error

[tpm]

Hi,

since the last update (of the program) of my avast home edition, I got following error when opening my browser. My browser does not display my homepage. When I click on the homepage button, then it displays my homepage, but when I open my browser for the first time, I got this. Can anyone help me with this ?

Many thanks.

The page cannot be displayed
There is a problem with the page you are trying to reach and it cannot be displayed.

Please try the following:

    * Click the Refresh button, or try again later.
    * Open the Web site home page, and then look for links to the information you want.
    * If you believe you should be able to view this directory or page, please contact the Web site administrator by using the e-mail address or phone number listed on the Web site home page.

HTTP 502 - Gateway timeout
avast! Web Proxy

The proxy server did not receive a correct response from the upstream server specified by URI or the response was not understood by proxy.

Winsock: (997) Overlapped I/O operation is in progress.

GET http://1/
Winsock: (997) Overlapped I/O operation is in progress.

[Eddy]

You need to allow ashwebsv.exe in your firewall.
Did you do that?

And what OS are you using?

And have you already read THIS THREAD?

[tpm]

I use Windows XP SP2 and Firefox 1.0
When I first open my browser my homepage URL is wrong.
It says: http://1/
instead of my normal homepage. When I click my homepage button, the url is correct and my homepage dusplays normally.

[Eddy]

I suggest you make sure your system is clean.
Click on the link in my signature and follow the instructions in the malware removal section.

[lukor]

tpm, Eddy suggests you right - your system possibly is / was infected by some malware which set your homepage incorrectly.

BTW: next time please use some meaningfull subject - something like: "Invalid homepage http://1/" should work - some other really lame subjects might include: "Help Me!" and "Question". 

[tpm]

I tried all anti-spyware programs there are. No results. Still the same remaining thing. There is nothing changed at my homepage, like I said before. It is only the first time I start my firefox. When I click on the homepage button, the correct homepage appears. Nothing of malware or spyware...

[Eddy]

Please post a HijackThis log here and let us have a look.

[tpm]

Here is my log:
Logfile of HijackThis v1.99.1
Scan saved at 19:59:07, on 1/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Trust\350 Series Mouse\mouse32a.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\TSIRCSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HJTanalyzer\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ludit.kuleuven.be/internet/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\system32\pavdr.exe,C:\WINDOWS\system32\userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: rxh - {19AD8203-1538-43a0-848B-D136782E09DE} - C:\Program Files\Dolphins Show Screensaver\rxh2.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: C:\WINDOWS\lbbho.dll - {96CD8D62-6252-4BA9-808A-FB319C43686C} - C:\WINDOWS\lbbho.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll (file missing)
O2 - BHO: TChkBHO Class - {F24C4C15-FE68-47B2-8751-424E8795F300} - C:\WINDOWS\system32\yilim.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Trust\350 Series Mouse\mouse32a.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [foster] C:\WINDOWS\system32\msnmsgr60.exe
O4 - HKCU\..\Run: [foster] C:\WINDOWS\system32\msnmsgr60.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15007/CTSUEng.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093020519709
O16 - DPF: {6FB1D10C-6D30-4940-80F6-4F5F9D314976} (Prefill.UC) - https://postbox.be/activex/Prefill.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://virusscan.zdnet.be/housecall/xscan53.cab
O16 - DPF: {94118C19-B178-4E43-BBE8-0EFDBB391BDB} - http://www.sponsoradulto.com/en/SysWebTelecom.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebSWK.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (Omega 1.6177) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TSI Remote Control Service (TSIRCSRV) - LapLink, Inc. - C:\WINDOWS\System32\TSIRCSRV.EXE
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Eddy]

This is the result that my HJT log analyzer gives:

