Avast WEBforum

Other => General Topics => Topic started by: Mika_fra on March 30, 2010, 07:05:45 PM

Title: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 30, 2010, 07:05:45 PM
Hello,

After several attempts to fix the problem using solutions found accross the forum. I am creating a new thread since I cannot acces internet without disabling avast web agent (= disabling internet connection protection if I understood correctly).

I am on Win XP and I am using Avast 5.0.462. It s the computer of someone from my family but I know it used to work properly with Avast in the past so I think it is linked to the most recent version of Avast

Here are all the solutions I have tried so far without any success:

http://forum.avast.com/index.php?topic=57443.msg485940#msg485940
http://forum.avast.com/index.php?topic=57282.0
http://forum.avast.com/index.php?topic=57646.msg485911#msg485911

The problem is still there even if I disable my firewall which is Windows firewall.

Would any of you have any other idea please?

Thanks!

Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on March 30, 2010, 07:12:51 PM
which xp? which sp? (2/3)
which avast? (free/pro/ais)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 30, 2010, 07:15:20 PM
Family edition - SP 3
Free Avast
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on March 30, 2010, 07:17:58 PM
web shield uses a local proxy. is there another local proxy running on ur sys?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 30, 2010, 07:25:15 PM
Well, I see two connections :

1394 connection
Local network connection
Title: Re: Avast 5.0.462 blocking internet connection
Post by: scythe944 on March 30, 2010, 07:30:03 PM
A proxy is not a hardware device (well, it CAN be), so it won't show up in your network connections.

You'd see a proxy in your Control Panel > Internet options > Connections tab > LAN Settings.

If there's a proxy listed there, you should probably disable it.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 30, 2010, 07:43:25 PM
Thanks for taking the time to explain

I have no proxy connection. I have the first option (connect automatically) selected
Title: Re: Avast 5.0.462 blocking internet connection
Post by: scythe944 on March 30, 2010, 07:53:44 PM
I looked at the threads that you posted, and saw that you apparently tried to remove / reinstall, you checked to see if any 3rd party firewalls weren't blocking any Avast services, and that you have correct registry settings for the Windows Temp folder.

In the removal process of Avast 4.8 (Which I assume you were using before upgrading to 5), did you remove through Add / Remove programs, then reboot into safe mode and run the removal tool for 4.8?

Did you just upgrade directly to 5 without uninstalling the previous version?

Have you attempted to completely remove avast 5, reboot into safe mode, use the removal tool for 5, then reboot and install from scratch?

If you've done all of that, then I can assume we can rule out an installation problem.  The problem is that I haven't had any of these problems with my Avast 5 installations (only about 5 so far) and I'm not sure where to start troubleshooting further.  All I know is that clean installations usually fix the most common problems like these.

If my post doesn't help in any way, hopefully someone else with more insight can help you soon.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on March 30, 2010, 08:16:08 PM
Family edition - SP 3

maybe its because of the family edition, i don't know much about it, sry.
anyone?

does ur pc connect via port 80 2 the net?
can u temporarily disable the firewire connection 4 testing?
is it posible 2 receive/send mails?
have u upgraded from 4.8 to 5.0 or was it a definition (vps) update?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: scythe944 on March 30, 2010, 08:17:18 PM
Family edition - SP 3

maybe i't because of the family edition, i don't know much about it, sry.
anyone?

I think he meant, "Home" edition.

Quote
My name is Mikaël  so it's "he"
*sorry about that*
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 30, 2010, 08:26:15 PM
My name is Mikaël :) so it's "he"

I tried again to uninstall with safe mode part (did not go into safe mode the first time) but it changed nothing
I suppose the upgrade from 4 to 5 was not done without removing the old version completely first

I am French and my Windows version is called Family which is actually the most basic one so I suppose it is called Home in English

does ur pc connect via port 80 2 the net? => I think not since the Proxy part in which you can chose it is in disabled since I have "automatic detection of connection parameters" selected
can u temporarily disable the firewire connection 4 testing? => if you tell me how to do it I think I can
is it posible 2 receive/send mails? => yes
have u upgraded from 4.8 to 5.0 or was it a definition (vps) update? => I dont understand what you mean by "definition (vps) update"
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 30, 2010, 08:35:38 PM
Let's go the complete way.

