Can't connect to internet at all if Avast is running...

[SWR]

I'm currently using Avast version 4.7.1029 with Windows 98 and IE 5.5 SP2.
I also use ZoneAlarm and WebWasher, but I have temporarily disabled WebWasher to make troubleshooting easier.

Everything was working OK when I was using a dial-up connection, but since I have changed to using a Cable connection (via LAN with a Windows XP system) I am not able to connect to the internet if the Avast program is allowed to run.
I can connect only if I prevent all 3 of the Avast modules from loading via the MS Config utility -- (ashServ.exe, ASHWEBSV.EXE, and ashmaisv.exe).


When I allow the 3 Avast modules to run they seem to interfere with the proper operation of the 2 networking components that were installed for Windows 98 via the Windows XP setup disk.  These 2 components are :

ICSDCLT -- C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient  -- loads from HKLM\...\Run

SSDPSRV -- C:\WINDOWS\SYSTEM\ssdpsrv.exe -- loads from HKLM\...\RunServices


If Avast is NOT allowed to run, ZoneAlarm will ask if I want to allow rundll32.exe (for ICSDCLT.dll), and then SSDPSRV.exe to access the internet about 30 seconds after the computer boots up.
I answer YES to both, and I can access the internet without any problems.


If Avast IS allowed to run, I am never prompted by ZoneAlarm for the 2 networking components to access the internet, but they appear to be loaded and running according to TaskInfo2000  (but Windows says that they are not responding when I attempt to shut down).
Also, Avast will report that it is waiting for a subsystem to start for 3 different providers -- they are OUTLOOK/EXCHANGE, WEB SHIELD, and INTERNET MAIL.

It's normal for the OUTLOOK/EXCHANGE provider to be waiting because I dont have OUTLOOK installed, but the WEB SHIELD and INTERNET MAIL providers have always worked in the past (with dial-up).



Any suggestions on how to get Avast working again??

Thanks for any help,
SWR

[DavidR]

The only module that would have any impact on Internet connection is the web shield, so why you would need to disable ashServ.exe which doesn't connect or scan web content is beyond me. The ashMaiSv.exe only monitors email traffic and ports 25, 110, 119 (news) and 143.

You need to allow ashMaiSv.exe and ashWebSv.exe to connect to the internet otherwise you will get the blocking of web browsing as web http port 80 traffic is redirected through the web shield proxy. It will also stop you sending and receiving email if ashMaiSv.exe is blocked.

Ensure these are allowed in the Program Control of ZA.

ICSDCLT -- C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient  -- loads from HKLM\...\Run

SSDPSRV -- C:\WINDOWS\SYSTEM\ssdpsrv.exe -- loads from HKLM\...\RunServices

None of these are avast processes so it isn't avast requesting connection for "rundll32.exe ICSDCLT.dll or SSDPSRV.exe.
http://www.bleepingcomputer.com/startups/rundll32.exe_Icsdclt.dll_ICSClient-2107.html
http://www.bleepingcomputer.com/startups/ssdpsrv.exe-5174.html

The Outlook/Exchange provider is for MS Outlook (not express) and is disabled by default unless you have MS Outlook, if you enable it, that is what the "waiting for a subsystem to start" is waiting for MS Outlook to start. Nothing to do with the other two processes, terminate Outlook/Exchange.

[Lisandro]

It's normal for the OUTLOOK/EXCHANGE provider to be waiting because I dont have OUTLOOK installed, but the WEB SHIELD and INTERNET MAIL providers have always worked in the past (with dial-up).

The Internet Mail Provider is an avast! resident provider and it is not just the corresponding service. If you have Internet Mail running and stop the "avast! Mail Scanner" service, you disable the scanning of e-mails, but you don't turn the provider into "stopped" state (rather "waiting for a subsystem to start"). Similarly, if Internet Mail is stopped, you cannot start it just by starting the "avast! Mail Scanner" service.

But, coming back to your case, check the avast! services?
Start > Control Panel > Administrative Tools > Services

I suppose you have to have four avast! services:

C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service)
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner service)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner service)

The two first of them should be Automatic loaded and the two last Manually loaded.

