IE7

[Lisandro]

Using ProcessGuard, and Ladbrokes only has permission to run.
Any idea what could be corrupted and how?

Isn't ProcessGuard blocking avast?

[DavidR]

I would take a look at processguard that can really get in the way of all sorts of installations. What have you got it protecting ?

I honestly can't see a reason for trying to install avast from safe mode, because if you install avast normally and boot into safe mode, avast isn't running until you manually start it. So based on that I don't know what the result of a safe mode install would be.

I gave up on the free version of it some time ago so I haven't looked at it in some time.

You could simply try to enter the line ZoneAlarmCompatibility=0 to the [WebScanner] section.

What does LadbrokesPoker do, what does it run, are you sure it is compatible with IE7 ?

Some time ago in the thread that you found via google, I said I thought that like many other default values in avast they aren't entered in the avast4.ini file, so I thought the same would be true of the ZA Compatibility (ZAC) value. The reason I thought this was ZAC value 0 means transparent proxy enabled which is the default state for the proxy. This however, was proven wrong, a) because ZA may not be your firewall and if there is no ZAC value and avast detects it at boot it will ask the question again.

Now it has been talked about to see if the ZAC check could be improved, if it were ZA Pro or Home and only ask the question if it was ZA Pro. I don't know if this has been implemented or not. I am to a degree a 'if it ain't broke don't fix it' man, since I can't confirm the ZAC line absolutely must be in the avast4.ini if you are using ZA I can't give a definitive answer.

[sputnik365]

Hi,

Using ProcessGuard, and Ladbrokes only has permission to run.
Any idea what could be corrupted and how?

Isn't ProcessGuard blocking avast?

No, and they have been happy together for several months.

I honestly can't see a reason for trying to install avast from safe mode

Worked a couple of years ago with AVG

You could simply try to enter the line ZoneAlarmCompatibility=0 to the [WebScanner] section

did that, no change

Now it has been talked about to see if the ZAC check could be improved, if it were ZA Pro or Home and only ask the question if it was ZA Pro. I don't know if this has been implemented or not

ZAC question wasn't asked so I expect so

[What does LadbrokesPoker do, what does it run, are you sure it is compatible with IE7 ?

Poker site. LadbrokesPoker.com
what does it run ? please clarify
Yes, and same prob with firefox

This from set up log
vrb/sys  Starting service avast! Web Scanner
vrb/sys  Service avast! Web Scanner started, errcode: 0x00000420
Any use?

Here are the errors renamed from .ws.ori to .txt
Found it in ...Alwil Software\Avast4\DATA\log

Thanks

[alanrf]

sputnik365 said:

The latest Avast must not write the ZA stuff in the .ini if using ZA free edition as it is still not there and seems OK to delete it if using ZA free.

It appears to me too that something is interfering with the proper processing of avast for sputnik365.

I have a WinXP SP2 system which is running the most up to date avast.  I was running an out of date ZA Free.  I just installed the most up to date ZA Free on the system.  For testing purposes I deleted the line in my avast4.ini file:

ZoneAlarmCompatibility=0

On restarting the system avast (as expected  and as reported in other posts in the forum) gave the pop-up warning about ZoneAlarm and asked me to make a choice.  I responded with the correct answer of "No" and avast immediately added to the avast4.ini file the line:

ZoneAlarmCompatibility=0

and, as expected, all browsing poceeds normally.  I have no problem accessing the ladbrokespoker.com site with IE7.

[sputnik365]

me too, I hope
ZA v 6.5.737.000 set to auto update
Avast v 4.7 home ditto
The trouble occurs during and after running the downloaded poker client.
And affects browsing generally.
As I said, after clean install of avast everything is fine till I run the poker client.
I have never had  the popup.
It is not IE specific.
Going to try your test

Regards

[sputnik365]

Ok,
removed ZAC line reboot no popup

[galooma]

@ sputnik365

could you reveal which  process or processes  are being guarded by PG ?.
Do you have any other  Intrusion protection utilities running?