Follow these rules: http://forum.avast.com/index.php?topic=57646.msg485911#msg485911


You already did that... hm. No more ideas here.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 30, 2010, 08:42:09 PM
Can you do a hijackthis scan and post a logfile?
Download from http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

Install, start and select "Do a system scan and save a logfile".

Post the logfile here, please.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on March 30, 2010, 08:42:45 PM
so, family=home in french ??? i never stop learning... ;)

if ur machine doesn't use port 80, u have 2 find out which port it uses.
then go 2 preferences.
error handling.
redirection rules.
look 4 http-port.
enter the port ur machine uses there.
try 2 connect.

(definition/vps update is the update avast makes several times a day as new viruses r encountered)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 30, 2010, 08:45:43 PM
What makes you think he doesn't use port 80?

Do you mean:
settings -> troubleshooting -> redirect settings
in the Avast UI?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on March 30, 2010, 08:47:31 PM
does ur pc connect via port 80 2 the net? => I think not

@zyndstoff: 1st question - see quote above. 2nd: tnx! could b, since i'm using the german version, i don't always know the right terms in english. ;)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 30, 2010, 08:55:40 PM
The "I think not"... I would rather say he hasn't the faintest clue.
I bet you that it is port 80.

He is a non-it-tech-savvy pc noob, which is normal for 95% of the people using computers, so I doubt that there is any very special set up.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: scythe944 on March 30, 2010, 08:58:31 PM
Well, he may not be, but you don't have to rub it in his face...  ;)

But I'll agree that he's probably using port 80 for browsing the web.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 30, 2010, 09:01:12 PM
I did not mean that insulting or offending in any way.
It is just a fact. I hope he does not misunderstand me.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: scythe944 on March 30, 2010, 09:07:21 PM
No prob Zynd,

no we just have to figure out what the hell is wrong with his install...  ???
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on March 30, 2010, 09:07:42 PM
well, guys - u might b right... ;)
but as we don't know 4 shure, we should try 2 help, if possible... ;D
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 30, 2010, 09:50:53 PM
yeah, but not by searching a needle in a hay-stack. And BTW it may be too complicated for him. The firewire e.g. is just the hardware in his device-manager. He is not using it, for sure.

I hope he will send a hijackthis log, that lights up at least a little on the sw-side.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on March 30, 2010, 10:20:24 PM
I hope he will send a hijackthis log, that lights up at least a little on the sw-side.

right, let's wait 4 that one... :)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 31, 2010, 08:06:03 PM
Hello,

Yes I am a noob :)

Indeed in Avast it indicate port 80.

Here is the log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:01:38, on 31/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Logitech\iTouch\iTouch.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Apps\ActivBoard\MMKeybd.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\TrayMon.exe
C:\Apps\ActivBoard\OSD.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] C:\Apps\ActivBoard\MMKeybd.exe
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Fichiers communs\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [Update Service] "C:\Program Files\Fichiers communs\Teknum Systems\update.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) - http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131374264514
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Apps\ActivBoard\nhksrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H+H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

--
End of file - 9319 bytes
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 31, 2010, 08:07:31 PM
By the way, a noob question: am I not displaying any too private info in the log? I mean...this is a public forum and I did not find a way to send a private message...
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 31, 2010, 08:15:03 PM
You are running Spybot S&D...? That right?
Disable Teatimer in Spybot.
Its more a hazard than a help - and may be the cause.
Maybe Spybot S&D is the problem... first guess. Can you disable it totally, just to see? Better even uninstall - and reinstall afterwards if avast should work then.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 31, 2010, 08:46:59 PM
Actually...no. It is not even installed on the computer anymore (I recall it has been used long ago)