--------------------------------------------------------------------------------
THESE ARE EITHER HARMFULL OR A SECURITY RISK
WE STRONGLY RECOMMEND TO FIX THEM :
--------------------------------------------------------------------------------
r0 - hkcu\software\microsoft\internet explorer\main,local page =
r3 - default urlsearchhook is missing
o2 - bho: c:\windows\lbbho.dll - {96cd8d62-6252-4ba9-808a-fb319c43686c} - c:\windows\lbbho.dll (file missing)
o2 - bho: tgtsoft explorer toolbar changer - {c333cf63-767f-4831-94ac-e683d962c63c} - c:\program files\tgtsoft\stylexp\tgt_bho.dll (file missing)
o2 - bho: tchkbho class - {f24c4c15-fe68-47b2-8751-424e8795f300} - c:\windows\system32\yilim.dll (file missing)
o3 - toolbar: (no name) - {ba52b914-b692-46c4-b683-905236f6f655} - (no file)
o10 - broken internet access because of lsp provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
o16 - dpf: {01fe8d0a-51ad-459b-b62b-85e135128b32} (dd_v4.ddv4) - http://www.drivershq.com/dd_v4.cab
o16 - dpf: {0a5fd7c5-a45c-49fc-adb5-9952547d5715} (creative software autoupdate) - http://www.creative.com/su/ocx/15007/ctsueng.cab
o16 - dpf: {62475759-9e84-458e-a1ab-5d2c442adfde} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/quicktimeinstaller.exe
o16 - dpf: {6414512b-b978-451d-a0d8-fcfdf33e833c} (wuwebcontrol class) - http://v5.windowsupdate.microsoft.com/v5consumer/v5controls/en/x86/client/wuweb_site.cab?1093020519709
o16 - dpf: {6fb1d10c-6d30-4940-80f6-4f5f9d314976} (prefill.uc) - https://postbox.be/activex/prefill.cab
o16 - dpf: {74d05d43-3236-11d4-bdcd-00c04f9a3b61} (housecall control) - http://virusscan.zdnet.be/housecall/xscan53.cab
o16 - dpf: {94118c19-b178-4e43-bbe8-0efdbb391bdb} - http://www.sponsoradulto.com/en/syswebtelecom.cab
o16 - dpf: {99b6e512-3893-4155-9964-8eb8e06099cb} (webspywarekiller class) - http://download.zonelabs.com/bin/promotions/spywaredetector/webswk.cab
o16 - dpf: {b38870e4-7ecb-40da-8c6a-595f0a5519ff} (msnmessengersetupdownloadcontrol class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
o16 - dpf: {d719897a-b07a-4c0c-aea9-9b663a28dfcb} (itunesdetector class) - http://ax.phobos.apple.com.edgesuite.net/detection/itdetector.cab
o16 - dpf: {f6acf75c-c32c-447b-9bef-46b766368d29} (creative software autoupdate support package) - http://www.creative.com/su/ocx/15008/ctpid.cab
o16 - dpf: {fa3662c3-b8e8-11d6-a667-0010b556d978} (iwinampactivex class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
o23 - service: avast! mail scanner - unknown owner - c:\program files\alwil software\avast4\ashmaisv.exe" /service (file missing)
o23 - service: avast! web scanner - unknown owner - c:\program files\alwil software\avast4\ashwebsv.exe" /service (file missing)
o23 - service: mcafee securitycenter update manager (mcupdmgr.exe) - unknown owner - c:\progra~1\mcafee.com\agent\mcupdmgr.exe (file missing)

--------------------------------------------------------------------------------
THE FOLLOWING ITEMS ARE NOT NEEDED TO LOAD
AT BOOTIME FOR THE SYSTEM TO WORK PROPERLY:
--------------------------------------------------------------------------------
o4 - hklm\..\run: [sunjavaupdatesched] c:\program files\java\jre1.5.0\bin\jusched.exe
o4 - hklm\..\run: [tkbellexe] "c:\program files\common files\real\update_ob\realsched.exe"  -osboot
 
I strongly suggest you remove McAfee completely. Having 2 av's on one system can cause a lot of problems

[taco78]

I  sugest you leave this items.

o23 - service: avast! mail scanner - unknown owner - c:\program files\alwil software\avast4\ashmaisv.exe" /service (file missing)
o23 - service: avast! web scanner - unknown owner - c:\program files\alwil software\avast4\ashwebsv.exe" /service (file missing)

it is a known bug in Hijackthis to mark them as file missing.
I screwed up my installation repairing it.
I also suggest uninstalling mcafee viruscan because 2 viruscanners can conflict to eachother.
Here you can see windows is loading the files properly.
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

Taco

[tpm]

Hi,

just wanted you to know I found the solution. It had nothing to do with spyware or whatsoever. I have a Trust Wireless Optical Mouse 350WL. With my left button (on the side of the mouse), I start my default browser. With the latest release of the avast program I had those things (which I described in this topic) with startin my browser with that button. When I start my browser with the firefox desktop icon, there is no problem.
I uninstalled this mouse driver and installed it back again. Same problem :-(
But anyway, I know now it has to do with a combination of my mouse control program and avast (before the last program update of avast, there was no problem).
Thanks anyway for searching. (ps: I also re-installed my avast, just to be sure).

Kind Regards,

tpm

[taco78]

Just don't install mouse drivers/software it gave me headaches too. windows will handell the mouse just fine. Especialy logitech drivers are crap. it installs software wich I don't want, just wanted only a driver not software but it just installs a load of crap, and it makes logfiles in the root of the c drive wich also made piss me off, why no logfile in c:\program files\logitech wich a good coded program should do!

[Lisandro]

Just don't install mouse drivers/software it gave me headaches too. windows will handell the mouse just fine. Especialy logitech drivers are crap. it installs software wich I don't want, just wanted only a driver not software but it just installs a load of crap, and it makes logfiles in the root of the c drive wich also made piss me off, why no logfile in c:\program files\logitech wich a good coded program should do!

I won't say that each Logitech driver is bad.
They add functionality to the very simple Microsoft shipped with XP.
Works like a charm for me. No trouble. 
Different systems, different tastes... 

[tpm]

I understand. Windows does the mouse handling fine, but with the extra Trust  (not logitech) software (this is the software which made this conflict), I can use the extra three buttons on my mouse. With the standard microsft driver, I can't use these buttons.

[Lisandro]

Because of this...

With the standard microsft driver, I can't use these buttons.

I wrote this:

They add functionality to the very simple Microsoft shipped with XP.