HELP - avast!: Internet Connection Timeout notices

[WiccaMagic]

Good evening!
 
I am hoping you can help me.
 
I am using Windows XP, with the Firefox browser (1.5.0.2) as my default browser.  I have Avast 4.0 Personal edition on my computer.  About 3 days ago, I started getting the following message from my Avast program (and it pops up about every 20 seconds - NO exaggeration!):

 
avast!: Connection Timeout!
Internet connection timeout elapsed.  Continue waiting?
(firefox.exe -> 206.165.97.120:110)


The thing is I *am* connected to the internet via cable connection and I am able to surf the web, answer IM's, send email, etc... so I know it's not really a connection timeout, or I would not be able to do these things WHILE I am getting this avast! message.

Every time I get the message (which YES, is about every 20 seconds!!  very very annoying) I tell it yes, to continue waiting, however even if I tell it NO, it still gives me the popup notice.  I have gone to your site and tried reconfiguring both my Firefox and my Avast, with NO luck - still getting the popup message.   When I do the configurations for firefox based on your instructional video it makes my Firefox not connect to the internet.  I now have the Web Shield OFF and it is STILL giving me the popup message.  Just while writing this message to you the message has popped up 25 times (I counted).   HOW do I get it to STOP?    It is driving me INSANE!!!!!!    
 
I like Avast - it is one of the better AV programs out there, but this has GOT to stop.  I have been reduced to screaming at the computer because of the pop-ups, and I can't get much accomplished because I'm having to stop every 20 seconds to respond to the pop-ups.
 
 
HELP!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
        :'(

[Lisandro]

If you're not infected and you're not browsing 'dangerous' sites, you shouldn't seeing this message.
Did you run a boot time scanning with avast to see if you're clean?
Which sites were you browsing when the message came?
Did you change the default proxy or port settings both into avast and your Internet options?

[WiccaMagic]

I'm not infected - Avast has been doing really good about catching things.  As to what sites am I visiting - checking mail in Gmail, or checking my groups at yahoogroups, or even when I was writing the message for this forum - doesn't matter what site I'm on, it does it regardless.  As for the internet settings for Firefox and Avast, I set them based on the info at the Avast site, and it didn't change anything - still get the messages.  Altho I didn't run a boot time scan, I do have the Avast running in the background constantly (according to the on-access scanner it is  is running 5 providers) and its not saying its catching an viruses - just that its "timing out" my internet connection... which I don't understand.

[Lisandro]

Can you post a screenshot of the message?

Are you sending/receiving email at this time?
Do you use a spam killer application?
Do you use Azureus (P2P application)?

[WiccaMagic]

here is the screenshot of the message - and it always says the same exact thing.

[WiccaMagic]

and no... never even HEARD of Azureus (sp?) so don't think I'm using that, and no to the spykiller question.  I run Ad-aware and Spy-Bot scans bi-weekly but they are NOT on constant scan like Avast is.

[Lisandro]

here is the screenshot of the message - and it always says the same exact thing.

Firefox is connecting the port 110 to download email... strange...
If you add the line:
IgnoreProcess=firefox.exe
at the [MailScanner] section of avast4.ini file the timeout will disappear.
You can see details clicking 'Settings' in my signature or clicking here: http://forum.avast.com/index.php?topic=1647.msg10267#msg10267

This will avoid the Mail Scanner to scan emails at firefox.
Your email (through webmail or through any email program) will be safe. Your firefox browsing will be safe.
Just that your firefox won't be scanned for email at the specific port 110.

Which extension of firefox could be using this port to get email?

[WiccaMagic]

LOL  don't know, considering I am ONLY getting the message for firefox - not for ANY of my other programs, and I use Incredimail to retrieve/send my email, so I'm not even really using Firefox for email purposes (except to empty gmail trash every few days or so).  However it is doing it even when I am on a non-email site, like this forum.  (And oddly enough, NO messages for anything related to Incredimail, which, if anything, I would have expected!)

I will make the changes that you suggested and see what happens.

Thank you, and I'll be in touch.

[Lisandro]

I will make the changes that you suggested and see what happens.

Most probably you need to save avast4.ini file and boot before experiencing the changes.
I bet that some firefox extension is trying to check mail at port 110.

[WiccaMagic]

I read that and thought "I wonder if that's it"....I have firefox set to automatically check and download for updates for extensions/plugins, etc.... so I checked and had a few that needed to be downloaded, so did those.  However still getting the messages.... where do I find the ini file and where exactly do I edit it?

[WiccaMagic]

I re-read your forum/settings post, found the ini file (did a search for it), put in the comment about IgnoreProcess=firefox.exe (after the MailScanner area) and rebooted the computer... have been back 'up' for about 3 minutes, and so far no messages.  Not sure what to expect tho.... LOL

Will keep you posted.  If you don't hear back from me, then I'm not getting them anymore.

[alanrf]

You will not see the messages anymore but if it were my system I would not be happy about that.

Something in your system is doing something it should not be doing - Firefox does not access port 110.  So, you could have some plugin or extension installed with Firefox that has hijacked Firefox to do - who knows what?

I would suggest that you run the usual helpers, AdAware, Spybot and Ewido.  A good look at a "HijackThis" scan would probably be a good idea too. 

[WiccaMagic]

After I rebooted, and posted my last post to you all, I was trying to think what extensions I had added recently to Firefox that might have anything to do with email, and I went through my extensions and I think I found it ... they have a fairly new extension called Email_Notifier Toolbar, which, when set, will automatically let you know when new mail has arrived in your mailbox, and it will periodically connect to your box to update the amounts.  It was trying to connect to my yahoo and my inbox.com accounts, and failing - which were the times it was getting the "timeout" messages.  So I removed the 2 accounts that were failing and lo and behold - no more messages.  I didn't put it together at first until I starting thinking "yea, which extension WOULD be trying to connect to a port like that?" and then it dawned on me.  I feel so dumb because it took so long to figure it out.  However, to be on the safe side I am still going to run both Ad-aware and Spy-Bot (ran the AV scan yesterday in the middle of all those messages, so I know there isn't a virus, and the list is updated automatically).  I have never heard of Ewido - what is it, and where can I find it?

[alanrf]

First off ... let's forget the "feel so dumb" part ... many of us would not have put 2 and 2 together in a month of Sundays. 

It certainly sounds like you may have found the cause. 

While I am also a user of Firefox (and Thunderbird) and some of the extensions - by their very nature they are provided by not-for-profit (or perhaps, less kindly, amateur) developers.  Many of the extensions are outstanding additions to the base products - some are less so.  I have not tried the Email_Notifier toolbar and I do not wish to sound overly critical but if they take more than 2 minutes (the default avast timeout) to decide that they cannot connect to a mail server - well they better go back to the drawing board.     

Ewido is, I believe, one of the more highly rated malware detection products (for users on the Win XP system).

http://www.ewido.net/en/

It has been recommended frequently in this forum as a useful addition to avast in your list of tools to try to keep the bad guys at bay.  It provides an online scan tool which (while only running under IE) will help ensure that any malware that make it through your defences is detected.