after avast home installation: cannot acces neither internet nor LAN

Avast Free Antivirus / Premium Security
1

hello,

here is my home configuration:
1 desktop / WXP
1 labtop / WXP
1 linksys WAG54 gateway

all this used to work well together:
the 2 pcs dynamically get an IP address (192.168.1.x) from the DHCP server of the gateway to sea eachother for file sharing and access the internet.

i have just downloaded AVAST! home on my labtop and installed it. as a result the network is down now on it:
cannot access the internet, cannot access the LAN.

in fact, the PC is no more able to found the DHCP server of the gateway, so an IP address 169.254.x.x is assigned by WXP IPAC service.

I have installed AVAST! home with all the default options, no warning…

by now, the labtop is 1000% protected against viruses… but useless.

thanks for your help.

2

forgot to say:
I have de-installed AVAST! and all is ok again…

3

Very strange… ???

It could have been a conflict with another application or a bad install.
Was there any other av on the system before Avast?
If so was it completely removed (including registry keys) before installing Avast?
Can you install Avast again and see if it happens again?
If it happens again check the system log, event log and Avast log file. It may tell us more about what is going on.

4

this is a fresh installation of WXP, AVAST is the second program i have installed on it after mozilla firefox.

what i can see is that the installation of AVAST (successfull with the default options) prevent me to access to the DHCP server of the gateway (even an ipconfig/renew does not work…).

just de-installing AVAST makes all working again.

so my understanding is that this is only AVAST that causes the trouble…

5

I never have seen Avast blocking network access.
Not saying it can’t happen, but it is very unlikely.
Since you connected to the net without all secrutiy patches installed and without av software, make sure your system isn’t already infected with malware.

6

how could the labtop be infected???
as i previously said, just only de-installed AVAST makes all working again: get a correct IP address, see the LAN, connect the internet…
or are you saying that my labtop was infected by AVAST?

7

Read my post again.

how could the labtop be infected?
You went online without proper protection and like also without ALL security patches/updates installed.
or are you saying that my labtop was infected by AVAST?
No I said with MALWARE.
8

mmm…
i have reformated the disk yesterday and installed Windows XP
then get Firefox and Avast from my desktop (behind gateway’s firewall and auto protect by NAV)
then installed Firefox
then installed Avast
then cannot access neither LAN nor internet
then de-installed Avast
then able to access both LAN AND internet…

9

Was it the current build 4.5.561 installed?
was avast! able to update?
Did you try selectively shutting down providers ?
windows firewall off?
re-boot after installation?

10

not sure. i have downloaded the kit yesterday.

from the web? of course not…

what do you mean by “providers”?

yes of course, for file sharing on XP

no

note that i am not currently at home.

11

What do you mean with NAV?
Did you install avast with NAV already installed?

12

I have tried again this week-end at home.

after having re-intalling AVAST (without restarting my labtop), my internet connection and LAN connection was OK.

then I restart my labtop and what I have seen is that AVAST is computing when I boot and connect on my Local Network preventing me to get an address from my gateway’s DHCP server.

so is there a way to enable AVAST ONLY when i connect the internet and disable it at computer start up?

thanks.

13

Hi and welcome back could you give us a log file generated from HJT as it will give us a list of what utilities you are running and system specs . You can download it here http://www.allsecpros.com/hjt.html there is also a tutorial at the site to read up on.

14

ok thanks, i’ll do this this evening when i am at home. stay tuned…

15

Have you tried disabling the Network shield?
Go, Right click on the avast ball in the tast bar >>on-access protestion control>>Details (if it has less details leave it) >>Network shield>>Terminate>> no

Watchthisspace

16

Two different connections… LAN and Internet.

You can delay the avast running on the logon. Not only the ashDisp.exe (the icon) but you have to manage the Windows services:
To this, you can try Startup Delayer that controls the windows startup (Windows 98\Me\2k\XP) that does not follow a strict order.

Only when connected to the Internet?
Well, try NetRun. It will run a list of programs only when a internet connection is detected, and close/kill the same ‘list’ when the connection is lost. When I upgraded my machine to XP, the program that I was using stop working so I was forced to write this program.

  • Tray based & Quiet (no splash or nags)
  • Easy Drag & Drop setup
  • Quicker bootups
  • Internet detect via IP method
  • Supports Windows XP
  • Re-Run on re-connect
  • Small demand on system resources
  • Can set to auto-start with current user
  • FREE for all!

You can download the Beta Version (1.2.1.3). It’s stable and functional:
http://www.home.earthlink.net/~czarsoft/NetRunSetup.exe

17

below is the hjt log file before AVASt installation (all working fine):

Logfile of HijackThis v1.98.2
Scan saved at 21:38:27, on 24/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wpabaln.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\My Documents\New Folder\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip..{854FBA0D-1117-4818-9F1B-20D5C7FC7E4B}:

now is the hjt log file after AVASt installation and before restart computer (all still working fine):

Logfile of HijackThis v1.98.2
Scan saved at 21:50:19, on 24/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wpabaln.exe
C:\Documents and Settings\Owner\My Documents\New Folder\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip..{854FBA0D-1117-4818-9F1B-20D5C7FC7E4B}: NameServer = 192.168.1.1

in the end, below is the hjt log file after restart computer (all going wrong now):

Logfile of HijackThis v1.98.2
Scan saved at 21:59:34, on 24/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wpabaln.exe
C:\WINDOWS\System32\cmd.exe
C:\Documents and Settings\Owner\My Documents\New Folder\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip..{854FBA0D-1117-4818-9F1B-20D5C7FC7E4B}: NameServer = 192.168.1.1

18

With Avast installed, can you access the router form the troubled machine? (ip router = 192.168.1.1)

19

no i can’t: ping 192.168.1.1 hangs…

20

Have you tried shutting down the Avast providers one at a time?
Is there anything in the system and/or event log?
Have you set a DNS server in the network connection options?

Are you using the latest firmware for the router?
Does giving the systems a static IP changes anything?
Have you tried resetting the router?

Edit: If you use HijackThis, please use the latest version. (Currently 1.99.0)