Avast On-Access Protection stopping browsers opening

[rossb]

Hi David.

When On-Access Protection Control is on and I attempt to open up IE7 I get a page with the following statement:

"Internet Explorer cannot display the webpage
   
   Most likely causes:
You are not connected to the Internet.
The website is encountering problems.
There might be a typing error in the address."

When I try FF, I get a page stating:

"Connection Interrupted
The connection to the server was reset while the page was loading.
The network link was interrupted while negotiating a connection. Please try again." (Trying again makes no difference).

Weirdly, a few minutes ago FF started working normally for a short while when I had the On-Access Protection on. I managed to bring up two sites, then the "Connection Interrupted" page came up when I tried a third site. That's persisted since, so I turned OAP off and now I can browse normally. Still, it's the first time either browser has worked at all for browsing while OAP was on. - even if it was only for a couple of sites.

I just tried to duplicate the errors I got when I tried to manually delete the AVG files I found on a search of the HD, but now I can find NO TRACE of anything to do with AVG! I don't know how this came about - there were certainly AVG remnants on view when I was trying to delete them this morning, but that they're gone now (however that happened) is a plus, I guess.

I don't understand your suggestion "you could pause the standard shield open the browser, using about blank as your home page so it doesn't connect immediately and once open resume the standard shield so you are protected." What is "about blank" (that you suggest using for a home page), for instance?

Anyway, thanks for your comments. I thought people had deserted the thread. I would REALLY like to get this browser issue sorted out so I can give Avast! a fair go for a while.

Cheers
Ross

[DavidR]

That is more like it as I couldn't believe you couldn't even open them.

Now this aside from possible conflict with another AV (that also monitors web traffic) it could be firewall blocking (this is more common). However, now you say it worked for a time and that would indicate that the firewall isn't blocking. But we are back to what appears to be conflicting processes for web traffic scanning.

Did AVG alter the IE (or firefox) proxy setting to be able to scan the internet traffic, I believe I have seen this before in the forums and that change wasn't reversed when it was uninstalled.

Check the Internet Options, Connections tab, Settings button, Proxy Server, if there is anything there remove it (unless of course you have to use a proxy ?).

Whilst this is going on, you are scaring me to death, so I have no idea what it is doing to you. You keep mentioning switching off The on-Access Protection leaving you with your trousers round your ankles metaphorically speaking, Just Terminate the Web Shield as that would be the only avast element involved and it leaves the standard shield as a last line of defence.

avast has 7 shields/providers, right click the avast 'a' icon and hover over the Pause provider and from the list select the Standard Shield, this is reversed by right click the avast 'a' icon, and from the Resume provider select the Standard Shield. This however shouldn't be required as contrary to what you said IE and FF are opening, my suggestion was to allow them to start and the re-setting home bake of your browser was to avoid it trying to connect when you had no defence.

[rossb]

David,

Thanks for your ongoing interest in this annoying problem of mine.

I checked the Proxy Server - there is nothing there.

I terminated Avast's Standard Shield as you suggested, and immediately got the "Internet Explorer cannot display the webpage" page when I tried IE, and the "Connection Interrupted" for Firefox. I then tried terminating the Web Shield instead - same result. Then terminated both the Web Shield and the Standard Shield - same result. So all these combinations render the web unsurfable while On-Access Protection Control is on.

I know that is not what you expected. Does this new information, including the absence of any Proxy, give any other clues as to what could be going on, please?

[DavidR]

The suggestion on the standard shield is totally unrelated to the problem (I also said Pause not Terminate), as I said it was only suggested because of your comment that you couldn't 'open' IE or FF not that you couldn't browse when they were 'open.' So the suggestion related to possible blocking of the executables that are run for IE or FF.

The Termination was related to the 'Web Shield' as I said:

No problem, glad I could help. Welcome to the forums.

So you will have to read carefully or you could leave yourself unprotected.

I now want you to ensure the standard shield is running, reverse what you did and do the same for the web shield so they are both running.
I want you to manually set your browsers to use the avast proxy and see if that makes a difference. The IE one may relate to IE6 but I'm sure you can find the appropriate settings if it differes in the version you are using.

For IE - broadband users: - Tutorial - Web Shield Proxy Set-up for IE
For IE - dialup users - Tutorial - Web Shield Proxy Set-up for IE (Dial-up)
For Firefox users - Tutorial - Web Shield Proxy Set-up for Firefox

That's me for the night, almost 2:45am here.

