AR
-
You don't need the Mail Protection Wizard because you are using XP and the Internet Mail proxy is transparent. This isn't something to do with the latest avast version but which OS you are using.
What is the complete error text or post a screenshot of it ?
-
Besides WinXP and Comodo Firewall, I use Outlook Express mail and occasionally Yahoo mail but mostly OE. I am on Comcast cable and
I note that incoming is through mail.comcast.net (POP3) and outgoing is smtp.comcast.net I do have a password on file in OE to enter
the Comcast server. Could this be the problem? I haven't a clue to fix that unless I call Comcast---sigh..............
I can do a screenshot with WebCapture but the message only appears on boot and it really can't be manipulated long enough to get
that device into action. The total message is: Avast can't scan or protect incoming POP3 mail. 10049 Error
Thanks for your patience,
Donna in AR
-
The total message is: Avast can't scan or protect incoming POP3 mail. 10049 Error
Thanks for your patience,
I have seen this message in the forums before and it has usually been in relation to having another AV installed or remnants that are also checking the email. The fact that the outbound email is OK tends to support this a little as many AVs don't scan outbound email so that might not be effected. The fact you had Norton IS might even if you tried hard to remove it some remnants could still be there. Also the fact that it only appears at boot I would think is significant to the above.
A link worth looking at, which is a program removal tool that can remove the remnants of a number of different Norton Programs:
Removing your Norton program using SymNRT (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039)
Also check this topic http://forum.avast.com/index.php?topic=23916.msg196817#msg196817 (http://forum.avast.com/index.php?topic=23916.msg196817#msg196817) it could be similar, so check and ensure that 1) your email account settings are correct, 2) that Comodo allows access to ashMaiSv.exe (this however, should be OK otherwise you wouldn't be able to send either).
Is ashMaiSv.exe running in Windows Task Manager ?
-
I had not had to go into Comcast forums in a long time. The problem may be that their server scans the mail before it leaves with an
antivirus. The advice was to disable one's private AV because it is not needed. I can't buy that.
If this is the problem why didn't NIS have the same difficulty or did they just not scan incoming mail and didn't say so.
Donna
-
Sorry I forgot to thank you for the links you provided. Yes that is the message and if it is not a Comcast problem then most likely it is
a glitch between Avast and Comodo. At present, I just took all of the ash application settings out of Comodo apps and will allow one by
one to see if that will remove the error.
Donna
-
I don't buy the "you don't need to scan your email because we do" comment either. Also their email scanner is on their server and not your system (unless they also give you some security software to install), so it shouldn't be what is causing the problem.
I'm not sure that Comodo is the issue otherwise it would also have an impact on sending email and not just receiving it if ashMaiSv.exe was blocked.
1. check your account settings for pop3 server settings, etc.
2. checking comodo won't hurt, but not confident it will resolve this.
3. check through the complete topic in the forum link I gave as there are other reference links in it also.
4. if steps 1, 2 and 3 prove fruitless then check out the Norton Removal tool.
No problem, glad I could help, welcome to the forums.
-
Then most likely it is a glitch between Avast and Comodo.
Comodo works perfectly with avast!
Into the firewall settings, the following programs should be allowed to connect:
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner Service)
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (avast! Update executable). This is a temporary file that just appears when an update (check) is about to launch, and disappears again afterwards.
Don't need rights to connect:
C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service)
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)
-
All the Avast settings are in place to run on Comodo. I ran the Comodo exe. scan again to get all apps and re-booted. Thought I had fixed it but not so as the message appeared later and when I checked a test e-mail there is no incoming scan.
I did find some issues between Avast and Comodo but running the scan was supposed to resolve the "can't scan incoming mail"issue.
It has not worked for me. This error has also appeared in the Comodo forum.
Norton removal tool was used earlier plus I worked on all hidden files. I don't think there is a shred left!
It could be Comcast but all my mail settings look ok. The port numbers might be in question but when you look at their forums
it looks like different ports for different folks. Oh well! Don't know if it can be an SSL issue. I'm pretty much back to square One.
Donna
-
If it were an SSL issue, that wouldn't present itself at boot only when you tried to send or receive email.
Does Comodo have an email checking function (my Outpost Pro firewall does, which I have disabled) ?
If so disable it.
What POP3 and SMTP ports do you have to use and does comcast insist you use SSL ?
Though that shouldn't have a relationship with this error.
-
No e-mail checking on Comodo that I can find.
Default ports on OE are out=25 in=110. I think those are default.
I did go back in and on Comodo created the Avast apps as TRUSTED. Don't know if that will make a difference or not.
You know now that I think about it, I'm not sure that Norton did incoming scans but they too always did outgoing mail.
I guess the only way to find out what is causing this is to uninstall Comodo and turn on WinXP temporarily to see what happens.
I guess what I am experiencing now is why I've used Norton products for years--then they worked together--now NIS is so
huge and its tentacles are so large I've lost what I invested in NIS 2007 unless I go back to it and I can't face that even though
everything worked together. I dropped it because of corrupted files that caused a shutdown problem--two of those blasted
error messages. In the day before firewalls we never had so many glitches and generally whatever you loaded worked. Now it is
so hard to find apps that work together and or with your ISP as well.
-
I am a long time Comcast customer and user of avast. Your Comcast settings are just the same as mine and that is probably not the issue here. Can you receive your email successfully from Comcast?
Norton did (at lease when I used it) scan incoming mail - scanning outgoing mail is far less important to anyone - the point of almost being useless.
This error seems to suggest that avast cannot set the low level intercept it needs to intercept calls to port 110 because something else in your system is blocking it. As the other folks have said this is usually the remnants of another antivirus program but it could be something else.
Are you running any anti-spam filtering product for your email?
-
Just checking ...
Did you run the most up to date Norton Removal Tool (2007 version from the link posted by DavidR above)?
-
I'm sorry to be such a pest with this problem but it is driving me mad. After searching this forum and the Comodo forum, I still believe the
problem lies with Comodo blocking in some way but I'm just not sure.
On various forums I noted that people were getting Avast cannot protect news, cannot protect incoming mail etc. like it is some kind of bug
but no one had any solutions.