I cannot even find the file in "Program files"

(by the way, can you please tell me if there is no problem with the log beeing on a public internet page? :p)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 31, 2010, 08:56:36 PM
No prob. It's very common in av-forums.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 31, 2010, 08:59:35 PM
Spybot is still in your startups (in the registry) :
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

Do you have any registry cleaner, like CCleaner, TuneUp or GlaryUtilities free?
Clean the registry with it.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on March 31, 2010, 09:20:38 PM
Well. It works now!!! Thanks so much for your help. Hope it is not temporary but it doesnt seem so!

Have a nice evening  :)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on March 31, 2010, 09:21:53 PM
STOP!

What did you do before it started working?
We rely on feedback here!
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on April 01, 2010, 10:17:32 AM
STOP!

What did you do before it started working?
We rely on feedback here!

+1
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 11:04:51 AM
Hello,

First, do not worry I will not disappear as soon as the problem is fixed.

Unfortunately it is not fixed yet :(

I had installed CCleaner and cleaned 1,7 GO (sounds huge) and then it worked. Rebooted. Worked again. The day after, it does not work anymore :(
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 11:07:59 AM
GO? What is that?

The problem is back?  :o
Would you mind and give a short description of the problem again? Sorry for the inconvenience...
We'll try our best! I think there will be not too much moderator support until Tuesday, after all, it's Easter time.  ;D

One stupid thought...: is your date/time on your PC set correctly?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 11:12:50 AM
Giga octet :)

Ok so here is an up to date description :

When Avast web agent is off. I have access to internet without any problem
When Avast web agent is on. I apparently have from time to time access to the internet (that's why it worked after CClean) but most of the time connection is not working. When I ask to check what could be wrong with the connection (the web browser automatically ask if I want) it says everything is ok

Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 11:14:56 AM
Okay... I remember we did this already? http://forum.avast.com/index.php?topic=57443.msg484431#msg484431
Would you mind checking it again, just to be sure?

BTW: what is Giga Octet?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 11:20:40 AM
L'octet - c'est francais pour "byte"?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: spg SCOTT on April 02, 2010, 11:25:36 AM
L'octet - c'est francais pour "byte"?
IIRC, one byte is 8 bits...

http://en.wikipedia.org/wiki/Octet_%28computing%29
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 11:31:03 AM
 ;D
How can "byte" be ambiguous...? (Referring to wikipedia)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 11:39:38 AM
http://www.wordreference.com/fren/octet

So I guess yes :)

I checked and the TEMP folder exist in C:\Windows

I checked registry and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
has values TEMP and TMP

By the way, I am going to be slower answering since now I am back in Paris and my relative is in Marseille so I have to explain to him by phone and have him do what you ask me since he does not speak english. But please be so kind to keep helping, I will answer as fast as possible.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 11:51:11 AM

I checked registry and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
has values TEMP and TMP


And the values are "%SystemRoot%\Temp"...?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 12:18:10 PM

I checked registry and HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
has values TEMP and TMP


And the values are "%SystemRoot%\Temp"...?

Yes
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 12:30:17 PM
Okay. I'm still confused about the "Tea Timer" from Spybot Search and Destroy in the hijackthis log.

Does this folder exist: "C:\Program Files\Spybot - Search & Destroy\" ?
Can you give a screenshot of Taskmanager (the running services tab)?

Go here: MBAM (http://www.malwarebytes.org/mbam/program/mbam-setup.exe) and run MBAM, just to make sure, there is no malware.
Also please post the content hosts file: C:\Windows\system32\drivers\etc\hosts (open file with editor)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 01:53:45 PM
We are running Malwarebytes

The folder of Spybot does not exist

(http://img145.imageshack.us/img145/4014/23150247.jpg)
(I hide the family name but I guess you had guessed)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on April 02, 2010, 02:37:16 PM
Just a try...
Please disable apdproxy.exe for testing.
I don't know if this will help you, i think we are back to guessing again...
asyn
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 03:03:52 PM
Which host file you want me to display? Most are "examples" but Protocol & Services files seems to be not examples but real files.