Also, into the firewall settings, the following programs should be allowed to connect:

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner Service)
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (avast! Update executable). This is a temporary file that just appears when an update (check) is about to launch, and disappears again afterwards.

Don't need rights to connect:
C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service)
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)

[SWR]

1) The only module that would have any impact on Internet connection is the web shield, so why you would need to disable ashServ.exe which doesn't connect or scan web content is beyond me. The ashMaiSv.exe only monitors email traffic and ports 25, 110, 119 (news) and 143.

2) You need to allow ashMaiSv.exe and ashWebSv.exe to connect to the internet otherwise you will get the blocking of web browsing as web http port 80 traffic is redirected through the web shield proxy. It will also stop you sending and receiving email if ashMaiSv.exe is blocked.

Ensure these are allowed in the Program Control of ZA.

3)

ICSDCLT -- C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient  -- loads from HKLM\...\Run

SSDPSRV -- C:\WINDOWS\SYSTEM\ssdpsrv.exe -- loads from HKLM\...\RunServices

None of these are avast processes so it isn't avast requesting connection for "rundll32.exe ICSDCLT.dll or SSDPSRV.exe.
http://www.bleepingcomputer.com/startups/rundll32.exe_Icsdclt.dll_ICSClient-2107.html
http://www.bleepingcomputer.com/startups/ssdpsrv.exe-5174.html

4) The Outlook/Exchange provider is for MS Outlook (not express) and is disabled by default unless you have MS Outlook, if you enable it, that is what the "waiting for a subsystem to start" is waiting for MS Outlook to start. Nothing to do with the other two processes, terminate Outlook/Exchange.

Thanks for your reply DavidR -- numbered responses are below...

1) ashserv.exe AND the other 2 Avast modules that load at start up have to be disabled, otherwise ICSDCLT and SSDPSRV will not work correctly and I will have no internet access at all.

2) ashMaiSv.exe and ashWebSv.exe are already allowed in ZoneAlarm

3) I already know that ICSDCLT and SSDPSRV are not Avast processes and that Avast is not requesting the connection for them.  They are the 2 networking components that were installed onto the Windows 98 system from the Windows XP setup CD.  It is normal for them to request access on their own about 30 seconds after I boot up, but as I said earlier -- If any of the 3 Avast modules are allowed to run at boot up time, then these 2 networking components will not work right (ZA will never even ask if they can connect or not and I have no internet access at all).

4) I suppose I could terminate the Outlook/Exchange provider since it isn't being used, but first I need to find out why ICSDCLT and SSDPSRV will not work correctly when EITHER ashServ.exe, OR ASHWEBSV.EXE OR ashmaisv.exe is allowed to run at boot up time.

Any other ideas?
Thanks again...

[SWR]

It's normal for the OUTLOOK/EXCHANGE provider to be waiting because I dont have OUTLOOK installed, but the WEB SHIELD and INTERNET MAIL providers have always worked in the past (with dial-up).

The Internet Mail Provider is an avast! resident provider and it is not just the corresponding service. If you have Internet Mail running and stop the "avast! Mail Scanner" service, you disable the scanning of e-mails, but you don't turn the provider into "stopped" state (rather "waiting for a subsystem to start"). Similarly, if Internet Mail is stopped, you cannot start it just by starting the "avast! Mail Scanner" service.

1)
But, coming back to your case, check the avast! services?
Start > Control Panel > Administrative Tools > Services

I suppose you have to have four avast! services:

C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service)
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner service)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner service)

The two first of them should be Automatic loaded and the two last Manually loaded.

2)
Also, into the firewall settings, the following programs should be allowed to connect:

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner Service)
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (avast! Update executable). This is a temporary file that just appears when an update (check) is about to launch, and disappears again afterwards.

Don't need rights to connect:
C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service)
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)

Thanks for your reply Tech™ -- my numbered responses are below...

1) Start > Control Panel > Administrative Tools > Services  (this does not exist in Windows 98)  but the registry shows that I have 3 services that start automatically.
They are all the same as the list you posted except for one that is missing :

C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service) -- Loads from HKLM\...\RunServices
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service) -- MISSING -- (I don't think I ever had this entry before when I was using the dial-up connection)
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner service) -- Loads from HKLM\...\Run
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner service) -- Loads from HKLM\...\Run

2) My firewall settings are already correct.