Donna
-
Yes when I had to update Norton out of the box I knew i was in trouble. i received about 12 pages of directions from tech support
and that included the latest removal tool which I did run before I loaded Avast or Comodo. I do know now that Norton will kill various commands on your PC as in the Security Center, thus mine does not show Comodo at all. Who knows what else is taken out. I uninstalled
on Control panel and then ran the removal tool and then took out the Symantec Shared folder manually as well as anything I could find
that had Norton or Sym in its makeup.
Donna
-
I'm sorry to be such a pest with this problem but it is driving me mad. After searching this forum and the Comodo forum, I still believe the
problem lies with Comodo blocking in some way but I'm just not sure.
Sorry to disappoint you but if comodo were blocking ashMaiSv.exe you wouldn't just be unable to receive email you wouldn't be able to send either. It can't be that selective unless you have somehow created a custom rule blocking ashMaiSv.exe inbound access, which I doubt.
On various forums I noted that people were getting Avast cannot protect news, cannot protect incoming mail etc. like it is some kind of bug
but no one had any solutions.
Donna
If you can give us any links as this isn't something that we are hearing of in these forums, all are basically related to remnants of or other installed AV or security applications.
The problem is usually related to registry remnants, virtual device driver, legacy keys.
Such as HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_xxxxxx where xxxxxx is the legacy key That could be Norton, Symantec or even NIS, I don't know what device drivers are installed of might be left behind.
-
David,
since avast cannot set the intercept at startup then ashmaiSv.exe will not be playing any part in receiving mail at the moment since it is the intercept that redirects the port 110 call to ashmaiSv.exe.
Donna,
can you confirm that you are, in fact, still receiving your email in OE?
If you are then it would be interesting to know just what the avast intercept blocker is doing when you are getting your mail.
Are you at all familiar with the diagnostic programs called Hijackthis or TCPView?
-
David,
since avast cannot set the intercept at startup then ashmaiSv.exe will not be playing any part in receiving mail at the moment since it is the intercept that redirects the port 110 call to ashmaiSv.exe.
That may well be the case but I can only assume that Donna can send email as she hasn't mentioned anything about not being able to nor has she corrected any of my assumptions that outbound email is working. So I have to assume that at least that part of the intercept is working. But, you know what they about assumption ;D
-
David,
very true indeed. I have never heard though of an avast message saying that it would not be able to intercept SMTP mail ... so this may be a generic message. Perhaps the avast team could enlighten us.
If Donna is familiar with Hijackthis or TCPView we may get some insight into what may be causing the block.
-
Yes both of those applications could reveal the activity, HJT possibly better to show registry entries that may not be running but being detected by avast.
@ Donna
Program & Tutorial - Also useful as a diagnostic tool - Download HiJackThis.zip (http://www.spywareinfo.com/~merijn/files/hijackthis.zip) HJT has now been sold to Trend Micro inc. but the 1.99.1 version should still be available here or at one of the download sites.
- HJT Information HiJackThis Tutorial 1 (http://www.bleepingcomputer.com/forums/tutorial42.html) or HiJackThis Tutorial 2 (http://www.tomcoyote.org/hjt/#introduction) or HiJackThis Tutorial 3 (http://hometown.aol.co.uk/jrmc137/hjttutorial/tutorial.htm)
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
-
If Comcast uses SSL, you need to use a solution like Stunnel for GMail.
Without it, it won't be possible because avast mail scanner doesn't support SSL (Secure Socket Layer) connections.
Take a look here: http://forum.avast.com/index.php?topic=10428.0 to see how to set up secure email with avast!.
Since SSL/TLS e-mail is encrypted and decrypted in the client, external virus scanners (including avast!) can't read or scan it. The solution is to pass e-mail in and out un-encrypted from your client (Outlook Express, Thunderbird, ...) to a proxy program (Stunnel) that does the actual ssl or tls encryption/decryption of the pop3/smtp e-mail and communicates directly with the ISP server on the appropriate ports. Download here: http://www.stunnel.org/download/binaries.html
If you were using MS Outlook it would be able to do that as there is a plug-in, which effectively has the avast email scanner inside Outlook.
-
The problem is usually related to registry remnants, virtual device driver, legacy keys.
Such as HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_xxxxxx where xxxxxx is the legacy key That could be Norton, Symantec or even NIS, I don't know what device drivers are installed of might be left behind.
David, I've used to say that but Igor teach you that legacy drivers on ControlSet00X only will be used if the user choose the 'Last known good configuration' and Windows will 'clean' the legacy drivers left behind from time to time. Of course, it would be better to not have these registry keys left behind but, like I think Igor said, they won't mess the avast installation and good working. The problem will be if the key is under CurrentControlSet keys.
-
I have researched until I'm frazzled; this problem goes back to 2004 on some forums including Avast!
Avast is scanning outgoing mail and has done so from the start; it has never scanned incoming. I disabled Outlook/Exchange when I
discovered that has nothing to do with OE which is what I use. OE does not show the Avast icon anywhere or any evidence of
scanning in Send/Receive. Perhaps it is in OE that the problem lies. I'm on Comcast and I can send and receive on OE just fine but somehow I have to
fix this error as I could be getting infected mail and not know it.
I'm pretty good on a PC but I let the registry alone because I do not feel competent in that area. I don't doubt that NIS could still be
somewhere. I've found folks on various lists that say they have fixed this problem but they never say how.
Donna
-
Thanks Tech, I didn't look to far in the registry to get an example path, just went to the first controlset.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_xxxxxx
-
<snip>
Avast is scanning outgoing mail and has done so from the start; it has never scanned incoming.
<snip>
OE does not show the Avast icon anywhere or any evidence of
scanning in Send/Receive.
Perhaps it is in OE that the problem lies. I'm on Comcast and I can send and receive on OE just fine but somehow I have to fix this error as I could be getting infected mail and not know it.
I'm pretty good on a PC but I let the registry alone because I do not feel competent in that area. I don't doubt that NIS could still be somewhere. I've found folks on various lists that say they have fixed this problem but they never say how.
Donna
1. since you are able to send and receive emails your settings I would say are correct.
2. since outbound email is scanned and point 1 above, your firewall doesn't appear to be blocking ashMaiSv.exe or OE.
3. I assume that you have checked the 'Scan inbound mail.' You know me and assumptions, so can you confirm ?
If that is ticked and I believe it is, we are back to this message on boot and that I feel has to be in the registry somewhere.
