Can't check emails with Avast going

[DavidR]

Hi
I am having a similiar problem as Jennifer however I can't access my hotmail account now that I have installed Avast and uninstalled Norton. After I enter the login info (Hotmail), I just get a blank screen (no error message). I am using Windows XP SP2. I tried to download the Norton uninstall feature but for some reason, nothing happens when I click on the download button.

any suggestions? thanks

Gail

I can't see this has anything like the same problem as hotmail is a webmail not pop3 email solution and doesn't use the Internet Mail provider but the Web Shield provider. Please start a New Topic to avoid this topic becoming confused with two different problems.

[atryeu]

Hi David,

I luckily already had the program on my computer. The first part of the log is below, and the rest will be in the next post (or two)....
------------

Logfile of HijackThis v1.99.1
Scan saved at 5:54:25 PM, on 7/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast Anti Virus\aswUpdSv.exe
C:\Program Files\Avast Anti Virus\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast Anti Virus\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Browser Mouse\mouse32a.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\IINet-Accelerated\slipcore.exe
C:\PROGRA~1\AVASTA~1\ashDisp.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\IINet-Accelerated\slipgui.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

[atryeu]

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\PROGRA~1\PARENT~1\ParentalFilter.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~2\VMNTOO~1.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll
O3 - Toolbar: VMN Toolbar - {4E7BD74F-2B8D-469E-8DA9-FD60BB9AAE33} - C:\PROGRA~1\VMNTOO~2\VMNTOO~1.DLL (file missing)
O3 - Toolbar: Infinity Accelerated - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\IINet-Accelerated\Toolband.dll
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Browser Mouse\mouse32a.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\IINet-Accelerated\slipcore.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\AVASTA~1\ashDisp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Infinity Accelerated.lnk = C:\Program Files\IINet-Accelerated\slipgui.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\IINet-Accelerated\gui_resource.dll/327
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\IINet-Accelerated\gui_resource.dll/328
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1152421066156
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{85419FF4-6058-4D2C-B182-9881E0702906}: NameServer = 64.255.237.190 64.255.237.191
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast Anti Virus\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast Anti Virus\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast Anti Virus\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast Anti Virus\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

[alanrf]

I noticed that your sites are hosted at iinet.  I also see now that you have installed an accelerator program provided by them called Slipstream.

According to the Slipstream website they "accelerate" email automatically for POP3 accounts.  In other words they are inserting intercepts for port 110 and (unlike some other software I have tested that does the same thing) it does not play nicely with the other kids ... in this case avast.  Unfortunately this issue is quite common with accelerators (most of which seem to be re-branding of a single badly written product). 

So you may be able to turn off Slipstream acceleration of your email and have avast scan it or you must forgo avast scanning.     

[atryeu]

Hi Alan,

I have the Accelerater set so it will only compress graphics and flash media. It won't mess with POP3 or FTP. I would love to get rid of the program either way, but I'm afraid that I live so far out from town and can't connect faster than 24k so without it I get nothing but timeouts while I try and browse something.

Just to double check though, I shut down the accelerator, turned the Internet Mail on and tried again, and it still is giving me the same error, even without the accelerator files running

[DavidR]

This makes me think that a proxy is used I don't know if this could be having an effect, although the Internet Mail provider doesn't have any redirect ports like the web shield to cater for having to use a proxy for acceleration. I see Alan noticed this also, I must improve my typing skills

O4 - Global Startup: Infinity Accelerated.lnk = C:\Program Files\IINet-Accelerated\slipgui.exe

User interface for Slipstream - internet acceleration through compression/decompression techniques, intelligent cacheing on the server side, and real-time conversion of large/high-bandwidth images to less bulky pix. Used by popular ISPs such as IceNet, Wanadoo, Terra, OnSpeed, United Online and AOL Canada. Required if the user's account is locked in to that proxy server

Did you install this VMN Toolbar http://toolbarwizard.vmn.net/.

Also don't know what all that Sony cr*p is about either, I'm very wary of Sony since the rootkit issue.

[atryeu]

A proxy is supposed to be used for the Accelerater, but if I stop the program or close it, the proxy is disabled.

I did not install the VMN Toolbar, but I did install something else by VMN.. some little program that lets you leave sticky-type notes around your desktop. It came in handy for awhile.  The toolbar may have came with it, but I don't have it active and it's not set to be loading at startup.

I hate the Sony program. There was some promotion on a brand of toothpaste for awhile that was giving away a code for 2-3 free music downloads per code, and that program was required. As soon as I get a new cd burner to get the music out of the program, it's getting deleted. I just downloaded the program to get the free music

[DavidR]

Unfortunately I don't know anything about how this accelerator works other than it uses a proxy to achieve what it tries to do.

As an example I know that the web shield proxy, even when paused, traffic still uses it but it isn't scanned, it is only when terminated that the proxy isn't used. So I don't know if there is a similar hook, on this (where it still goes through iinet before arriving at your email server) which still gets in the way. Alan is more experienced on the email issues than I so I hope he will continue to try and help. I'm calling it a night or morning, almost 3 a.m. here.

[alanrf]

It does use a proxy - that works for its Web connections - that is pretty clear.  A Web proxy has nothing to do with email in any shape or form.  Its "automatic" email intercept must work similarly to avast's.   

However, the interface (according to this site - if I have the right one http://www.slipstream.com/our_solutions/guide.html#interface ) will allow you to specify that you do not want POP3 intercepted by the product.  To make that effective I suspect that a system restart would be needed to allow avast to get its intercept working properly. 

[atryeu]

Thank you for the help David! When I closed out the accelerater, there are 2 seperate files for it and I closed both down so the proxy should have been shut down as well I'd imagine.

I don't know much about proxies though, but I'd imagine since that's the only thing using one and the program was shut completely down, the proxy would be as well.

I must also head off for the night I guess. My internet has had issues with the local dial up number I use for the last 2 days and it's having problems responding and staying connected. Hopefully they get the problem fixed tomorrow.

Thanks again for trying to help me out! Yikes, 3am there? Are you over in Europe perhaps? It's only 7pm on the west coast of the USA right now.

Alan:  I already have Accelerated set so doesn't mess with POP3.  I attached a screenshot of the settings for the program to this post.  (There is nothing set in the Proxy Exclution list that is shown as a button in that screenshot, just in case you ask about that...)