[rossb]

David,

I meant "paused", not terminated. I do read your advice carefully - my carelessness was in my phrasing when responding. I am, as you may have noted, terminologically challenged, although I am fairly well experienced on computer matters generally...but as with many non-techies, there are yawning gaps in my knowledge that may make me appear more ignorant than I am.

I am new to Avast, having used AVG without a hitch for years. The reason I made the change was that AVG was taking a long, long time to scan, and several folk I trust who are up with the tech side of things recommended Avast as a superior and more streamlined free alternative to AVG. So, I ask for your patience. I am close to abandoning Avast, simply because I can't resolve whatever this current problem is with the browsers, and as you say, it is dangerous to leave myself unprotected when I am forced to stop On-Access Protection any time I need to browse (like now!).

I really do want to try to get this bloody problem fixed, though.

I have tried setting FF to use the Avast proxy - I couldn't browse with FF at all, whether On-Access Protection was on or off!

So, getting nowhere fast.

If you or anyone else have any further suggestions, I'll gladly follow them. In the meantime, I'll uninstall and reinstall Avast later, and see if that works now that the remnants of AVG appear to be gone.

Cheers

[Tarq57]

Hi,
Here's a couple of long shot ideas, which may help for troubleshooting.
1) You used Revo Uninstaller for AVG. It is easy when using this uninstaller to delete more reg values than should be deleted, unless the tree for the reg entries is expanded, and only the bolded entries are removed.
    Solution: -Uninstall and re-install the programs subsequently affected, or
                 -System restore to prior to the removal date, then re-run the AVG remover, or
                 -Restore the registry from the backup (you make backups, of course?) then re-run AVG remover.

If that is not applicable,
2) You have used ZoneAlarm in the past. Is it fully uninstalled?

Any other security software installed in the past?
Are you running (or using the "run as" command) as an administrator when installing/uninstalling software?

[rossb]

Hi Tarq57, and thanks for your comments.

I will try uninstalling and reinstalling Avast later (next few hours - short of time right now).

ZoneAlarm does appear to be completely uninstalled. A search didn't pick up any files, and I can't see any remnants in the C drive.

No other security software installed in the past (not anti-virus, that is). I have tried Spyware Blaster (uninstalled now). I currently run Spybot Search and Destroy and Adaware. Other than Avast (and AVG until recently), that's it.

[DavidR]

OK simply saying it didn't work as that doesn't give much in the way of detail and the main issue is exactly what you entered (localhost  and 12080 some missed one of the 0s off).

Earlier I asked if you had to use a proxy to connect to the internet (ISPs sometimes insist or using a web accelerator) ?

Though what is really getting me is everything is so intermittent it works, it doesn't work as many of the suggestions we give including the one above are to correct fixed permanent problems.

So the problem in applying a fix/suggestion when it is an intermittent problem, could introduce its own issues and that has me totally stumped (and you have to ensure that you reverse any change that doesn't work or we could be fighting the change).

[rossb]

David,

I entered localhost  and 12080, as instructed.

I don't think I use a proxy to connect to the net. Not sure where to check this, though.

The problem as described isn't really intermittent - only once, for two page downloads using FF, has browsing been as normal when On-Access Protection Control has been on. The rest of the time - which is over a week now - the problem has been as described at all times when On-Access Protection Control has been on, and browsing has been normal at all times when On-Access Protection Control is off.

There is one other issue I have been experiencing that I haven't mentioned until now because I assumed it was not related to Avast. I mention it now in case it does offer some clue to you tech-initiated folk as to what could be amiss with Avast and the browsers. It has been occurring for 2 weeks or so - ie: before I changed from AVG to Avast. Anyway, it's this: autologin is not working in FF.

When this first started happening, which was suddenly one day, for no apparent reason, it also affected IE7. Sites I had been autologging into for literally months or longer suddenly asked me to log in. My username and PW were already filled out, but even when I ticked the box asking the browser to keep me logged in, it failed to do so next time I brought up the site(s). I restored the default settings in IE7, and that resolved the problem for that browser. The problem remains for FF, despite uninstalling and reinstalling it. Bewilderingly, last night I got a notice that FF had completed some upgrade (automatically...that is, I didn't manually upgrade it), and soon after, autologin started working in FF. This morning, it had stopped working again in FF. IE7 remains OK for autologin.