4. There really isn't much to worry about doing a search of the registry, it is just like navigating in windows explorer the layout is basically the same, so you click the little + to expand the 'registry folder' HKEY_LOCAL_MACHINE, then find the SYSTEM and expand using the + Now do the same with the CurrentControlSet, then the Enum and finally the Root.
Now you can scroll down and see if you can find any legacy Keys relating to Norton, Symantec, NIS, etc. don't do anything just tell us if you found anything and what you found and we can take the next step.
-
Wow! Have I found some horrors! Not only Symantec traces but Tenebril Spycatcher and Trend Micro Antispyware.
I've made screenshots with WebCapture of the offending areas which I will label origins. How do I insert into message to you?
Donna
-
If you have made images (crop the bits that are relevant to reduce size) and save them on your HDD. When you post (reply) you will notice Additional Options, click that and you will see Attach:, opposite that a Browse button, from that pop-up navigate to the location you saved the image and select it and click open. That will transfer the path into the attach window, when you post, the image will be uploaded and attached to the post.
-
I also found a bunch of Legacy files such as SYMEVENT, SYMFW, SYMIDS, SYMIDSCO, SYMLCBRD,SYMDIS
Under Local Machine Software I found NRT (tool) Tenebril Spycatcher and Trend Micro
-
I did a duplicate by mistake but here are two more that look pretty bad.
Donna
-
OK lets deal with the LEGACY_SYMxxxxx entries first, before doing anything, you need to be logged on as a user with administrator privileges, the next thing we are going to do is export a copy of each legacy key. We are going to back-up each key (export), change its permissions and then delete the key.
1. Right click on the first one, LEGACY_SYMDNS and select Export, choose a location (where you can find it again if required) to save it into and give it a meaningful name legacy_symdns is fine.
2. Right click it again and select Permissions, you will see the Security Tab with two Group or User Names, Everyone and System.
3. Highlight Everyone in the window below tick allow box opposite Full Control and click OK. This is needed so that you are able to delete this key later.
4. Right click it (LEGACY_SYMDNS and nothing else) again, select Delete, you will get the usual Confirmation window. This will give you a means to escape if you made any mistake, click Yes to proceed.
Now you need to do that for the remainder of the LEGACY_SYMxxxx keys.
Once you have done that reboot.
-
All done with your wonderfully clear directions. The files are in my documents in a Legacy folder.
After reboot, I did get a FF error saying it needed to close but that just happens sometimes. The
Avast can't scan or protect incoming e-mail did appear. I'm replying on IE this time.
Donna
-
I did get a FF error saying it needed to close but that just happens sometimes.
If you get any errors make a note of them, they may be of help. In that first ff needs to close pop-up there is something like a more information or details, click that and copy and paste that information.
Norton can get really embedded deep into your system and as You can see a real pig to get rid of.
OK now I would suggest doing the same with the Symantec and SymNRT folders/keys (export, permissions, delete and reboot) the sub keys will also be removed BDM, etc.
Watch out for any error messages re. avast, etc. and record, try opening firefox and see if the error is replicated.
Now I would do the same with the Tenebril folder.
Can you recall what the Trend Micro was in relation to did you have their AV installed at one point ro use their on-line scanner Housecall ?
-
Trend Micro was antispyware by itself; the folder (key?) appears to be empty.
I note that the Tenebril Spycatcher stuff has e-mail and phishing in the breakdown of it.
I'll get these done ASAP. Does the registry have to be defragged if a good bit is removed? If so how?
Donna
-
The permissions form is different as in the attached shots. It looks as if I have to go into ADVANCED and click on Donna as admin and
this key and all subkeys. I'm afraid to take a chance without asking about what to check and click since the full control is grayed
on the first form.
Donna
-
If yu are logged on as Administrators (Donana\Administrators) then you should be able to delete/have full control as can be seen in the first image that has a tick in the Full Control box. In this case (image 1) you shouldn't need the Advanced settings.
-
FF just had to close again when I started typing a new message. I may really have something wrong for I've never seen the fully updated copy that I run do this so often.
When I set up this computer I am the only user Owner_Administrator and I have not used the log in
message (I think I made it disappear) in ages. After some reading I don't see why I need it as the
START menu says I am logged on. However that Full Control Command is not checkable although
it does say Donna Administrator at the top.
It may be that Norton's tentacles have gone in too deep and I suppose I could cause this thing to
crash quite easily so if it's OK with you, I think I'll quit for the night other than just seeing if you reply
and put the heavy stuff off until tomorrow. Thanks for your patience and help. You are wonderful! Donna
-
All traces of Norton, Tenebril, and Trend Micro are removed except for two folders that looked empty.
FF had to close again while I was composing this post on it. Since most security programs do not fully
support it I can't see why my registry removals would affect it.
That's the good news. The Avast! mail warning is still present on bootup and is inthe Task Mgr. at the
same time. AshWebSv.exe asks to be allowed on Commodo to act as server at the same time.
I've checked the web for possible problems with FF 2.0.0.3. No record of excessive closings. Don't suppose I could have a virus or other invader. So far IE has not closed though it used to have that problem occasionally. I had no warnings while doing the registry removals.
Is it uninstall time for Avast! and re-install? Configuration check! What?
Donna
-
Firefox shouldn't have any issues with security applications as it is a fairly standards compliant browser. It may not be entirely Firefox's fault, it could be using another module and that is at fault. That is why I suggested clicking the more information, etc. to see more information about the reason.
I'm still using 2.0.0.2, will be updating later today, but it may be better to download the complete latest version of firefox and save it so you can find it later, uninstall the current installation and reboot, then install the latest version. Something else you could try is to run firefox from the Safe Mode link in, Start, All Programs, Mozilla Firefox. This starts firefox without extensions, if you have no problems then it might just be a troublesome extension and that may be pointed out in the 'more information' I spoke about.
I'm probably more baffled than you as to why this can't protect email is displayed on boot, I have exhausted the major reasons this may occur.
I believe you said you have tried the avast reinstall before, what I would suggest is you download the avast! Uninstall Utility, find it here (http://www.avast.com/eng/avast-uninstall-utility.html) and save it to your HDD so you can find it later. Now uninstall using add remove programs, reboot, run the uninstall utility, reboot and install.