Thanks anyway for your suggestions,
SWR

[Lisandro]

1) Start > Control Panel > Administrative Tools > Services  (this does not exist in Windows 98)  but the registry shows that I have 3 services that start automatically.

My fault...

They are all the same as the list you posted except for one that is missing :
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service) -- MISSING -- (I don't think I ever had this entry before when I was using the dial-up connection)

Maybe this does not exist on Windows 98. I'm not sure. I don't have a 98 computer to check this.

What happens if you install from the scratch?

1. Uninstall avast from Control Panel first.
2. Boot.
3. Use Avast Uninstall for complete uninstallation.
4. Boot.
5. Install again the last version.
6. Boot.

[SWR]

What happens if you install from the scratch?

1. Uninstall avast from Control Panel first.
2. Boot.
3. Use Avast Uninstall for complete uninstallation.
4. Boot.
5. Install again the last version.
6. Boot.

I have just downloaded the uninstall utility and a new copy of Avast and will give this a try later tonight.
I'll let you know what happens either way...

SR

[Lisandro]

I'll let you know what happens either way...

We'll be here to help...

[SWR]

I'll let you know what happens either way...

We'll be here to help...

OK,  I uninstalled Avast using the Control Panel/Add Remove Programs, then rebooted.
Next, I used the aswclear.exe file to remove anything left over, and then rebooted again.
Next, I installed a new copy of Avast, and then rebooted again.

When the computer restarted I could not connect to the internet at all...
(Note that ZoneAlarm never prompted me to let rundll32.exe\ICSDCLT.dll or SSDPSRV.exe to access the internet.)


Next, I used the MSCONFIG.exe utility to disable the newly installed Avast components ashServ.exe and ashWebSv.exe, and then I rebooted again.
When the computer restarted, ZoneAlarm prompted me to let the 2 networking files run and I answered YES to each one and then I was able to access the internet again.

This confirms to me that the Avast components that normally run at startup are causing a problem for the rundll32.exe\ICSDCLT.dll and SSDPSRV.exe files (which are needed for internet access).

Any other suggestions?
SR

[Lisandro]

This confirms to me that the Avast components that normally run at startup are causing a problem for the rundll32.exe\ICSDCLT.dll and SSDPSRV.exe files (which are needed for internet access).

Look, imho, that two files (a library and an executable) could be the parental application (or a component) of the main program trying to connect the Internet. I'm not sure that ZA detects parental behavior, does it?
If ZA has parental check option, avast WebShield could be blocked into ZA settings and then the parental files can't connect through avast WebShield.
What happens if you uninstall ZA and try to connect only using avast and Windows firewall?

Does this thread help? http://forum.avast.com/index.php?topic=29993.0;topicseen

[SWR]

Look, imho, that two files (a library and an executable) could be the parental application (or a component) of the main program trying to connect the Internet.

Yes, I think this is the case because they put an icon in the tray that reads "Internet Gateway: Connected" when I mouse over it.

I'm not sure that ZA detects parental behavior, does it?
If ZA has parental check option, avast WebShield could be blocked into ZA settings and then the parental files can't connect through avast WebShield.

I'm not exactly sure what "parental behavior" is (LAN is something new to me as well), but I think this was the problem.

What happens if you uninstall ZA and try to connect only using avast and Windows firewall?

Windows 98 doen't have the built in firewall, but I decided to try things with ZoneAlarm disabled and I was able to connect to the internet with Avast running normally.

I did some checking on the ZoneLabs website and found the most updated version of ZoneAlarm for Windows 98 (ZA version 5.5.094.000), and after installing it I was able to get everything working together in harmony again.

The newer version of ZoneAlarm prompted me to let the files have internet access in this order :
1) rundll32.exe ICSDCLT.dll
2) SSDPSRV.exe
3) Webwasher
4) Avast

Thank you very much for helping me figure this out...
SWR

[Lisandro]

Thank you very much for helping me figure this out...

Glad that everything is working now.
Feel free to come back to forums any time you need help or can share experiences.

[Kilia]

Thank you very much for helping me figure this out...
SWR

Yay! Another problem solved!

--brought to you by the avast! cheering section.