avast!: Connection timeout

[JohnnyBob]

I'm reluctant to get involved with these tech problems. It takes a lot of work, and I'm busy otherwise
already, but here goes...

Q: Are you using any peer to peer connection such as azureus or utorrent?
A: Not that I'm aware of, but I don't really know what you mean - except as mentioned in this thread above.
I've searched and found one instance of javaw.exe on my computer under C:\Program Files\PC-Doctor for
Windows\jre\bin, which is one of the utilities provided by this computer manufacturer, Compaq. However I
rarely if ever use PC-Doctor, and as far as I know it is inactive otherwise.

Q: Have you made any change to the default ports being monitored by the avast Internet Mail scanner?
A: No, not intentionally, because I wouldn't know how or where to change them! Those kinds of technical
details are over my head.

Q: Is your mail client permanently active ... if so can you please advise the client used?
A: I don't know what you mean by "permanently active". I use a dialup connection, so it's active when I'm
online. My email software (client, presumably) is Outlook Express 6, which comes with Windows XP Home (SP2)
and all the latest updates. I use it 95% of the time with POP3/SMPT, or (SSL) POP3/SMTP with gmail.com, and
only occasionally use Internet Explorer webmail interfaces such as provided by gmail.com, earthlink.net, etc.

Q: I just find out that the extra info (program and address) is by mistake not displayed if user disabled the
mail icon (in Internet Mail/page Advanced). Is it your case?
A1: I am using the Normal sensitivity setting for Internet Mail, and have not made any customizations. If you
mean: "Show tray icon when scanning mail", that box is not checked under Resident Task Settings, Advanced tab.
However I didn't uncheck it, as best I can remember, so that must be how it installed by default. I disabled
the tray icon and sliding box, and run updates in Silent mode, under avast! settings, Update Basic, Details
button. That's because they started to become an annoyance.
A2: I'll try checking the "Show tray icon when scanning mail" box and see if that makes any difference. But
will that work if I leave the slider on Normal sensitivity? Or do I need to move the slider to Custom? As you
can see, I am not an expert on avast! Maybe I'll make a long study of it someday, but am normally pretty busy
otherwise.

As you can see, checking that box worked to insert the extra information...



However the unwanted avast! connection timeout popup is continuing to appear frequently, a major annoyance, so
that didn't fix my problem.

Now herebelow is a portion of the AswMaiSv.log you requested. I had to cut it off to fit into your 10000
character maximum here. You can have the whole 128KB log via email if you want it. I am automatically polling
many different email addresses and domains every xx minutes with Outlook Express including earthlink.net,
gmail.com (SSL), all2easy.net/all2ez.net), dialup.cc, and a private domain which I don't want to mention in
public here. Offhand I don't see the dialup.cc domain in the log; it is not connecting, and apparently causes
the unwanted timeout popups.