No malware found

Apdproxy.exe shut down => nothing changed
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 03:17:13 PM
Why that? It's an (I believe) Adobe CS 3 Elements part...
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 03:18:01 PM
There is only one file called "hosts" in that folder...
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 03:24:41 PM
But anyway, I don't have much hope the hosts file being the problem.
I see a lot of HP stuff there. Is it 1 printer from HP?
I'm down to guessing and wild shooting in the dark - would it be too much effort to uninstall the HP-printer completely and reboot, run CCleaner again...

How is that PC connected to Internet anyway? Via router?

I wish I could be of more help... makes you feel so stupid.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: bong2x on April 02, 2010, 03:45:49 PM
 ;D
Quote
I wish I could be of more help... makes you feel so stupid.

hey don't give up!!! i saw you have two os in one machine that's your advantage

you can reproduce his problem and you can solve it in your machine ;)

but he need only a reset. i mean cold boot but before that, he need to re configure his start up menu.

it has to much application running make the slowly response to the operation ;)

best regards!!!
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 03:46:50 PM
Well, the Hosts file display that:

Quote
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
::1             localhost

Yes there is one printer and I know it caused a lot of trouble when they tried to make it work properly so it is not an option to uninstall it :(

The PC has a cable connection and there is a cable modem to connect it to the internet
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 03:48:33 PM
1. No I can't reproduce, because my XP is running perfectly. No errors, no slow or sluggish internet. Nowhere to search.

2. He needs more than a restore. We've had that all through already.

3. I'm hanging on. But if you don't know where to look... it's hard.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 03:51:55 PM
That is bad luck, that we can't uninstall the printer.
It is my biggest suspect at the moment.
How is the printer connected? Via USB?

BTW: as I thought, the hosts file is absolutely ok.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on April 02, 2010, 04:00:16 PM
Why that? It's an (I believe) Adobe CS 3 Elements part...

Well it's just a shot in the dark... only because it has the word 'proxy' in it. ;)
I thought if it is some kind of proxy, it could interfere somehow. As he stated, that it only happens sometimes, i guess it is related to a driver/prog, running at that specific time... Is the HJT log from a time the problem occured?
asyn
Title: Re: Avast 5.0.462 blocking internet connection
Post by: bong2x on April 02, 2010, 04:03:10 PM
yes its bad luck how can you help him he show the task manager only name, pid and description, how about the status what is running? will the nearest thing to do is guess ;)

and he only show local service how about the plug and play? how about the net service?



Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 04:05:28 PM
Shooting again:

Go to webshield, Expert Settings and disable Code-Emulation. (see screenshot)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 04:05:33 PM
That is bad luck, that we can't uninstall the printer.
It is my biggest suspect at the moment.


I think it is connected via USB but cannot check at the moment since everybody is out

It would not surprise me if the printer was creating problem since it had a lot of time as I mentioned earlier. The owner of the computer told me he think he should switch to Microsoft Security Essentials and I wonder if this is not the easiest solution...hoping it works with his computer set up :(

Let me know if you have other ideas otherwise I think we will just go for changing antivirus option :( (I have been using Avast for long without any problem on my computer and I would have liked to avoid removing Avast on the other but if we cannot solve the problem...)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 04:08:22 PM
See one post above yours.  :)

Yes, I can understand if he switches. However, he could also go to add/remove programs, avast, change and uninstall the webshield.
I heard there will be a version update soon - and I believe it will solve the slowing down problem with webshield.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on April 02, 2010, 04:11:46 PM
That is bad luck, that we can't uninstall the printer.