I was wondering if I have some virus or spyware messing things up, but AVG did not detect anything, and I ran a thorough check including archives when I downloaded Avast - again, nothing detected. I've run scans with Adaware and Spybot, also, and they have detected nothing.

Maybe I need to reformat Win XP. I bloody hope not, but I'm starting to get desperate. I'd better log off now, because as you know, I am unprotected any time I am online.  Will check back later after I've uninstalled and reinstalled Avast.

Thanks to all for your help to this point.

[DavidR]

Well the problem with autologin (though I have no idea what one you might be using, I have never used it) I always log on to sites and don't use a password, login manager, etc. but anything that is common for both browsers is possibly a factor. If you disable that would it make any difference.

I'm sorry as I'm totally clutching at straws here as I have never experienced what you are experiencing in the five years I have been on the forums. For me intermittent is obviously different something either works or it doesn't no change, so when it works even for a short period without having done something. That I call intermittent especially when for no reason it fails again.

Well if you had to use one I would have thought it would be in the IE connection settings.

FF 3.0.10 has just been released so that may have been your auto update (I don't have this enabled, I'm on dial-up and need to control what connects and what updates, etc.).

You could try these tools as adaware is IMHO a waste of hard disk space and S&D I'm no great fan of either.
If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

• 1.  MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
• 2. SUPERantispyware On-Demand only in free version.

[rossb]

Hi again, David.

The "autologin" I referred to is just the facilities inbuilt in IE and FF - I don't have any specific separate autologin programs.

I uninstalled Spybot S&D, Adaware and Avast. Then I reinstalled Avast. The problem persists as before with both browsers.

I downloaded, installed and updated MalwareBytes Anti-Malware and ran it. It detected a single file, Rogue.Antispyware, which was in my Applications folder. I got rid of it using MBAM. Here is MBAM's report:

Malwarebytes' Anti-Malware 1.36
Database version: 2059
Windows 5.1.2600 Service Pack 2

30/04/2009 12:55:12 AM
mbam-log-2009-04-30 (00-55-12).txt

Scan type: Quick Scan
Objects scanned: 97053
Time elapsed: 6 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Ross B\Application Data\AntispywareBot (Rogue.AntiSpywareBot) -> Quarantined and deleted successfully.

Files Infected:
(No malicious items detected)

------------
Now I am about to install SUPERantispyware. If nothing else, at least you have the satisfaction of being responsible for my binning SpyBot S&D and Adaware in favour of the two programs you recommended!

Sheeyit, I just wish this damned browser issue with Avast could be resolved though.

[rossb]

Update!

I just installed Superantispyware, ran it, and it detected 17 Adaware cookies. I quarantined them, and now both IE and FF can be used to browse as normal WITH Avast's On-Access Protection Control ON!!!

Maybe, at long, long last, the issue is finally resolved. It's hard to believe the problem was caused by Adaware cookies, but that's the only conclusion that can be made from where I sit...

Going to bed now (it's nearly 2am here), so fingers crossed everything will still be fine in the morning. Will check back in to let you guys who have so kindly offered your advice and recommendations throughout this long thread know the situation. Sincere thanks to all.

[DavidR]

Re Reply #25
There are some applications that can do the login stuff and that was something I was more concerned with. Since using two different methods/browsers to login that fails, seems to point in a totally different direction than say a common application for logon.

There is certainly some very strange goings on in your system but what is the question, I haven't seen the like of.

Re MBAM results, good that it found a rogue application, though I'm surprised as these normally throw up pop-ups stating your infected/vulnerable, etc. and you would notice that. Though it is possible that it had other effects, possibly to make you consider (if pop-ups were present) buying it, etc.

Re Reply #26
The tracking cookies are a very minor issue and certainly not a security one, so once again I'm surprised (twice in one post) if they could have had this effect.

So it may be that the rogue detected by MBAM or possibly adware messed with your connections.

Thankfully it seems to be clear, fingers crossed and you now have two of the top anti-spyware/malware applications to compliment avast.

[rossb]

I can't believe this. Just logged on this morning and the problem is back - while On-Access Protection Control is on, I get page load errors with IE7 ( "Internet Explorer cannot display the webpage etc") and FF "Connection Interrupted etc". What can I say? SHIIIIIIT!

[Tarq57]

Maybe it's time to post a HijackThis log. http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis
I feel a bit rude suggesting this, as I do not have the training to back it up by being able to actually analyze the log.
But there are folk at this forum who do have that ability.