-
David,
Thanks so much for all your help and I will try the re-install.
If I were you I'd stay right where you are on FF. After more research, 2.0.0.3 is crashing frequently and in truth no one knows why.
On my U3 flash drive I have 1.0.5.11. I just got through surfing on it for an hour or so--NO PROBLEMS at all. The info I found says
it is in the version (shades of IE!). Thankfully all I had to do was upload my bookmarks and my portable surfs beautifully until they
find a fix.
I really like Avast and want to stay with it so I will go through the rigamarole involved. If it still won't protect the mail then I'll have to
find another program I guess.
Donna
-
Well I have just updated to firefox 2.0.0.3 so we will see ;D
That is why it is important to gather as much information when it does crash or have to be closed.
I use MailWasher Pro, primarily for anti-spam and I run mailwasher first, it checks a small part of the email X number of lines (user configurable) and it views that in text mode to make a decision on spam and doesn't download the attachments. It has a knock on benefit that you can also see the suspicious emails and flag them for deletion, when you click Process Mail, it deletes all those flagged for deletion at 'the email server' (you don't have to even download them) and then calls your email program where you download the remainder of the emails.
There is a free version of mailwasher but that only covers one email account (address) were the pro version covers unlimited email accounts.
-
If it still won't protect the mail then I'll have to find another program I guess.
Donna, maybe you can add the following line to the [MailScanner] section of <avast>\data\avast4.ini:
Log=20
Then generate some traffic, simulate the problem (i.e. force the avast mail scanner to time out by sending an email with attachment) and then post here the contents of the file <avast>\data\log\aswMaiSv.log
Details: http://forum.avast.com/index.php?topic=12234.msg103474#msg103474
-
David,
I'm afraid to brag but I got my first incoming PROTECTED mail just now! WaaHOOO! I feel like I've been through a war zone but I learned so much along the way. You have helped me through the registry's uncharted waters and I'm cautious but not afraid anymore.
Not sure what may have done the trick. Maybe it was a glitch in the install but Norton is gone and that
is a good feeling. I really like the Avast program and am so glad to have it working correctly.
Thanks again for all your help,
Donna in AR
If my system errs again then I've got Tech's new post for another road to travel. Thanks!
-
If my system errs again then I've got Tech's new post for another road to travel. Thanks!
Ok, Donna.
Welcome to avast forums and feel free to come back any time you need help.
-
You have helped me through the registry's uncharted waters and I'm cautious but not afraid anymore.
Not sure what may have done the trick. Maybe it was a glitch in the install but Norton is gone and that is a good feeling. I really like the Avast program and am so glad to have it working correctly.
Thanks again for all your help,
Donna in AR
Your very welcome.
The registry is something to be cautious with as it can seriously screw your system, ensuring always to export/back-up before editing or deleting.
Norton can really get its hooks into the system and getting rid of all registry occurrences I would say has certainly helped. Add to that a complete clear out of avast and reinstall helps as when avast detects Norton (usually in the registry) it can disable elements of itself to avoid conflict, which could lock-up your system.
Perhaps that was what was going on so until all remnants were gone avast would likely to have kept on disabling elements and a complete clear out of avast and reinstall should ensure all elements of avast are installed correctly.
Now at last you can sit back and enjoy avast, glad that you stuck with it and didn't give up.
-
Well, it breaks my heart to report this but here goes. Avast protected my mail for a few hours and I cut off my PC at night. On reboot this a.m. the warning is there again that it cannot protect incoming mail. I ran Outlook Express and no incoming mail was scanned so I'm right back to where I started.
What poltergeist changed something in the system is beyond me. I ran a THOROUGH Avast scan
yesterday with even archived files: nothing was found.
I suppose I need to download Hijack This so I can run a log . I've had even less dealings with .ini file
so I'm not sure how to follow Tech's directions to add to the mail scanner in that file. My mail downloads so very fast from Comcast Server and there were three in line this a.m. In Avast's On Access Internet Mail the mail that was scanned yesterday is gone and count has returned to 0 so the
functionality that I had briefly is gone.
Any ideas,
Donna
-
I ran Outlook Express and no incoming mail was scanned so I'm right back to where I started.
Why are you sure about this?
I've had even less dealings with .ini file so I'm not sure how to follow Tech's directions to add to the mail scanner in that file.
I posted how to create logs of the mail scanner activity... I did not post anything related to how to scan a file...
-
An ini file is just a text file containing installation and setting information (Configuration Settings), it can be edited by a text editor like notepad, always make a copy and save in another location before editing the original. Just navigate to it in explorer "C:\Program Files\Alwil Software\Avast4\DATA\avast4.ini" Find the [MailScanner] section, directly under it, create an new line and enter the Log=20, save, exit and reboot.
I would say proceed with the HiJackThis download, create a folder for it HJT will do rather than leave it on the desktop or a temporary folder, run it, save the log and post the contents here. You can find the download and tutorial links in my previous pots here, http://forum.avast.com/index.php?topic=27569.msg224673#msg224673 (http://forum.avast.com/index.php?topic=27569.msg224673#msg224673).
-
I may be missing something here but what is the point of getting Donna to create this log?
We are told that outbound mail is being scanned. A log will simply confirm this (to what end?). Since avast reports that the inbound intercept cannot be set then avast will not be logging any inbound activity because it cannot intercept it. How does that get us any further?
I really think the effort on HJT and perhaps on getting a TCPView we can see would yield more information.
-
I too don't feel it will reveal anything as the error is at boot and as you say if inbound traffic isn't being scanned there will be no log data for that, I was simply answering Donna's question.
-
Avast! knows before or as it goes into the system tray on bootup that it cannot check my mail. Since it worked briefly, it sounds more
like a bug in the Avast installation. It checks outgoing mail perfectly still. In fact that can't protect mail is the first thing I see on my desktop. ASAP follows a Comodo allow/deny for Avast. I agree that there is really nothing to log with HJT unless I am looking for an intruder.
I'm almost tempted to uninstall again using all the reboots, tools and scans and see if it would begin working again. A log might be helpful from that point especially if it quits again so I guess I could do HJT first and then do all the remove etc. It may even be
necessary to remove Avast files from register if there is something rotten in there so to speak. As you can see I don't give up easily
especially when a solution is so near and yet so far. I may even need to remove all Avast permissions from Comodo and let them
add themselves because I think there are already duplicates there. Once they are removed I have to re-boot for that too as I
understand it.