But we could stop the hp-drivers from loading. (with eg. ccleaner)
What do you think? Sould we give it a try?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Sesame on April 02, 2010, 04:31:12 PM
Well, the Hosts file display that:

Quote
# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
::1             localhost
I am on Win XP and I am using Avast 5.0.462.
IPV6 on XP?  Have you installed a driver for IPV6?  Here (http://support.microsoft.com/kb/972034), you can see difference  in hosts files in XP and Vista/7.

This is just yet another shot in wild, but how about copying the hosts file in a different place and deleting the entry "::1             localhost"?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 04:43:34 PM
Let's try. We don't need to delete. Just put a # in front of it to mark it as a remark... If it doesn't change anything, we can just delete the # again.

The hosts file is write-protected, be sure to change that before changing and reset after changing.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 04:47:46 PM
One more thing: I see it's an ATI Graphics adapter... what driver version are you using? if it is 10.2, revert to 9.xx.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on April 02, 2010, 04:55:03 PM
Maybe that's a hit.
Could be his printer is connected via firewire... The op stated that the install of the printer was difficult. And if they messed some things up, it could be that this is the problem, since firewire can use ipv6.
(The default MTU size for IPv6 packets on an IEEE1394 network is 1500 octets.)
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 05:12:44 PM
No, printer is via USB, I asked.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on April 02, 2010, 05:29:34 PM
Yes, but he wrote... 'I think'.... you know, what that means... ;)
Let's wait till he can check it and posts back.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 02, 2010, 08:35:34 PM
Sorry for the late answer.

Printer is connected with USB.

ATI Graphic driver is 6.xx

About the "Hosts" part : since he had it translated in french for some reason and it seemed like it was 100% equal to the one on my computer, I copied it. However I had stoped him from reading everything at the 127.0 line. And actually it was the last one for him but (since I am on Vista?) I had the extra "::1  localhost" line. He does not have it.

Now I think it is unfortunately time to give up because as expected he does not want to uninstall the printer since it was very hard to install and while I am 100 % ok with you calling me a newbee, he is a super newbee and it took me like 30 minutes to do something which should take 3 (posting pics of the screen for example) so it is to heavy to handle and unfortunately I do not know how to take control of his computer (it would be the solution) and it seems too complicated from what I have read on the web since I need to set up things on his computer also before beeing able to take control of it :(

Thanks a lot for your input and time invested. I wish we could have solved the problem but as suggested it seems to be a wider problem than just a Avast related problem.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 02, 2010, 08:41:22 PM
I fully understand you.
If you go on www.tex62.de -> contact and send me a message with your email, I will inform you when the new updated version is here - if you wish.

Thx for your support, help and patience.
Hope to see you back again at avast.

Zyndstoff

Oh, and for distance control: google for teamviewer. It is free for private use and it is SIMPLE! Very simple. Start on both PCs, he calls you on the phone, gives you two numbers that you enter on your side: voilá.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: mkis on April 02, 2010, 10:21:50 PM
HijackThis log

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) - Fix this
Checkmark in box next to the entry and click Fix Checked in bottom left hand corner of the screen


09 - Extra button: Packard Bell - {1D49B7D4-524D-4ac9-BC34-B4822CAE4BB1} - C:\Apps\IECustom\script.htm
Is this the printer? - has an app written in IE


O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
extra and probably not playing role in performance lag

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
I get a hosts file block on Real.com - probably need to fix this - I dont know what it is - second opinion

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
Wait proceedings

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll

I see Spybot - and I would say uninstall that and see if any difference in performance - Why Spybot?

I'm no expert at these logs,  so I usually leave them open for other members to comment
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 03, 2010, 09:40:28 AM
mkis: Spybot was the first thing I suspected, but it is not installed. Also, the determined Folder with Spybot TeaTimer does not exist - even though it shows up in the hijack-log without the (file missing) entry...

I don't know what to do...
Title: Re: Avast 5.0.462 blocking internet connection
Post by: .: L' arc :. on April 03, 2010, 10:12:05 AM
Spyboy might've not been properly removed and causing conflict with avast.