[DavidR]

Hi,

Now it has been talked about to see if the ZAC check could be improved, if it were ZA Pro or Home and only ask the question if it was ZA Pro. I don't know if this has been implemented or not

ZAC question wasn't asked so I expect so

This would appear not to be the case as Alan has proven and a problem with your installation.

What does LadbrokesPoker do, what does it run, are you sure it is compatible with IE7 ?

Poker site. LadbrokesPoker.com
what does it run ? please clarify
Yes, and same prob with firefox

What processes does it run, see task manager, does it use say a Java applet (as what you mention downloads a client), etc. ?
Does it normally use secure communication HTTPS or normal HTTP pages ?

This from set up log
vrb/sys  Starting service avast! Web Scanner
vrb/sys  Service avast! Web Scanner started, errcode: 0x00000420
Any use?

Here are the errors renamed from .ws.ori to .txt
Found it in ...Alwil Software\Avast4\DATA\log

Thanks

Well there is something taking up buffer space perhaps that might be either the poker client or something else as the errors in the extract of the log indicates "An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full."

This however, is beyond my practical experience of avast and would need one of the Alwil team to get on the case.

I still feel there is something stopping your avast installation as that doesn't follow what others have experienced with avast and zone alarm.

You didn't answer my question about ProcessGuard as if you have it protecting avast that would possibly prevent uninstall and clearing registry entries, etc. So I feel you should disable it completely and try the reinstall including the use of the uninstall utility as has been previously mentioned. If for no other reason it takes something else out of the equation. You may find that PG is a pain in the rear to disable, I know I had lots of hassle uninstalling it (not disabling the protection or at the very least disabling protection on avast if you had that included).

I would take a look at processguard that can really get in the way of all sorts of installations. What have you got it protecting ?

[sputnik365]

Hi all,
Thank you very much for all your help.

With so many views of this thread maybe others have a similar problem?

ALan Your ZAC popup may be a legacy from an install before September 25, 2006

"improved detection of ZoneAlarm Pro (to prevent unnecessary WebShield incompatibility warnings)"

http://www.avast.com/eng/avast-4-home_pro-revision-history.html

My laptop, which has an install of avast from before that date, although program autoupdated as usual, (latest version) still gives the popup.

LadbrokesPoker doesn't use java for the downloaded version, although an outdated instance of javaw.exe autoruns for another app.
just 1 process, MPPoker.exe

Secure, although whether HTTPS or not I will know later(is there any alternative? maybe proprietry)

Yes, tell me about the trouble PG can cause hence the reinstall in safemode.
However, it is an essential part of my layered scurity.

I did try reinstalling with Windows running normally and PG properly disabled.
I have a method devised if anyone reading this needs to know.(disabling protection sometimes isn't enough).

Laptop now has the same symptoms

OK, here is my security setup.
WPA encrypted wireless network behind a Linksys router

Resident
ZA personal firewall
Avast AV
AVG AS
Processguard
Spywareblaster
They do all play nice together

Occasional scans
Ad-Aware
SpybotS&d
Fsecure blbeta

Frequent cleanup with CCleaner

Online
Kaspersky
Symantec
TrendMicro HouseCall

Defrag : PerfectDisk Live

I suspect the trouble is caused by a recent major update of the poker software but why should WebShield mess it up?

Thank you very much for your time and trouble,
All the best

[alanrf]

sputnik365 said:

ALan Your ZAC popup may be a legacy from an install before September 25, 2006

You are absolutely correct, I have just validated this on a Windows XP SP2 machine on which ZoneAlarm had never been installed.

As an aside to the Alwil team, what a decision - if you installed ZoneAlarm before a certain date it works one way - if you install or update ZoneAlarm after that date it works another way ... and is improved? While I do understand the need to move forward I am very disappointed in the method chosen.

[Lisandro]

if you installed ZoneAlarm before a certain date it works one way - if you install or update ZoneAlarm after that date it works another way ...

