Avast and windows firewall not happy together?

[Asyn]

Let me try again.  

Periodically, Avast will show that the realtime shields have been turned off.  I cannot restart the realtime shields from the avast window.

At the same time, Windows firewall ceases to work.  When I try to look at the WFW through the control panel, I get this strange message that it cannot display information because of an internal problem.

Also, at the same time, I cannot start firefox.  It shows in the task list but I never see a firefox window.  The computer is still able to get to the internet with UDP packets (SNTP program) and ICMP packets with ping or traceroute.

These are the major symptoms, the question is what is the problem?  Is this an issue with Avast?  Is this an issue with Windows?  What do I do to keep this from happening again?

Ok, thanks - something to work with... We will go step by step now...
- First, please tell us which other security software is running on your system. (also former installed..!)
- Did you install avast with admin rights? (necessary for security software)
- Did you scan your system for malware lately?
(If not, please dowload and run free Mbam: http://www.malwarebytes.org/mbam.php)
- Please post back your results.
asyn

[Dch48]

Avast!5 works fine with the XP Firewall and I tried it on a Vista machine with no problems as well.

[reallyold]

Ok, thanks - something to work with... We will go step by step now...
- First, please tell us which other security software is running on your system. (also former installed..!)
- Did you install avast with admin rights? (necessary for security software)
- Did you scan your system for malware lately?
(If not, please dowload and run free Mbam: http://www.malwarebytes.org/mbam.php)
- Please post back your results.
asyn

Answering your questions in order...

There has been no other security software installed on this computer.  Mentioned earlier, this is a relatively new install on brand new hard drives that were partitioned and formatted under Ubuntu 9.10.  During the rebuild of the system, avast was one of the first pieces of software installed.

Definitely installed as an administrator.

Trying to do the malware scan but I'm having some difficulties with the computer at the moment.  I decided to uninstall and reinstall both SP3 and avast.  Managed to do the SP3 but the avast uninstall seems to be languishing.

[Asyn]

Trying to do the malware scan but I'm having some difficulties with the computer at the moment.  I decided to uninstall and reinstall both SP3 and avast.  Managed to do the SP3 but the avast uninstall seems to be languishing.

Why are you uninstalling/reinstalling SP3..??
If you have problems uninstalling avast use this in safe mode:
http://www.avast.com/uninstall-utility
asyn

[reallyold]

Why are you uninstalling/reinstalling SP3..??
If you have problems uninstalling avast use this in safe mode:
http://www.avast.com/uninstall-utility
asyn

The reason for uninstalling/reinstalling SP3 is to get WFW working again.  If WFW is not working, then I cannot start a browser (either firefox or IE).  I do appreciate the link to the avast uninstall utility.  Thanks.

Last night, I went through the whole process again of uninstalling/reinstalling both avast (fresh download) and SP3.  I also ran mbam and was assured that as far as that program was concerned, I have no malware.  After that, everything worked; I was able to browse, read email, all of the things you expect to be able to do.  I used ccleaner to check the registry and it's fine.  I have scanned the hard disk looking for errors and none where found.

This morning, I am right back to where I was.  The avast icon in the system tray has an exclamation point, I cannot access WFW through the control panel (exact message: "Due to an unidentified problem, Windows cannot display Windows Firewall settings").  I cannot enable avast realtime shields through the avast menu.

Firefox will not start, IE will not start, Thunderbird RUNS.

I am officially lost and out of ideas, help or comments please.

[doktornotor]

Given the time you have spent/wasted re/uninstalling SP3 back and forth to no avail, you could have a sane fresh new XP install and working Avast. Seriously, reformat the drive.

[Asyn]

1. The reason for uninstalling/reinstalling SP3 is to get WFW working again.  If WFW is not working, then I cannot start a browser (either firefox or IE).  I do appreciate the link to the avast uninstall utility.  Thanks.

2. Last night, I went through the whole process again of uninstalling/reinstalling both avast (fresh download) and SP3.  I also ran mbam and was assured that as far as that program was concerned, I have no malware.  After that, everything worked; I was able to browse, read email, all of the things you expect to be able to do.  I used ccleaner to check the registry and it's fine.  I have scanned the hard disk looking for errors and none where found.

3. This morning, I am right back to where I was.  The avast icon in the system tray has an exclamation point, I cannot access WFW through the control panel (exact message: "Due to an unidentified problem, Windows cannot display Windows Firewall settings").  I cannot enable avast realtime shields through the avast menu.