1  Download OTL (http://oldtimer.geekstogo.com/OTL.exe)
2  Double click the icon to run
3  Under the Custom Scan box paste this in:

netsvcs
%SYSTEMDRIVE%\*.*
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
c:\windows\system32\*.dll /lockedfiles
c:\windows\system32\drivers\*.sys /lockedfiles
%systemroot%\*. /mp /s
CREATERESTOREPOINT


4  Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
5  When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
6  Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and paste them into your reply as an attachment.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: mkis on April 03, 2010, 10:34:17 AM
Given that info from Zyndstoff - Fix checked is the only option for that Spybot entry - get rid of it.

However the suspect entry is more likely the Real.com entry

127.0.0.1  real.com

Make some of move on this entry - fix checked
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

Sorry I didn't say, but after each fixed checked, you need to run Scan to bring up new log

and this too - fix checked
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll

If these is some app on board for Real.com - prob media player of some sort - then uninstall that also

Restart computer and run mbam quick scan (update first)


Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 03, 2010, 10:52:06 AM
We ran MBAM twice...  :( Nothing found.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: mkis on April 03, 2010, 08:54:01 PM
Is computer now clean?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Asyn on April 03, 2010, 10:21:10 PM
Is computer now clean?

I guess it was clean all along, but am not sure if he will post back after all that troubles. Let's see...
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 04, 2010, 12:17:29 AM
He (resp. his cousin) changed to MSE. He won't be back.
Yes it was always clean, no infection.
I am suspecting the HP-Printer drivers.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: mkis on April 04, 2010, 03:27:53 AM
He says he removed 1.7 GB (he actual said  1,7 GO)

http://forum.avast.com/index.php?topic=57853.msg488676#msg488676

Thats a big clean out, for me would usual mean a big tidy up ahead
system would need updating, some resets maybe, as well as usual like defrag, etc...
Start menu probably needs a bit of a clean out too, stop some programs running at boot

I think maybe had picked something in the running somewhere and maybe still something there

These two entries seemed suspect - something amiss - but I don't have time to look up
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll

Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 04, 2010, 09:41:41 AM
shdocvw.dll:
Microsoft Shell Doc Object and Control Library
Title: Re: Avast 5.0.462 blocking internet connection
Post by: mkis on April 04, 2010, 10:23:27 AM
yes other installs such as Real and Spybot will make use of shdocvw.dll: - from what I gather

Perhaps one of the guys will comment on the HjT log
- generally the old hats will leave well alone if they feel all that can be done is being done - and so far, no intervention
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 09, 2010, 05:51:52 PM
Hello,

After a week of testing: when the printer is disconnected, internet connection is working most of the time. So indeed the problem seems to come from the printer and unfortunately he is going to live with it because it was to difficult to configurate the printer as he wanted in the first place.

Thanks again to everybody for your help.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 09, 2010, 07:31:46 PM
Thanks for the feedback!
What is the printer type, model and number?
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on April 10, 2010, 01:52:00 PM
This one : http://www.zdnet.fr/produits/test/hp-psc-2510-photosmart-39144225.htm
Title: Re: Avast 5.0.462 blocking internet connection
Post by: mkis on April 10, 2010, 03:51:35 PM
Hi mika_fra

there is a workaround which has proven successful with HP printers and scanners. The actual symptoms were high CPU usage, where one of the svchosts was taking all the CPU. The issue itself, which was meant to have been fixed by Microsoft, was related to Windows Update service. The information concerning the issue can be found on the following page -

http://ask-leo.com/how_do_i_fix_this_high_cpu_usage_svchost_virus_or_whatever_it_is.html

halfway down the page under the heading Another Temporary Solution
the link you want is  http://wuauclt.info/  and you choose  Reset, Repair and Reinstall Scripts
which brings you to this page  http://wuauclt.info/scripts.asp   - which is the one you want

I think this routine of three steps proved successful with HP printers and scanners mainly because it flushes out 'software distribution' as part of reset, repair and reinstall of Automatic Updates service (you can read the script yourself).

