The provider 'Internet Mail' blocks outgoing mail but NOT incoming mail

[subzero_two]

Installed software
OS : Windows XP Professional
Firewalls : Windows Firewall ( disabled ) , Sygate Personal Firewall Pro 5.0 ( enabled )
Antivirus : Avast version 4.8 Home Edition ( build Feb2009 4.8.1335 )
Mail-client : Outlook Express 6 ( 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) )

Problem description
When I try to send and receive e-mail. I can only receive e-mail. For the task sending I see the progress bar fill up and then wait for 60 seconds. After 60 seconds I get a timeout and the following error message appears in the tab 'Errors' in Outlook Express (translated from Dutch) : 'The server disconnected unexpectedly. Possible causes are problems with the server, networkproblems or too long inactivity. Subject 'Test', Account: 'MyAccount', Server: 'smtp.xxxx.xx', Protocol: SMTP, Port: 25, Secured(SSL): No, Errornumber: 0x800CCC0F'

The computer on which I have this problem is new. I have been busy installing all my software the last couple of weeks. My previous computer is still running with mostly the same software as my new computer. On my old computer I can send and receive e-mail without a problem. I have compared the settings in Avast and Outlook but have not found any differences.

On my new computer the e-mail gets sent when I disable the provider 'Internet Mail' in Avast. My firewall is active at that time so the firewall is probably not the problem. The application 'ashMaiSv.exe' is granted complete access to the Internet by the firewall.

I have checked the port-numbers in the tab 'Redirect' when you press the button 'Customize' at the provider 'Internet Mail'. It contains the standard ports : POP 110 , SMTP 25 , IMAP 143 , NNTP 119.

In the tab 'Advanced' of my account in Outlook Express the standard portnumbers are shown too : SMTP 25 , POP3 110.

In the tab 'Servers' of my account in Outlook Express there is no tick for the option 'Verification is needed for this server'. There is also no tick here on my old computer.

Testing after the first post
When I disable 'Scan outbound mail' in the tab SMTP for the and the provider stays activated I can send an e-mail. As soon as I enable 'Scan outbound mail' the outgoing e-mail is being blocked.

When I remove the tick before 'Insert note into clean message' in the tab SMTP for the provider 'Internet Mail' the e-mail gets sent. So there is possibly a problem when attaching this note. However when I tick the note on my old computer the e-mail gets sent. And I receive the e-mail on my new computer. The note (sent on my old computer!) is as follows :

avast! Antivirus: Outbound message clean.

Virus Database (VPS): 090814-0, 14-08-2009
Tested on: 15-8-2009 14:13:33
avast! - copyright (c) 1988-2009 ALWIL Software.

I'm beginning to suspect corruption in Outlook Express on my new computer.

Question
Can someone give me some clues on how to find the source of this problem?

[YoKenny]

The latest Outlook Express is 6.00.2900.5512 (xpsp.080413-2105)

It looks like you are still running Windows Service Pack 2 so you need to install Windows Service Pack 3 that has been available for over a year and contains several Critical Security updates plus performance improvements.

You need to start Internet Explorer then go to Tools then Windows Update and download all of the available updates.

Also you should enable Automatic Updates or at least be notified that Updates are available.

Go to Control Panel then Automatic Updates then select Automatic (recommended) or at least Notify me but don't automatically download or install them.

Download and install:
User Profile Hive Cleanup Service:
Brief Description
A service to help with slow log off and unreconciled profile problems.
http://www.microsoft.com/downloads/details.aspx?familyid=1B286E6D-8912-4E18-B570-42470E2F3582&displaylang=en

Download Malwarebytes' Anti-Malware (MBAM) then install it then update it and run a Quick scan and let it remove whatever it finds:
http://www.malwarebytes.org/mbam.php

Go to Secunia Online Software Inspector then run it to see what other applications are vulnerable:
http://secunia.com/vulnerability_scanning/online
 

[subzero_two]

I do get notifications of Windows updates and install most of them. Especially the security ones. Since I don't see advantages installing SP3 I have blocked this update so far.

I will investigate your tips. And check for each tip if it solves the problem.

Especially the tip about the 'User Profile Hive Cleanup Service' sounds good. Since I often get warnings in my application log about problems with 'userenv' under eventid 1517.

I have not mentioned yet that I have also had problems with MailWasher hanging. I use MailWasher to delete spam from the mailserver before receiving it with Outlook Express. Maybe something is damaged around that time since I'm not sure if I have treated my computer nicely at that time. It was the first time I discovered I couldn't send e-mail on my new computer.