Donna
-
I may be missing something here but what is the point of getting Donna to create this log?
Try to know why the emails aren't being scanned...
-
I agree that there is really nothing to log with HJT unless I am looking for an intruder.
If this is in response to Alan and I saying it will reveal nothing that is about the avast log and 'not' HJT.
HJT doesn't just provide information on intruders, it provides information on everything running on your system. HJT if nothing else is useful for elimination purposes.
I honestly don't see another re-installation as a resolution of all the times you did that it only worked once (after the use of the uninstall utility, also cleaning registry) and then for only a short time, if this were a genuine avast bug it wouldn't just be happening to you and it would be consistent, it wouldn't be intermittent, now it works, now it doesn't.
I'm not sure deleting the comodo entries for avast will achieve what you are hoping, if it were blocking avast's ashMaiSv.exe then none of your email would work and not outbound works and inbound doesn't. However, it won't hurt to do it, but avast doesn't add itself to comodo, the firewall challenges an unknown (first use) application, your authorisation or denial adds it to comodo's applications list.
There really is only one option and that is running HJT and getting a log or Alan's suggestion of TCPview that will show what is using TCP connections. Personally I would go for HJT first.
-
Tech,
The avast mail log will show us what avast is intercepting - nothing.
Donna,
Do you know all of the drivers that are being loaded in your system at startup? Do you know all of the programs that are being started during startup? Have you used a product to tell you?
Do you know what might still be there and loading an intercept that is preventing avast from loading its port 110 intercept? Have you looked at what might be controlling the ports on your system?
If you do and you have already determined how to solve the problem (however briefly) then you will, most likely, not need any further help in resolving this. It would be helpful if you could report the solution here to help anyone else who might face a similar problem.
-
David,
-
David,
Don't know what happened as IE just cut off my message. I have run a system log with HJT. I'm confused on where you want me to send it and exactly how using notepad. I'm a bit in over my head here.
Donna
-
When you complete the HJT scan there is a button to Save the Log, doing that opens the log in notepad. Simply copy and paste the contents of the log into your post.
If it is to large to post in one piece, copy the first half and paste that, then copy the second half and post that in another post.
-
Logfile of HijackThis v1.99.1
Scan saved at 7:37:50 AM, on 4/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\SanDisk\Sansa Updater\SansaSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zinio\ZinioDeliveryManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\HP_Owner\My Documents\HJT\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=pavilion&pf=desktop
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: &Web Eyes - {C8C0204E-F720-4ec9-96F2-DF6C33C1E3CB} - C:\PROGRA~1\IONSYS~1\WEBEYE~1\WEBEYE~1.DLL
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Zinio DLM] C:\Program Files\Zinio\ZinioDeliveryManager.exe /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
O8 - Extra context menu item: Add To HP Organize... - C:\PROGRA~1\HEWLET~1\HPORGA~1\bin/module.main/favorites\ie_add_to.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {FC4F8941-BB5B-45c1-857C-E5B32157D00B} - C:\PROGRA~1\IONSYS~1\WEBEYE~1\WEBEYE~1.DLL
O9 - Extra 'Tools' menuitem: Web Eyes &Page Control - {FC4F8941-BB5B-45c1-857C-E5B32157D00B} - C:\PROGRA~1\IONSYS~1\WEBEYE~1\WEBEYE~1.DLL
O9 - Extra button: (no name) - {FD67E839-BCC2-4487-88DF-FB54C083CB14} - C:\PROGRA~1\IONSYS~1\WEBEYE~1\WEBEYE~1.DLL
O9 - Extra 'Tools' menuitem: Web &Eyes Reader - {FD67E839-BCC2-4487-88DF-FB54C083CB14} - C:\PROGRA~1\IONSYS~1\WEBEYE~1\WEBEYE~1.DLL
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159798113515
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://software.newsstand.com/reader/live/Disk1/isetupml.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.streamload.com/Upload/XUpload.ocx
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sansa Updater Service (SansaService) - Unknown owner - C:\Program Files\SanDisk\Sansa Updater\SansaSvr.exe
-
Even my untrained eye can see that something is wrong in Section 23 with two missing files that are crucial to Avast.
I wanted to check startup on my PC just out of curiosity but when I type MISCONFIG in an error appears saying that Windows cannot
find the file. That's pretty scary to me as I have been using Selective Startup for some time after I got rid of some unneeded icons.
Donna
-
Well do I feel like a fool or not? Guess it is a clue as to how rattled I am from this whole procedure. LOL
MSCONFIG works fine as it always does when you don't put in extra letters. I'm still worried about the two Avast
missing files.
Donna
-
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast). If they were truly missing the web shield wouldn't work and if you check the physical location you will see they are there.
The correct Run command is MSCONFIG not MISCONFIG.
Re your log, your untrained ey should also see references to symantec, these should be fixed, e.g. run HJT again and tick the box to the left of these entries and click the Fix checked button.
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
Other entries to fix:
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll (file missing)
O11 - Options group: [INTERNATIONAL] International*
Check, did you install this, do you know what they are, check on VirusTotal - Multi engine on-line virus scanner (http://www.virustotal.com/xhtml/index_en.html) if not sure.
C:\WINDOWS\system32\bgsvcgen.exe
http://www.file.net/process/bgsvcgen.exe.html (http://www.file.net/process/bgsvcgen.exe.html)
-
I did not recognize the Symantec at all but the first thing I did see was the Spycatcher stuff 02 BHO. I note that the log says that file is missing and it should be because Tenebril Spycatcher stuff was one of the files removed from the registry.
As to the International 011 entry I haven't a clue; I Googled it but didn't find a likely source. Bleeping Computer says: Its for Internationalized Domain Name Support in Internet Explorer 7. http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ietechcol/cols/dnexpie/ie7_idn_support.asp Guess I'd better let this one alone as I do have IE7.
I will run HJT again and fix the Symantec and I guess the Spycatcher too. Does HJT take it out as we did manually?
Donna
-
bgsvcgen.exe file information
The process B's Recorder GOLD Service Library belongs to the software B's Recorder GOLD by B.H.A Corporation (www.bhacorp.com).