I have used this workaround myself when a troublesome printer prevented me from accessing the internet, or at least, only enabled intermittent internet access like you say you have. So I have used the solution and it has worked for me. I still use the computer at times, and I haven't had a problem with it since.

but read the page carefully,
especially the part at the bottom under the heading Common Mistake - Not Changing the File Type in Notepad

The main thing, because this is a common routine, it cannot harm yr computer. But if you proceed, ensure anyway to backup first or at least enable yr computer to be restored to the time previous to running the 3 step routine. also, you can have a look and question and answer here before making a move. But it has worked for me, and there does not appear any alternative workaround to solve yr problem.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: scythe944 on April 12, 2010, 04:14:54 PM
Hey Mika_fra,

You could easily remotely access his PC using tools such as: http://teamviewer.com/index.aspx?split=A

Just download the program and start the free version, have him do the same.

Just call him up and get the number that is displayed on his teamviewer client and the password.  Type it into your teamviewer program and voila, instant access.

Oh, and HP printers are a pain in the butt.  ;D
Title: Re: Avast 5.0.462 blocking internet connection
Post by: EN_AMRR on May 04, 2010, 10:03:06 PM
my brother
sysan
i have some problem concet avst internet to interne

try  open avst program
2- select firwawll
3- setting
4- police
4-select tru to internet counction shared mode and list box select allow


if countinuos problem   do in same steps   and select network   and clice no outmatic profile

my   syb if continus problem
select prprities  networks and click no firwall avast



amr
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on May 09, 2010, 05:32:34 PM
Hey Mika_fra,

You could easily remotely access his PC using tools such as: http://teamviewer.com/index.aspx?split=A

Just download the program and start the free version, have him do the same.

Just call him up and get the number that is displayed on his teamviewer client and the password.  Type it into your teamviewer program and voila, instant access.

Oh, and HP printers are a pain in the butt.  ;D

Thanks so much. It is very helpful. 

I am gonna try all the other solutions next week and keep you informed. Have a nice Sunday
Title: Re: Avast 5.0.462 blocking internet connection
Post by: Mika_fra on May 14, 2010, 12:37:13 AM
Hi mika_fra

there is a workaround which has proven successful with HP printers and scanners. The actual symptoms were high CPU usage, where one of the svchosts was taking all the CPU. The issue itself, which was meant to have been fixed by Microsoft, was related to Windows Update service. The information concerning the issue can be found on the following page -

http://ask-leo.com/how_do_i_fix_this_high_cpu_usage_svchost_virus_or_whatever_it_is.html

halfway down the page under the heading Another Temporary Solution
the link you want is  http://wuauclt.info/  and you choose  Reset, Repair and Reinstall Scripts
which brings you to this page  http://wuauclt.info/scripts.asp   - which is the one you want

I think this routine of three steps proved successful with HP printers and scanners mainly because it flushes out 'software distribution' as part of reset, repair and reinstall of Automatic Updates service (you can read the script yourself).

I have used this workaround myself when a troublesome printer prevented me from accessing the internet, or at least, only enabled intermittent internet access like you say you have. So I have used the solution and it has worked for me. I still use the computer at times, and I haven't had a problem with it since.

but read the page carefully,
especially the part at the bottom under the heading Common Mistake - Not Changing the File Type in Notepad

The main thing, because this is a common routine, it cannot harm yr computer. But if you proceed, ensure anyway to backup first or at least enable yr computer to be restored to the time previous to running the 3 step routine. also, you can have a look and question and answer here before making a move. But it has worked for me, and there does not appear any alternative workaround to solve yr problem.