The problem of not being able to send e-mails is solved by not ticking 'Insert note into clean message' in the tab SMTP for the provider 'Internet Mail'. But nevertheless I will investigate some more with your tips to see if I can find a way to make the 'tick' work.

1. User Profile Hive Cleanup Service
Did not solve the problem. But no 'userenv' error in application log after installation.

2. Malwarebytes
Malwarebytes detected 1 infected object : Rogue.Link. Did not solve the problem.

3. Secunia Online Software Inspector
Had to install 'Java 6.1 update 15' first. No errors detected.

So now I know more about how secure my system is. The original problem however is still there.

I will be exploring ways to reinstall Outlook Express.

[subzero_two]

The 'User Profile Hive Cleanup Service' showed two interesting entries when I shut down the computer last night in the application log :

ID : 1412
Setup for handle remapping for process ashServ.exe (1908) failed.  Reverting to closing handle.

ID : 1201
The following handles in user profile hive XXXXX\Xxxxxxx (S-1-5-21-527237240-1897051121-839522115-1003) have been closed because they were preventing the profile from unloading successfully:
 
ashServ.exe (1908)
  HKCU\Control Panel\Desktop (0x328)

Seems like the Avast service isn't nice to my system.

[DavidR]

I use both MailWasher (see #### below) and OE6 SP2 on XP Pro SP3 with avast and no issues here.

The ashServ.exe is the main scanning engine of avast if there is any activity going on it will still be scanning, so wouldn't shutdown until complete.
So what other security software do you have ?
Do you have any application that does a clean-up on shutdown, etc. ?

Whilst this appears to be only SMTP related, try deleting the entry for ashMaiSv.exe in the Sygate firewall and force Sygate to ask permission again. Personally I would be looking for another firewall as Sygate has a vulnerability as far as localhost loopback is concerned (and it is no longer being developed). avast uses localhost proxies to scan content before it is allowed to be saved in inboxes/temp internet cache, etc. and sygate only monitors changes in the Parent of the proxy and not what uses the proxy, so this would allow applications to use the proxy unchallenged.

####
avast's Internet Mail provider would scan the inbound email traffic to MailWasher:
MailWasher doesn't download the complete email to do its analysis, it only downloads the headers, a small part of the body, it doesn't download images or attachments and it views what is downloaded in text only. Based on this I personally don't feel that any negligible risk worth scanning duplication, but the choice is yours.

By editing the avast4.ini file, [MailScanner] section using a text editor like notepad. It is best to save a copy of avast4.ini to another location in case of any problem, you can then copy the original back.
[MailScanner]
IgnoreProcess=MailWasher.exe add this line if you don't already have an IgnoreProcess line.
Save the changes to avast4.ini and exit, the avast self-defence module will ask are you sure about the changes, etc. answer Yes.

[subzero_two]

The ashServ.exe is the main scanning engine of avast if there is any activity going on it will still be scanning, so wouldn't shutdown until complete.

What do you want to say with this? Should I disable the 'User Profile Hive Cleanup Service'?

So what other security software do you have ?

Only a firewall and virusscanner. I sometimes use 'Ad-Aware' but that isn't resident.

Do you have any application that does a clean-up on shutdown, etc. ?

Not that I'm aware off.

Whilst this appears to be only SMTP related, try deleting the entry for ashMaiSv.exe in the Sygate firewall and force Sygate to ask permission again.

I already tried that. Sygate asked permission next time. It didn't solve the problem.

By editing the avast4.ini file, [MailScanner] section using a text editor like notepad. It is best to save a copy of avast4.ini to another location in case of any problem, you can then copy the original back.
[MailScanner]
IgnoreProcess=MailWasher.exe add this line if you don't already have an IgnoreProcess line.
Save the changes to avast4.ini and exit, the avast self-defence module will ask are you sure about the changes, etc. answer Yes.

Good tip. I will try that. I edited 'avast4.ini' directly but got no questions from the Avast self-defense module.

[DavidR]

1. User Hive clean-up - Unless you are experiencing any real problems at shutdown e.g. errors displayed to the screen I would leave it alone, however, I don't know how the user hive clean-up would fare trying to stop what is an avast protected process (self-defence).

So I don't believe it will make any difference, I also have the user hive clean-up running.