Description: bgsvcgen.exe is located in the folder C:\Windows\System32. The file size on Windows XP is 86016 bytes.
The program is not visible. File bgsvcgen.exe is located in the Windows folder, but it is not a Windows core file. bgsvcgen.exe is not a Windows core file. Therefore the technical security rating is 51% dangerous.
Important: Some malware camouflage themselves as bgsvcgen.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the bgsvcgen.exe process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.
Can't really find a solid answer but it looks iffy. Unless this came through iTunes I've not downloaded anything like this.
Donna
-
avast also detects registry entries, that is why we spent time trying to remove them. If avast detects a registry entry that could conflict then it may disable any element that could conflict, even though the file isn't running, it doesn't know it might not start later it doesn't go looking in depth. HJT removes the registry entry and should keep a back-up.
Although the international one was one I said to fix, it shouldn't have anything to do with the avast issue, leave it if you like.
The only one I sought confirmation was bgsvcgen.exe in the link I gave and you quoted, gave a file size did you compare that to yours ?
The idea of anything that is 'iffy' as you put it is to check it with virustotal, etc. if nothing is detected in the 32 different scanners the less likelihood of it being 'iffy.'
From the bhacorp.com site this doesn't appear to be anything to do with itunes and would appear to be a paid for installation. As such I would expect to see an add remove programs entry for it.
-
I was unable to figure out how to get the bgsvcgen.exe file into Virus Total; it is in Task Mgr. and its size is 100K as opposed to the
86016 bytes mentioned in my quote. It is not in Add/Remove in any form that I can see. I expect it is malware. I will check Virus
Totals if you explain how. I can also add the International one; I don't like the fact that even if it is IE7 MS should claim it in some way.
Donna
-
You connect to virustotal on the top right of the screen is a browse button, click that and navigate to the suspect file, C:\WINDOWS\system32\bgsvcgen.exe.
You can't check the International one there is no associated file.
-
This mysterious application is virtually hidden I found it by running a search and there is a file Named B's Recorder Gold Library by
BHA File 1.0.0.1 created 12/15/06 84.0 KB
I have no clue but it must be attached to some program I have perhaps Audible or perhaps my CD/DVD burners. When I go to BHA it
looks to me as if the software is no longer supported. Too Weird!
Just completed the scan. VirusTotal is AWESOME! Is there a spyware one like this? No virus in this and no threats!
Ok I'm ready to FIX using HJT as you directed. Fix the Spycatcher in 02 BHO and the 3 Symantec in 016. Right?
I guess leave the International and this mysterious BHA? Is there a possibilty of No Fix and might have to go in manually?
Donna
-
Virustotal has anti-spyware engines in there as well and is the ideal location for checking any suspect file.
Ignore the International issue for now as it is of no importance in this particular problem, fix the rest.
Rename bgsvcgen.exe to bgsvcgen-exe.old I say rename rather than delete as that is a final option. If some program in the future complains about bgsvcgen.exe is missing then if this program is legit and its use of this file also seems legit you can re-name it back again.
Files that are deleted from the system folder usually end up as restore points in the c:\system volume information folder and you don't really want that, certainlt no tat this moment in time.
-
David,
I've removed the 4 items, they are in back-up, and I re-booted. I did another scan and they are gone. The can't protect e-mail
appeared on re-boot. As a last ditch effort I'm pasting in a copy of a start up scan to see if you note problems there.
StartupList report, 4/9/2007, 6:01:05 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\HP_Owner\My Documents\HJT\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16414)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\SanDisk\Sansa Updater\SansaSvr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zinio\ZinioDeliveryManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
C:\Documents and Settings\HP_Owner\My Documents\HJT\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
hpsysdrv = c:\windows\system\hpsysdrv.exe
KBD = C:\HP\KBD\KBD.EXE
Recguard = C:\WINDOWS\SMINST\RECGUARD.EXE
PS2 = C:\WINDOWS\system32\ps2.exe
ISUSPM Startup = C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
COMODO Firewall Pro = "C:\Program Files\Comodo\Firewall\CPF.exe" /background
avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Zinio DLM = C:\Program Files\Zinio\ZinioDeliveryManager.exe /autostart
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
--------------------------------------------------
Enumerating Task Scheduler jobs:
AppleSoftwareUpdate.job
User_Feed_Synchronization-{366CA388-C814-431F-A04B-50AC30D63C32}.job
--------------------------------------------------
Enumerating Download Program Files:
[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
CODEBASE = http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
[Snapfish Activia]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\SnapfishActivia1000.ocx
CODEBASE = http://www1.snapfish.com/SnapfishActivia.cab
[{49232000-16E4-426C-A231-62846947304B}]
CODEBASE = http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159798113515
[Ofoto Upload Manager Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\axofupld.dll
CODEBASE = http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
[InstallShield International Setup Player]
InProcServer32 = c:\windows\DOWNLO~1\isetupml.dll
CODEBASE = http://software.newsstand.com/reader/live/Disk1/isetupml.cab
[CInstallLPCtrl Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\InstallLP.dll
CODEBASE = http://u3.sandisk.com/download/apps/LPInstaller.CAB
[Persits Software XUpload]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\XUpload.ocx
CODEBASE = http://www.streamload.com/Upload/XUpload.ocx
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
--------------------------------------------------
End of report, 6,546 bytes
Report generated in 0.016 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Hopefully this will be of some help. If not I'm brain dead at this point.
Donna
-
Unfortunately I don't see anything in this start-up report list.
I'm absolutely at a loss as to what else to suggest, I can't see anything that might have some interaction with the mail scanner.
What makes it all the more baffling is even though the error on boot that avast can't protect your email, clearly it is checking/protecting your outbound email.
I have spent some time going over the topic again in the hope of finding something that I may have missed or is significant and I think I have found something.
Avast! knows before or as it goes into the system tray on bootup that it cannot check my mail. Since it worked briefly, it sounds more
like a bug in the Avast installation. It checks outgoing mail perfectly still. In fact that can't protect mail is the first thing I see on my desktop. ASAP follows a Comodo allow/deny for Avast.
Highlighted in red, what I can't understand is why comodo should need to ask permission again, there should be an option to remember your choice, etc. Although you say this comes ASAP after the avast warning, it actually may be happing at the same time but avast would potentially intercept it whilst it scans the pop-up comodo alert.