02/01/06 09:24:04 000007F0:   Started as serice, Log = 20(0x00000014)
02/01/06 09:24:04 000007F0:   Build 4.6.763
02/01/06 09:24:04 000007F0:   Windows XP Workstation (Service Pack 2)
02/01/06 09:24:04 000007F0:   Using WinSock 2.0
02/01/06 09:24:04 000007F0:   PID = 1988(0x000007C4)
02/01/06 09:24:04 000007F0:   Tray icon settings changed 0(0x00000000)
02/01/06 09:24:04 000007F0:   AutoRedirect settings changed 1(0x00000001)
02/01/06 09:24:04 000007F0:   IgnoreAddress set
02/01/06 09:24:04 000007F0:   IgnoreProcess set
02/01/06 09:24:04 000007F0:   IgnoreProcess set avast.setup,winroute.exe,ccEvtMgr.exe,ccPxySvc.exe,ccProxy.exe,ccApp.exe,ccPwdSvc.exe,ccSetMgr.exe,ccLgView.exe
,SMPROXY.EXE,isafe.exe,TMPROXY.EXE,EMULE.EXE,WEBPROXY.EXE,NAVAPW32.EXE,SYMPROXYSVC.EXE,NETMONSV.EXE,CRAXY.EXE,
CZDCPlusPlus.exe,ABC.EXE,mpftray.exe,bitcomet.exe,V3P3AT.EXE,ypager.exe
02/01/06 09:24:04 000007F0:   IgnoreProcess set avgemc.exe
02/01/06 09:24:04 000007F0:   IgnoreLocalhost settings changed 1(0x00000001)
02/01/06 09:24:04 000007F0:   POP Start settings changed: 1
02/01/06 09:24:04 000007F0:   POP Listen settings changed: 127.0.0.1 12110
02/01/06 09:24:04 000007F0:   POP Listening daemon starting
02/01/06 09:24:04 000007F0:   POP Listen handler: 0x000000F4
02/01/06 09:24:04 000007F0:   POP RedirectPort: 110
02/01/06 09:24:04 000007F0:   Redirect set 110->127.0.0.1:12110
02/01/06 09:24:04 000007F0:   IgnoreLocalAddresses set 110
02/01/06 09:24:04 000007F0:   POP Listening daemon started
02/01/06 09:24:04 000007F0:   SMTP Start settings changed: 1
02/01/06 09:24:04 000007F0:   SMTP Listen settings changed: 127.0.0.1 12025
02/01/06 09:24:04 000007F0:   SMTP Listening daemon starting
02/01/06 09:24:04 000007F0:   SMTP Listen handler: 0x000000F8
02/01/06 09:24:04 000007F0:   SMTP RedirectPort: 25
02/01/06 09:24:04 000007F0:   Redirect set 25->127.0.0.1:12025
02/01/06 09:24:04 000007F0:   IgnoreLocalAddresses set 25
02/01/06 09:24:04 000007F0:   SMTP Listening daemon started
02/01/06 09:24:04 000007F0:   IMAP Start settings changed: 1
02/01/06 09:24:04 000007F0:   IMAP Listen settings changed: 127.0.0.1 12143
02/01/06 09:24:04 000007F0:   IMAP Listening daemon starting
02/01/06 09:24:04 000007F0:   IMAP Listen handler: 0x000000FC
02/01/06 09:24:04 000007F0:   IMAP RedirectPort: 143
02/01/06 09:24:04 000007F0:   Redirect set 143->127.0.0.1:12143
02/01/06 09:24:04 000007F0:   IgnoreLocalAddresses set 143
02/01/06 09:24:04 000007F0:   IMAP Listening daemon started
02/01/06 09:24:04 000007F0:   NNTP Start settings changed: 1
02/01/06 09:24:04 000007F0:   NNTP Listen settings changed: 127.0.0.1 12119
02/01/06 09:24:04 000007F0:   NNTP Listening daemon starting
02/01/06 09:24:04 000007F0:   NNTP Listen handler: 0x00000104
02/01/06 09:24:04 000007F0:   NNTP RedirectPort: 119
02/01/06 09:24:04 000007F0:   Redirect set 119->127.0.0.1:12119
02/01/06 09:24:04 000007F0:   IgnoreLocalAddresses set 119
02/01/06 09:24:04 000007F0:   NNTP Listening daemon started
02/01/06 09:24:04 000007F0:   Ignored PIDs: 1988
02/01/06 09:24:04 000007F0:   Ignored Addresses: 127.0.0.1:119 127.0.0.1:143 127.0.0.1:25 127.0.0.1:110
02/01/06 09:24:04 000007F0:   Ignored Processes: avgemc.exe ypager.exe V3P3AT.EXE bitcomet.exe mpftray.exe
ABC.EXE CZDCPlusPlus.ex CRAXY.EXE NETMONSV.EXE SYMPROXYSVC.EXE NAVAPW32.EXE WEBPROXY.EXE EMULE.EXE TMPROXY.EXE
isafe.exe SMPROXY.EXE ccLgView.exe ccSetMgr.exe ccPwdSvc.exe ccApp.exe ccProxy.exe ccPxySvc.exe ccEvtMgr.exe
winroute.exe avast.setup
02/01/06 09:29:00 000000F4:   POP accept connection from: 127.0.0.1
02/01/06 09:29:00 000000F4:   Connection handler: 0x000003E8
02/01/06 09:29:00 000003E8:   Ignored PIDs: 1988
02/01/06 09:29:00 000003E8:   Ignored Addresses: 127.0.0.1:119 127.0.0.1:143 127.0.0.1:25 127.0.0.1:110
02/01/06 09:29:00 000003E8:   Ignored Processes: avgemc.exe ypager.exe V3P3AT.EXE bitcomet.exe mpftray.exe
ABC.EXE CZDCPlusPlus.ex CRAXY.EXE NETMONSV.EXE SYMPROXYSVC.EXE NAVAPW32.EXE WEBPROXY.EXE EMULE.EXE TMPROXY.EXE
isafe.exe SMPROXY.EXE ccLgView.exe ccSetMgr.exe ccPwdSvc.exe ccApp.exe ccProxy.exe ccPxySvc.exe ccEvtMgr.exe
winroute.exe avast.setup
02/01/06 09:29:00 000003E8:   --POP command REDIRECT 64.202.165.92:110 624
02/01/06 09:29:00 000003E8:   PATH: \Device\HarddiskVolume1\Program Files\Outlook Express\msimn.exe
02/01/06 09:29:00 000003E8:   Connected to POP server 64.202.165.92 110
02/01/06 09:29:00 000003E8:   received 53(0x00000035)
02/01/06 09:29:00 000003E8:   <-POP  +OK <31497.1138807740@pop04.mesa1.secureserver.net>
02/01/06 09:29:00 000003E8:   sent 53(0x00000035)
02/01/06 09:29:00 000003E8:   received 1(0x00000001)
02/01/06 09:29:00 000003E8:   received 1(0x00000001)
02/01/06 09:29:00 000003E8:   received 1(0x00000001)
02/01/06 09:29:00 000003E8:   received 1(0x00000001)
02/01/06 09:29:00 000003E8:   received 1(0x00000001)
02/01/06 09:29:00 000003E8:   received 1(0x00000001)
02/01/06 09:29:00 000003E8:   received 1(0x00000001)