4. I am officially lost and out of ideas, help or comments please.

1. I've never heard of something similar..!!! You won't need WFW to use any browser...!!!
2. Please stop deinstalling/reinstalling SP3 over and over again, best you can achieve is messing up your system completely..!
3. So problem is back, after all. Maybe it really would be best to follow doktornotor's solution. If you have not too much data to loose..??
4. If you don't like the idea of a newly clean installed system, we could try something else. Tell us which way you want to go...
asyn

[reallyold]

1. I've never heard of something similar..!!! You won't need WFW to use any browser...!!!
2. Please stop deinstalling/reinstalling SP3 over and over again, best you can achieve is messing up your system completely..!
3. So problem is back, after all. Maybe it really would be best to follow doktornotor's solution. If you have not too much data to loose..??
4. If you don't like the idea of a newly clean installed system, we could try something else. Tell us which way you want to go...
asyn

Well, I'm certainly not keen on reinstalling windows, that's its own special pain.  I am also interested in discovering the root cause of problems and understanding exactly what happened.  If someone has something that they could suggest or that they would like me to try on the system as it exists, I am willing to make the effort.  If everyone is tired of the problem and has better things to do with their lives, then the simple solution is to clear the slate and start over. 

I am open to suggestions and comments, thanks for the help so far.

[Dch48]

Just a wild guess, but maybe it has something to do with the fact that the HD was partitioned and formatted by Ubuntu?

[reallyold]

Just a wild guess, but maybe it has something to do with the fact that the HD was partitioned and formatted by Ubuntu?

I thought about that early on but I eventually gave up on that idea.

1. If it would have been a ubuntu problem, I think it would  have shown up immediately rather than waiting for many weeks.
2. The disk has passed all of the diagnostics I could think of including windows scandisk and chdsk.
3. there are no other software problems I can detect, everything else works just fine.
4. if it were to involve a specific portion of the disk, my multiple uninstall/reinstalls would have touched different parts of the disk
5. I've done this many times in the past, although never with XP.

[steen]

I had a minor quirk with resized partitions & the Avast tray service. Selecting repair from the install/remove CP worked for me, but a full uninstall/reinstall should have resolved the issues for you. Your problem sounds peculiar & indicative of malware, but MBAM & SAS should pick up most of these. It's unlikely, but try memtest for any obscure RAM issues.

[mkis]

Hi reallyold

I cannot find any reference to Epox KT7a raid. Are you sure that is yr mainboard? Doesn't matter too much, I know the period hardware, which was designed for AMD processors, and there was problems with shift into XP Athlons, meant tweaking the bios, etc...I'm not sure whether these issues resolved as quite a time ago, however with older mainboards such as these, problems will crop up from time to time.

perhaps you could run a HijackThis scan just to better put us in the picture

HijackThis   Click here – (will take direct to download)
http://www.filehippo.com/download_hijackthis/download/8571e06e5eb8ab03c649f3b5d647c599/

Download and run.
Then do scan and save a log file.

Post the log file to this thread. If it is too large you may have to post in two parts.

Or OTL    - see  http://forum.avast.com/index.php?topic=53253.msg451454#msg451454

You could also go to Startup manager in ccleaner
Let us know what programs are set to start with the boot up of yr system

ccleaner – open Tools in menu column on left-hand side
select Startup – what programs are enabled to start when you boot?
- provide screenshot or simply outine in yr reply post

[reallyold]

here is hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:29:29 PM, on 5/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17023)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\userinit.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
D:\WINDOWS\system32\RunDll32.exe
C:\Program files\EPoX\USDM\USDM.EXE
D:\Program Files\D4\D4.exe
D:\Program Files\Common Files\Java\Java Update\jusched.exe
D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program files\EPoX\USDM\USDM.EXE" "5000"
O4 - HKLM\..\Run: [Dimension4] D:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast5] D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{137553B9-7B8A-4D90-A5FF-259E92951B97}: NameServer = 65.32.1.70,65.32.1.65
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - D:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

Here is the startup from ccleaner:

Yes   HKCU:Run   NvMediaCenter   RUNDLL32.EXE D:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
Yes   HKCU:Run   ctfmon.exe   D:\WINDOWS\system32\ctfmon.exe
Yes   HKLM:Run   NvCplDaemon   RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
Yes   HKLM:Run   nwiz   nwiz.exe /install
Yes   HKLM:Run   Adobe Reader Speed Launcher   "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
Yes   HKLM:Run   Cmaudio   RunDll32 cmicnfg.cpl,CMICtrlWnd
Yes   HKLM:Run   EPoXUSDM   "C:\Program files\EPoX\USDM\USDM.EXE" "5000"
Yes   HKLM:Run   Dimension4   D:\Program Files\D4\D4.exe
Yes   HKLM:Run   SunJavaUpdateSched   "D:\Program Files\Common Files\Java\Java Update\jusched.exe"
Yes   HKLM:Run   avast5   D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
Yes   Startup Common   Microsoft Office.lnk   D:\Program Files\Microsoft Office\Office\OSA9.EXE

[Dch48]

I really hate when threads get cluttered with Hijackthis info. That should be sent through messages.

[DavidR]

No they shouldn't be sent through messages as, a) that is only seen by one person and b) most people seeking help haven't got 20 posts as in the case of reallyold with only 14, so can't use the PM function.

There is nothing wrong in attaching the log file to the post though.