At that time comodo is effectively blocking so that may be why avast is grumbling about not not being able to protect your email.
So exactly what avast process is comodo continually asking permission for, I'm hoping it is ashMaiSv.exe ?
-
The Comodo Avast permission did not come up this a.m. nor I think did it in a reboot last night either. I've gone back over all my notes and it appears that it was AshWebSvc. that was asking to be allowed.
FF just crashed again when it has not for two days. Go figure that too.
Donna
-
The ashWebSv.exe, Web Shield 'shouldn't' have and impact on the email protection message, so scratch that hope to have found a possible reason.
Since the comodo pop-up doesn't occur, does the avast email protection warning still appear, I can only assume it does as you didn't say but you aren't jumping for joy ?
Have you taken/recorded the information on the FF crash as I previously suggested, without it you really wont find the cause. I have had no issues with FF 2.0.0.3 since I updated.
I think it is time to take another step and try the avast beta 4.7.971 I and several others have been using this for 11 days now with no major issues, http://forum.avast.com/index.php?topic=27439.0 (http://forum.avast.com/index.php?topic=27439.0), download the small exe file and then run it, that will change the version to the beta, you will need to reboot after conversion.
When the final release version update comes avast will update to that with no input required from you. Just monitor the beta topic and you will see when it is released as a regular update and you can do a manual update if you don't want to wait for the regular update cycle.
Some of the changes in the beta are designed to get avast starting quicker on boot, this may help if there is any conflict with another running process, it really is the only thing left that I can suggest.
-
I will try the beta version today as I like everything ELSE about Avast very much. After much research I find there really are no other choices other than something like Trend Micro which doesn't conflict with anything. LOL I certainly don't want any more Norton. For years Norton worked well for me but the present bloated version is not my cup of tea.
Right now I don't have the energy for FF problem but yes I will have to solve it. I think taking out
extensions and a re-install may work best. I started having trouble when the auto (prior to start) ext.
updates began. In my case it was several weeks after installing 2.0.0.3 before crashes began.
I don't suppose I need to do anything to Comodo when I go to beta Avast; I guess it will take care of itself.
I can't thank you enough for all your help and the learning experience I've had. As a 63 yr old retired
school teacher who taught myself the Mac and the PC (what little I know) I don't think I will ever lose
my love of learning new things.
Donna
-
For years Norton worked well for me but the present bloated version is not my cup of tea.
Fully agree.
Right now I don't have the energy for FF problem but yes I will have to solve it. I think taking out
extensions and a re-install may work best. I started having trouble when the auto (prior to start) ext.
updates began. In my case it was several weeks after installing 2.0.0.3 before crashes began.
Version 2.0.0.3 is working well for me. Maybe you should open Firefox (Safe Mode) and exclude the problematic extensions from there.
I don't suppose I need to do anything to Comodo when I go to beta Avast; I guess it will take care of itself.
Yes, no trouble between them.
-
10.04.2007 09:14:32 general: Started: 10.04.2007, 09:14:32
10.04.2007 09:14:32 general: Running setup_av_pro-3ae (942)
10.04.2007 09:14:32 system: Operating system: WindowsXP ver 5.1, build 2600, sp 2.0 [Service Pack 2]
10.04.2007 09:14:32 system: Computer WinName: DONNA
10.04.2007 09:14:32 system: Windows Net User: DONNA\HP_Owner
10.04.2007 09:14:32 general: Cmdline: /downloadpkgs /noreboot /silent /progress
10.04.2007 09:14:32 general: DldSrc set to inet
10.04.2007 09:14:32 general: Operation set to INST_OP_UPDATE_GET_PACKAGES
10.04.2007 09:14:32 general: Old version: 3ae (942)
10.04.2007 09:14:32 general: SGW32P::CheckIfInstalled set m_bAlreadyInstalled to 1
10.04.2007 09:14:32 system: Computer DnsName: Donna
10.04.2007 09:14:32 system: Computer Ip Addr: 69.247.112.214
10.04.2007 09:14:32 internet: SYNCER: Type: use IE settings
10.04.2007 09:14:32 internet: SYNCER: Auth: another authentication, use WinInet
10.04.2007 09:14:32 package: Part prg_av_pro-3ae is installed
10.04.2007 09:14:32 package: Part vps-73101 is installed
10.04.2007 09:14:32 package: Part news-4b is installed
10.04.2007 09:14:32 package: Part setup_av_pro-3ae is installed
10.04.2007 09:14:32 general: Old version: 3ae (942)
10.04.2007 09:14:32 file: SetExistingFilesBitmap: 937->145->145
10.04.2007 09:14:32 general: GUID: 593be896-c2e4-4c85-9f6a-94b8c7ebb2ee
10.04.2007 09:14:32 general: Server definition(s) loaded for 'main': 2 (maintenance:0)
10.04.2007 09:14:32 general: SelectCurrent: selected server 'Test (external beta)' from 'main'
10.04.2007 09:14:32 package: GetPackages - set proxy for inet
10.04.2007 09:14:32 internet: SYNCER: Type: use IE settings
10.04.2007 09:14:32 internet: SYNCER: Auth: another authentication, use WinInet
10.04.2007 09:14:32 general: Entered SetupProcessPro::Do( INST_OP_UPDATE_GET_PACKAGES )
10.04.2007 09:14:32 general: Entered SetupProcessWin32Avast::Do( INST_OP_UPDATE_GET_PACKAGES )
10.04.2007 09:14:32 general: Entered SetupProcessWin32::Do( INST_OP_UPDATE_GET_PACKAGES )
10.04.2007 09:14:32 general: Entered SetupProcess::Do( INST_OP_UPDATE_GET_PACKAGES )
10.04.2007 09:14:32 general: progress thread start
10.04.2007 09:14:32 general: progress start - 1
10.04.2007 09:14:33 general: progress start - 2
10.04.2007 09:15:07 package: ERROR:HttpGetWininet, catch returned 0x00002EFD
10.04.2007 09:15:28 package: ERROR:HttpGetWininet, catch returned 0x00002EFD
10.04.2007 09:15:28 general: InvalidateCurrent: invalidated server 'Test (external beta)' from 'main'
10.04.2007 09:15:28 general: SelectCurrent: unable to find any suitable server in 'main'
10.04.2007 09:15:28 internet: while trying to get file 'servers.def.vpu', error 0x20000004 has occured, try 1
10.04.2007 09:15:28 internet: tried 1 servers to get file 'servers.def.vpu', but failed (0x20000004)
10.04.2007 09:15:28 file: GetNewerStampedFile:GetFileWithRetry failed: C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\_av_proI.tm~a03348\onefile, servers.def.vpu, error: 0x20000004
10.04.2007 09:15:28 package: Download servers.def, servers.def.vpu failed with error 0x20000011.