Whatya think?
JohnnyBob

[PatP3005]

Jumping into the fray here...be nice...I have recently started getting these timeout popups also. Probably for the past week. Like JohnnyBob, sometimes its every 2-3 minutes, other times, its twice a day. I am not aware of any changes I have made to my system, but that doesn't mean I haven't. I took a picture of my error message but have spent WAY more time than I have, trying to attach it to this, so here's a direct quote from the pop-up:
"Internet connection timeout elapsed. Continue waiting? (OUTLOOK.EXE -> ip-my ip address inserted here.secureserver.net:110)" Yes No
I have broadband/cable. My internet connection is not timing out, I'm staying connected. And I stay connected continuously.
One thing that just occurred to me (and is over my head), I use AVAST Anti-Virus and for about 1-1/2 weeks after the sweep (I sweep every night) it would give me a message about a possible rootkit. Tech support at Avast said they were working on it and would send the patch asap. My sweep last night did not reveal a rootkit so I'm assuming they got that worked out. Because of that, I ran a thorough sweep using Avast (took 4 hours!) today and it found no problems. I'm still getting the pop-up though.
I'm using WinXP, IE 6, don't know what else to stay. Thanks to anyone who can offer some help.
Pat

[JohnnyBob]

Thanks for commenting. It's always nice to know someone else is having the same problem...

My wayward email account with dialup.cc started connecting again.

Also I went into:

--On-access Protection Control
--Internet Mail
--Customize button
--Advanced tab

and selected the radio button for "When this time is over: shutdown connection". I also unchecked the box for "Show tray icon when scanning email" because I really don't want to see it. My timeout there is set for 120 seconds. whereas the timeouts set in my email software (Outlook Express) are for 60 seconds.