Hello,

I tried that and it did not work. I think now is time to really give up. Thanks again for your help everybody
Title: Re: Avast 5.0.462 blocking internet connection
Post by: homi on April 19, 2011, 03:40:51 PM
hi zyndstoff, or anybody else

have avast 6.00, webschield blocks internet access
win 7 32 bit+SP1
have already deinstall avast with the avast uninstall tool and install is again
problem stayed :-[

here is my log file

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:27:30 AM, on 4/19/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\XDOCK\XWD.exe
C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
C:\PROGRA~1\Bandoo\Bandoo.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe
C:\PROGRA~1\Bandoo\BndCore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
C:\Users\Homi\Desktop\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\ToolBar\searchqudtx.dll
O2 - BHO: UrlHelper Class - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\PROGRA~1\WIA6EB~1\Datamngr\IEBHO.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Bandoo IE Plugin - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Program Files\Bandoo\Plugins\IE\ieplugin.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\ToolBar\searchqudtx.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [TrueImageMonitor.exe] "C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\WIA6EB~1\Datamngr\DATAMN~1.EXE
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: XWindows Dock.lnk = C:\XDOCK\XWD.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\progra~1\wia6eb~1\datamngr\datamngr.dll c:\progra~1\wia6eb~1\datamngr\iebho.dll c:\progra~1\bandoo\bndhook.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Acronis Nonstop Backup service (afcdpsrv) - Acronis - C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - Unknown owner - C:\Program Files\AVAST Software\Avast\afwServ.exe (file missing)
O23 - Service: Bandoo Coordinator - Bandoo Media Inc. - C:\PROGRA~1\Bandoo\Bandoo.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--
End of file - 8050 bytes



Title: Re: Avast 5.0.462 blocking internet connection
Post by: Zyndstoff (aka Steven Gail) on April 19, 2011, 07:14:56 PM
Set as screenshot, reboot and try again.
Title: Re: Avast 5.0.462 blocking internet connection
Post by: StaffyOwner on May 23, 2011, 08:25:24 AM
Hi Mods/Admin/Avast dudes,

My Name is Rob and I'm running 'Windows 7 Ultimate' was 'FireFox' + 'Chrome', a day or 2 ago I downloaded something called Ilivid player, I scanned the download with Avast, plus googled the website an player name to check it was safe. My Avast is upto date, its set to Auto update virus defs and program, but still somehow I got something(malware?) called 'Searchqu' a 'rootkit bundle', think they(WhattheTech) said it comes with something called 'bandoo'?.
Straight after the ilivid player downloaded I noticed a unwanted/unaccepted 'free smileys' logo had appeared on my desktop and I knew it wasn't a good sign, then I clicked either Chrome or Firefox and my home page had changed to 'Searchqu' same for both browsers, straight away I new it was a virus so I got to google, google'd it and researched enough to remove it with 'ComboFix'. Also for safety I uninstalled 'FireFox' and 'Chrome' what had both been affected, and installed IE9 and Opera(which are much faster, didn't know:-)).
Anyway I was wondering how come my Avast 'Free' didn't stop it or find it in the scan? So I came here to see what Avast said about this 'Searchqu malware' that I jst got, then when I searched it here, this was the only thread that came up, and it('Searchqu') was highlighted in the guys(Homi's) post above in his log file:o, so sh*t he's been infected by it too then, its meant to be real nasty.
Yeah maybe you should email the guy if he doesn't come back to this thread? Think he's pretty lucky this worked out like this if he doesn't know hes got it, lol? Crazy hu, he only posted a few days ago too.

Anyway have you guys heard of this 'Searchqu' virus/malware(not sure of the difference?) and would your Avast Pro stopped and sorted this 'Searchqu'? Wondering whether to now upgrade Avast or get Malwarebytes or something? Whats our advice?

Edit, A little more info, my system 32 bit and Avast 6, also just looked at that guys log file and he's got 'Bandoo' and someone told me to try to remove the program called 'DataManager' or DataMngr'? Could be the virus? I removed all of it though, all 'Searchqu' , 'Free Smileys thing' Ilivid player' all of it. All seems good now :-)

Thanks, hope all goes well, take care.

Rob.