10.04.2007 09:15:49 package: ERROR:HttpGetWininet, catch returned 0x00002EFD
10.04.2007 09:16:10 package: ERROR:HttpGetWininet, catch returned 0x00002EFD
10.04.2007 09:16:10 general: InvalidateCurrent: invalidated server 'Test (external beta)' from 'main'
10.04.2007 09:16:10 general: SelectCurrent: unable to find any suitable server in 'main'
10.04.2007 09:16:10 internet: while trying to get file 'servers.def', error 0x20000004 has occured, try 1
10.04.2007 09:16:10 internet: tried 1 servers to get file 'servers.def', but failed (0x20000004)
10.04.2007 09:16:10 file: GetNewerStampedFile:GetFileWithRetry failed: C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\_av_proI.tm~a03348\onefile, servers.def, error: 0x20000004
10.04.2007 09:16:10 package: Tried to download servers.def but failed with error 0x20000004.
10.04.2007 09:16:10 general: progress end - 1
10.04.2007 09:16:10 general: progress end - 0
10.04.2007 09:16:10 general: progress thread end
10.04.2007 09:16:10 general: Err:Cannot connect to cat.asw.cz (195.47.75.56:80)Logfile from error attached:
-
It went ahead and loaded but I received a corrupt file notice in red at the bottom of the screen. Ithink the problem is and always has been the Comodo firewall which delays by asking 1000 times I don't care how much I check to remember my allow message. The last attachment shows that and it would not allow in time to correctly load the update.
My current version still says 4.7.942. I think it is clean out and start over time. I need to know what to do with the firewall Comodo 2.0.
Disable or uninstall and turn on WinXP as temp measure.
Donna
-
You have to allow avast.setup in the comodo firewall, if an entry exists for avast.setup, delete it and do a manual update iAVS this should force comodo to ask permission, accept, directly after that try running the beta conversion exe you downloaded.
What version of comodo are you using ?
There were previously some issues with comodo (in the forums), I can't recall exactly what but there was a beta release for that which has now been a regular program update, ensure you have the latest comodo version.
-
I have Comodo 2.4.18.184 and there are no updates available. In looking at the apps monitor in the firewall almost every Avast app has
been duplicated at least once. There are also a huge number of FF entries for whatever that is worth.
It is my personal belief that I should have set up Avast and got it working properly and then installed Comodo. Their tutorials are rather
sketchy and trying to figure two complicated programs at once is a headache. I just don't like the way CPF asks and asks and asks
no matter what I check and in spite of the fact that I ran a scan early to set up apps already in use. I have to say that I never had
that problem with Norton Firewall; it seemed to know what to do and its settings were familiar and easier to navigate.
I'm sorry but iAVS is Greek to me.
Donna
-
I would suggest you delete all the entries for avast and firefox in comodo and then allow them as they are challenged, the duplicated could possibly cause some sort of fallout.
Fortunately I know what iAVS is, it is the old name for VPS the virus signatures, had you dome as suggested try a manual update, right click the avast icon, Updating, you would then have seen the iAVS.
It is not too late to do as you suggest, uninstall both avast and comodo and reboot then install avast, reboot and then install comodo. You will of course get lots of pop-ups asking permission until it stabilizes.
-
iAVS is, it is the old name for VPS the virus signatures
Not that old: it appears on help files and some windows too...
-
Just thought I'd let you know what has happened. I am now running beta version of Avast! On reboot the error about mail scan remained but the new message says it is probably the firewall. I uninstalled Comodo, rebooted and no message!!!!!
I think in ignorance I made some mistakes installing Comodo so I now have a tutorial and will follow it step by step. I have WinXP
firewall on temporarily just to make sure that all is well.
I suppose I should leave beta Avast as is if all remains well and just try the re-install of Comodo and cross my fingers? By the way,
taking out Comodo did nothing for the FF crash problem so once I get everything up and running that has to be my next project.
Oh well, It's always something.
Donna
-
I suppose I should leave beta Avast as is if all remains well and just try the re-install of Comodo and cross my fingers?
No need to remove neither avast beta nor Comodo.
Both work perfectly together. Why don't you just post a screenshot of the message you're seeing and let us help easier...
-
Donna, has posted the text of the error many, many, pages ago http://forum.avast.com/index.php?topic=27569.msg224533#msg224533 (http://forum.avast.com/index.php?topic=27569.msg224533#msg224533).
The total message is: Avast can't scan or protect incoming POP3 mail. 10049 Error
For currently #80 replies that is what we have been trying to do help her and this is what it has got down to !
There clearly is something wrong with her comodo installation, duplicate application entries, failure to remember previous grant of permissions, etc. etc. the use of the beta was done to try and get avast in before comodo. Now without comodo, no error, go figure.
@ Donna
There is no need to uninstall the beta, leave that, reinstall comodo once you have read up on the tutorial, my fingers are crossed too, this has been a long journey. Good Luck.
-
David,
It has been a long road and I can't thank you enough for all your help. Once the firewall was uninstalled I knew the answer had been found. When I re-installed Comodo using Little Mac's tutorial
from their forum it was a piece of cake. I had made some installation errors out of ignorance and lack
of familiarity with firewalls.
I love both Avast! and Comodo. They are wonderful pieces of software! I filed for my Norton refund today and I am a full convert to both of my new programs. When done right they both perform right
out of the box.
I think you can safely consider my case closed and thanks again.
Donna
-
Congratulations in sticking with it and succeeding, job done ;D
Good luck with the Norton refund.
Now everything is working I think you should be able to see your system is quicker.
-
Donna,
I too think that you have shown magnificent perseverance and a great aptitude for excellent diagnostic thinking - you and David made a great partnership in tracking down and overcoming this problem. One for us all to remember when the going gets difficult.