With my fingers crossed, I can say that so far I haven't had another avast timeout popup.

Good luck with yours,
JohnnyBob

[alanrf]

JohnnyBob,

While I have not seen the complete log you created of your mail connections I am fairly sure that I know what happened. 

While I understand that you do not want to be bored with technical details maybe a high level view may help you adjust your timeout values appropriate for your needs and assist you in knowing what is going on when you see another timeout from Outlook Express. 

Since you are on a dialup connection remember that, even if OE has exclusive use of the connection the maximum amount of data you can transfer is about 6Kb a second or 360Kb a minute.  Also, files sent as email attachments actually become quite a bit larger than their real size when they are encoded to make it possible to send them through email systems.

When the avast email scanner is active it actually fools OE into thinking that avast is the email server.  avast sends your login credentials to the email server and then it monitors all the POP3 activity of OE.  When OE requests that a message be retrieved from the server it is avast that gets all the message blocks and it then caches them on your system until the whole email is received.  It then can disect the message parts and ensure that none of the message parts is infected.  Assuming the message is not infected it then passes the complete message back to OE.

By the way, I am certain that there have been no issues about connecting to the POP3.dialup.cc mail server.  If there were avast would not wait around for 120 seconds it would return the error immediately to OE.  This was confirmed by some tests I carried out with that server today.

Without seeing your complete log I am fairly certain the scenario went like this:

Remember at this time you had your OE timeout set higher than the 120 seconds timeout in avast.

At some point (coincident with when you started to see these timeouts) someone sent you an email to your account at dialup.cc with a large attachment let's just guess at 800Kb.

When you started OE it processed your mail accounts (one at a time as it does) and eventually it got to the dialup.cc account.  OE asked for the first unread message to be retrieved (the one with the large attachment).  avast intercepted the message blocks and in two minutes was only able to read about 720kb of the message so the message was still incomplete.  Then the timer popped and you got the message asking you if you wanted to wait.  I assume you said no and the connection to POP3.dialup.cc was terminated.

OE of course will keep trying to access your account again and again, that it what it is supposed to do and the whole process repeated itself.  And it can go on for days. 

Many ISPs have a retention policy for unread mail and will simply delete it after a period.  If that happened with this particular message then at a point in time you would find that suddenly are able to read the messages from that account again.  Some confirmation of this scenario would be that you would find, once this "blockage" was removed, the first few message you were able to read might be older than you would expect.   

To draw this to a close I think that your policy of keeping the OE timer slightly lower than avast timer is a good one.  Only you know what size attachments you typically need to send and receive with your email.  I have advised a couple of folks on dial up that I support to set their avast timeout to 300 seconds while keeping their mail client timers slightly lower.  That still allows them to get and send reasonably large email attachments without being plagued with warnings. 




       

[alanrf]

PatP3005,

can I ask for a clarification of:

OUTLOOK.EXE -> ip-my ip address inserted here.secureserver.net:110

When you say "my ip address inserted here" do you mean the ip address of your own system?

[JohnnyBob]

My Dialup.cc email account is inactive. I've never given it to anyone. There's a chance I might receive an email today from their tech support, but it would probably be a small plain text email, no large attachments likely.

After their email system came up again, I checked via their webmail interface and nothing was in my inbox. So I believe that email account was refusing to connect because their server was offline. Their website also would not connect at the same time.

What's wrong with turning off the avast! internet connection timeout completely (uncheck that box on the Advanced tab)? Why do I need it? It seems superfluous to me. I would presumably still get Outlook Express popups to let me know when there's a problem polling an email account. Also presumably there would not be a problem with large email attachments. In other words, just let Outlook Express do its thing.
JohnnyBob

[alanrf]

I was expecting that question.  I did not respond to it unasked since my last response was getting rather long.

Just as an aside ...