2. adaware shouldn't be an issue when not resident. However adaware is a bit of a waste of hard disk space it really hasn't kept pace with malware developments.

3. What other AV was installed before avast and how was it removed ?

[subzero_two]

What other AV was installed before avast and how was it removed ?

None. This is a new install on a new computer.

I have new information. When I compose the e-mail not in HTML-format but in text-format the e-mail gets sent and on receiving the note is attached as text. So there seems to be a problem with the note in HTML-format.

I just received the reload-message for 'avast4.ini'. This is a bit late considering I changed the ini-file some time ago.

[Sesame]

I guess David R has gone off line.

I have new information. When I compose the e-mail not in HTML-format but in text-format the e-mail gets sent and on receiving the note is attached as text. So there seems to be a problem with the note in HTML-format.

Then, HTML messages may take too much time to be scanned.  How about giving it a try to increase the server time-out setting?
Without lowering your defence offered by Avast! Internet Mail Provider,

you may be able to resolve this problem by increasing the server time-out setting in Outlook or Outlook Express. To increase the server time-out setting, use the following method that is appropriate for your version of Outlook or Outlook Express.

Outlook Express 5.x and 6.0
     1.Start Outlook Express.
     2.On the Tools menu, click Accounts.
     3.Click the Mail tab.
     4.Click your POP3 account, and then click Properties.
     5.Click the Advanced tab.
     6.Gradually increase the server time-out setting until the problem is resolved.

You have other tips related with the error you have at Microsoft KB

[subzero_two]

I did already lower the time-out to 30 seconds, I didn't want to wait 60 seconds. On my old computer sending works ok with the same SMTP-server, time-out, HTML-message with standard HTML-note. The test e-mail contain no text other than a subject so the e-mails are very small. And when I send e-mail in HTML-format without a note it gets sent within the timeout of 30 seconds.

I already visited the Microsoft-link. That's where I got the idea of corruption somewhere in Outlook Express. When I compare the info-box from Outlook Expres between my old and new computer there are two DLL's without text under the title 'version' in the info-box on my new computer. These are the dll's : 'wab32.dll' and 'wab32res.dll'. So I'm inclined to expect corrupted dll's or corruption somewhere else in the software and data from Outlook Express.


I'm now going to restore to the oldest restore-point on 28 july 2009.

In the info-box from Outlook Express I now see the version-numbers like they are on my old computer for 'wab32.dll' and 'wab32res.dll'. This looks promising. I'm also made happy with a bunch of new hardware found messages. Not so cool. And Avast isn't installed yet in this restore-point.


I have restored an image because after trying some restore points I get the feeling it isn't getting any better. Some restore points can't be restored! After restoring the image (with Acronis True Image) the sending of mail with a note still gives an error in Outlook Express. The next step will be installing another e-mail client (maybe Thunderbird) and testing the sending of e-mail with that. So I can rule out the e-mail client.

[subzero_two]

With the e-mail client Thunderbird I didn't get the error-message.

Today I did a fresh install starting from scratch : create partition , install Windows XP etc.

The chances of corruption in the software should be minimized now in my opinion.

But the error still occurs in Outlook Express when I choose to attach a note to sent e-mails in Avast. When I don't attach a note to sent e-mails all is fine.

So here I am after all this work.

Conclusions so far :

1. The error-message doesn't occur with all e-mail clients;

2. Outlook Express is probably not corrupt, because it's a fresh install.

[subzero_two]

Friday 21 august 2009
Since all the software is freshly installed and the error is still there I'm beginning to suspect the hardware.

1. Maybe the processor on my new computer Intel i7 920 is too fast;

2. Maybe there's a problem with my LAN-port and/or LAN-driver.

However you might argue the problem should be solved in the software of Outlook Express and/or Avast.

Saturday 22 august 2009
I decided to install Windows XP Service Pack 3 to see if a new version of Outlook Express would solve the problem. And it did. So the problem was either caused by Outlook Express or possible another piece of software that was part of the installation of the Service Pack. This will be hard to check since the Service Pack contains all previous patches which might have been missing on my computer.

Problem solved.

The latest Outlook Express is 6.00.2900.5512 (xpsp.080413-2105)

It looks like you are still running Windows Service Pack 2 so you need to install Windows Service Pack 3 that has been available for over a year and contains several Critical Security updates plus performance improvements.

Special thanks to YoKenny 

[YoKenny]

Microsoft does actually fix things with Service packs.