If this is correct, maybe ZoneLabs has finally improved their code to face this *incompatibility*.
If this is correct, it would be great if Alwil change this avast4.ini feature after all 
Sometimes, it would be great if instead of our guesses, some official word is dropped in some threads 

[DavidR]

LadbrokesPoker doesn't use java for the downloaded version, although an outdated instance of javaw.exe autoruns for another app.
just 1 process, MPPoker.exe

Secure, although whether HTTPS or not I will know later(is there any alternative? maybe proprietry)

Sorry for the delay in geting back this was a little more detailed than I had time for.

Yes, tell me about the trouble PG can cause hence the reinstall in safemode.
However, it is an essential part of my layered scurity.

I did try reinstalling with Windows running normally and PG properly disabled.
I have a method devised if anyone reading this needs to know.(disabling protection sometimes isn't enough).
<system info snip>

Yes PG got in the way so much for me I got rid of it.

All of the software mentioned with exception of PG and possibly the Poker program (see below) should work just fine together, I have used most of it myself with no problems.

I suspect the trouble is caused by a recent major update of the poker software but why should WebShield mess it up?

You mentioned an outdated version of javaw.exe, this used to cause problems for the email scanner as people commonly used email ports to communicate with p2p clients the email scanner expects email protocols and this caused timeouts until javaw.exe was excluded from the [Mailscanner} section.

Did the old poker program ever use javaw.exe ?
Perhaps MPPoker.exe does something similar communicates with the host if that communication is outside what the web shield monitors any layout information (if passed) may simply be lost leading to layout/format errors.

I'm clutching at straws here as I have absolutley no idea what MPPoker.exe does.

Similar communication issue used to cause problems with web shield and ZA Pro's privacy function, when a logon was required the user name and password were entered on an http page, validated on an https page and if valid redirected to another http page. During this flip flop between secure and unsecure pages the logon info appeared to be lost and the logon failed. This is why the ZA Compatibility came about, so it is possible that if MPPoker.exe has any communication function outside of the http port 80 then that info may be lost.

I think you need to ask the Poker site what in simple terms MPPoker.exe does to see if there is something that might cause these issues or if they can be circumvented.

In other avast providers it is possible to ignore programs from scanning, but I don't know if this is possible in the Web Shield as I believe it isn't monitoring outbound conections (otherwise it would detect malware I upload for confirmation scanning at virustotal, etc.). In the other providers it is possible to edit the avast4.ini adding the line IgnoreProcess= followed by the program to ignore e.g. IgnoreProcess=MPPoker.exe to the [WebScanner] section. I suspect this won't work, but it is worth a try and easy to do and reverse.

Other than that I think you may have to disable the web shield to play poker, though why it would also be a problem after you finish playing is beyond me. You may need to close the poker program and also End Task any Service that might be running.

Interestingly a google search for MPPoker.exe returns many hits, several of them from security based web sites.

[sputnik365]

Hi

Did the old poker program ever use javaw.exe ?

not as far as I know

IgnoreProcess=MPPoker.exe to the [WebScanner] section

Didn't

I think you may have to disable the web shield to play poker

And all other browsing :'(

I think you need to ask the Poker site what in simple terms MPPoker.exe does
to see if there is something that might cause these issues or if they can be circumvented.

will do

End Task any Service that might be running.

No, MPPoker shuts down clean as far as taskmanager knows

Interestingly a google search for MPPoker.exe returns many hits,
several of them from security based web sites.

Nothing to worry about, you get that with almost anything, from HijackThis logs. Ladbrokes and MPPoker is clean

Interestingly, i have a set of pages that load OK as well as a set that don't. (WithMPPoker running)
I am starting to think it may be a combination of pages with images on, and errors on the page (as shown in FF eror console)

The latest thing I have tried is:
Uninstall Ladbrokes
Uninstall Avast
Uninstall ProcessGuard
Clean up the registry with Registry Mechanic
Install an old version of Avast From march 2006 without allowing it to update
Browsing just the same
Now reinstalled everything

Just to clarify with MPPOker running most pages don't load correctly but usually
 after multiple refreshes they are acceptable
Without it running, a lot load ok or after 1 refresh.

I thank you for your time and trouble with this.

Happy New Year

[DavidR]

Your welcome, I guess we will have to see what the poker site say.

A Happy New Year to you.