If a POP3 server is inaccessible (POP3.dialup.cc was available every time I attempted to connect to it today) then OE will give you an instant response to that effect - that's just the way the POP3 protocol works.

As I mentioned in an earlier post the mail scanner timeout has been the only indication for some avast users that they have allowed their machines to become infected with malware that is using their machines to send out vast amounts of spam email.  These infections typically have their own email engine built in and so do not use the email services like Outlook Express.  They just sit there connected to a server using the resources of a system to generate the spam and stay connected as long as the system is running (one user found that he was sending in excess of 500 messages a minute - a high speed connection of course) and now for some ISPs a breach of the terms of service.   

A typical infection would be seen in the avast timeout with a message like:

winlogon.exe -> some.mailserver:25

Without avast warning of the long connection period these users would be unaware of the actions of their systems. 

Such a problem is never going to be reported by Outlook Express.  What appears to be superfluous to you has been an advantage to many.   

You are the master of your system, one of the good things I appreciate about avast is that it provides you a great deal of control over its actions and allows you to decide the level at which you want it involved in the running of your system.  I wish you success with your choices.   

[JohnnyBob]

Thanks for the explanation. I understand, I think. I suppose it must be a change in the last program version of avast!

I scan regularly with, or use, several different malware detectors for that purpose such as A2,  Ad-aware, Spywareblaster, Spybot-S&D, as well as avast! complete system scans. So I'll take the risk and turn off the avast! internet connection timeout function - now that I know how to do it (I think)...

I have another question but it's in a completely different vein, so will start a new thread.
JohnnyBob

[PatP3005]

I'm sorry, I don't really know what my IP address is, but I assumed it was referring to mine. And after re-reading my post I realized I was getting my programs mixed up. I do daily sweeps with Spysweeper and IT was giving me the rootkit problem message. Once it stopped giving me that message, I did a thorough scan with Avast. Today, clean sweep last night with Spysweeper, still getting Avast timeouts. I haven't read the other posts yet, but it appears others are having this problem as well?

[galooma]

@pat  if you fear you have a rootkit it might be worth running blacklight  http://www.f-secure.com/blacklight/
this will make progress a lot faster if indeed you are infected by a rootkit.

[PatP3005]

Thanks for the suggestion. I did download Blacklight(?) and run it. It didn't find anything. As I had said, I think Spysweeper finally found it and got rid of it. I'm at a loss. I guess we'll just have to wait while Avast works on this. I say this because I don't think I changed anything. Just don't know....

[alanrf]

PatP3005,

a few questions if I may,

1) What kind of connection to the Internet are you using (dialup, DSL, Cable etc)?

2) Do you have a POP3 email account (in your Outlook email accounts) with an email server that has secureserver.net as part of its name?

3) Can you follow the instructions I posted earlier in this thread to create a more detailed log of your connection?  That should help to give us a better idea of why your connection from Outlook is persisting so long and what it is doing. 

4) Please go to the avast Internet Mail provider, click on Customize then select the Advanced tab and please advise of the timeout value you see there.

[vojtech]

Check avast plugin in Outlook: http://forum.avast.com/index.php?topic=12691.0

[alanrf]

vojtech correctly points out that with Outlook (at least the more recent versions) you can use the vast Outlook plugin and then do not need to use the Internet mail scanner for your Outlook mail at all.  Then the only timer you'll be working with will be the timer in Outlook itself. 

It does not necessarily mean that your problem will go away but it means that avast will be totally off the hook to answer the problem.


 

[JohnnyBob]

I decided to try the 600 seconds setting for the Internet Connection timeout (Internet Mail) with my Outlook Express and dialup modem as was suggested above, but am still getting occasional unwanted popups. There's no rhyme or reason to it. I'm not doing anything. No email or internet traffic is flowing. It just pops up at odd times, apparently at random. So I really have no choice but to disable it entirely by unchecking that box under Customize > Advanced tab.
JohnnyBob