Hi,
I have been using AVAST for about 1.5 years, doing fine with it. Seems really good to me. In the last couple of weeks, i keep getting this message, popping up on my screen:
Internet TimeOut Connection Elapsed! Continue Waiting? (explorer.exe->mail.charter.net25)
It does this pop-up CONSTANTLY.
Charter.net is my internet provider. I called and talked to them.
They don’t have a clue, just say it must be a virus, they’ve never heard of AVAST and I should get a “real” virus scanner. Had me do one at Housecall.com, which found 2 trojan horses, which I deleted. But it this message keeps popping up? Any ideas?
hi and welcome jan,
Is it your mail program giving the warning/notification or Internet explorer? If you search for timeout connection in our forum search you will see how many others have dealt with this problem.
As for the suggestion of the experts at your service provider. It is always easy to throw money at a problem and hope it goes away.Im guessing they tried to sell you an alternative maybe.
What might be a worthwhile addition to your protection strategy is a trojan scanner like A squared or ewido or spybot these are all free and run well alongside Avast!
these and many others freely available here http://spyros.atspace.com/security.html
good luck
Thanks - I’m not using IE, altho it is on my computer (isn’t it on everyone’s? I couldn’t even delete it when I tried.) I use Mozilla Firefox and Thunderbird. But this message pops up even if both programs are closed. And the fact that it shows "internet.exe-> …) makes me think it’s cnnnected to IE rather than Firefox.
The other problem that seems to be happening at the same time is that my email program only works sporadically. When I spoke with my ISP today, they said that they had blocked my emails because it looked like I was spamming. I don’t do that, but had sent a few emails with multiple recipients in the last few weeks. After they unblocked me, I thought it would be better, but it’s not. Sometimes it works and sometimes it doesn’t. Completely unpredictable.
I tried to search the forums, but there is so much there - it’s hard to sift thru. Can you advise what search terms would give me the best results? So far I’ve found nothing helpful.
Is there a way to call someone at AVAST and actually talk to a person? That would be so great . . . .
There is malware that “hijacks” explorer.exe (which you have pointed out is the program apparently sending SMTP traffic to your mail server) for example MyDoom.
Explorer.exe (which is different from Internet Explorer) should not be connecting to your mail server as part of its normal activities so I strongly support the running of the scans recommended by Cloussau.
Ewido (www.ewido.net) is very easy to run and is frequently recommended, but be advised you cannot run it from Firefox - it uses Microsoft’s ActiveX - so it has to be run from IE.
The timeout notifications are specifically generated by e-mail programs not being able to correctly function.
It could be that the infections you repaired/removed had done some damage to those functions. personally I loathe anything related to e-mail as its never simple. Can i suggest you visit the link in previous post and download a little utility called hyjack this. Run it and generate a log. post that log here and someone can look it over and see where you are at.
When I spoke with my ISP today, they said that they had blocked my emails because it looked like I was spamming.
Having re-read your post it seems more like the infection you had was sending mass messages. This has caused your ISP to block your mail access.
Do you remember what the trojans were that you dealt with?
You really need to post the HJT log as your next step.
ewido does not create a log file unless you click on the button at the end to do so. Sorry - should have warned you of that - I made the same mistake last time I ran it.
Let us know if the ewido cleanup has made any difference to the timeout problem.
I see a couple of immediate problems that i can definitely say should go
C:\WINNT\System32\hkcmd.exe is suspect i think.
look in add/remove programs for anything related to viewpoint and Aim these are not nessesarily bad but troublesome unless you want them.
If there is no uninstaller for them then run HJT again and tick the boxes next to them and “Fix” these.
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\AIM95\aim.exe
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O4 - HKLM..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
Make sure that the log of this scan is saved somewhere in case we need to backtrack ok
also i would suggest you remove the spyware program you have installed as it is recognised as a rogue program according to this list http://www.spywarewarrior.com/rogue_anti-spyware.htm
good luck with all that and post back if you have any problems
ok, so I feel like I’ve scanned this stupid machine all day long with I-don’t -know-how-many different programs, and they all have found stuff and deleted it. This Hijack thing - well, I don’t exactly understand what this file it generates tells me, but I deleted all the Viewpoint stuff. Don’t want to get rid of AOL instant messenger, which is the other thing you suggested. I use it to IM with my adult kids.
I’ve attached the Hijack scan that I just did again after fixing and deleting according to your suggestions, but those annoying Timeout windows keep appearing anyway. And whenever I am online, my son’s computer that gets it’s signal thru our wireless router runs REALLY slowly - he’s not happy. Mine runs slow too - that wasn’t happening yesterday, but all the rest was.
Should EVERYTHING with the WINNT\system32 phrase be deleted?
Do you think I have to take this to a PC guy and have him figure out where the “bug” is that’s causing slow runtimes, the Timeouts, and the inconsistent Email availability? Seems like it shouldn’t be so hard to get rid of something you don’t want.
And anyway, should Avast be picking up all this stuff, instead of having to use so many different programs?
the suggestions i have made are only those of a fellow user and not an “expert” and am reluctant to suggest going any further without having someone more experienced oversee the changes. there are several entries beginning with win32 that seem irregular but they require searching and verification before removal.
Unfortunately im at work and dont have the time however there are plenty here who can help if you are prepared to wait. I hope the removal of Viewpoint has had an impact but it sounds like there`s more to do.
If you have someone you can call into your home then thats probably the fastest way to get a solution but I believe there is sufficient knowledge here if you are prepared to be patient. The infection your system had and maybe still has has possibly compromised your system to the point that you may need to format and reload at some point.
Its unfortunate that the most learning is done through difficult times like this .
well, for someone who isn’t an expert, you sure seem to know what you’re doing. Thanks so much for taking this much time in the middle of your work day - wow, I didn’t mean to intrude into anyone’s personal time.
Anyway, if anyone else has any suggestions, let me know. I’m using my laptop for now - which, altho it’s connected to the same wireless system, isn’t having any trouble. At least it’s obvious which computer in the house is definitely the problem. The people at my ISP tried to imply it was the whole system. But of course they want me to buy their virus program for 5$ per month and wanted to criticize Avast.
Thats quite ok , i and many others volunteer our time as gesture of giving back to the community where we can and enjoy helping others. There are posters here from Alwil who help customers/users as well but mostly with problems related to their product.
I am sure that you must be rather frustrated with this problem by now. I am sorry to intrude with a couple of thoughts that may seem to run counter to the other advice you have been given and I certainly do not want to cause you any further frustration.
I did not see any evidence in your log that you are running a Firewall, for most of us these days a Firewall is a pretty important way of protecting our system. Do you use one?
From your log the only piece of software running on your system that really stands out to me as a possible issue is “SpywareCleaner” which seems to have something of a questionable reputation for being more foe than friend. Do you recall when you installed this product?
As to running foul of your ISP for spamming - there may be a way of stopping the problem from getting outside your system and upsetting your ISP but only if you have a firewall installed. If you are not using one may I suggest the ZoneAlarm free edition that many of us here are using along with avast! quite happily?
Alan
Thanks - that is very helpful. I thought that part of Avast was a firewal - that WebShield part. Apparently not, eh? Silly me.
Anyway, I’ll do that asap.
The Spyware Cleaner was just downloaded yesterday, as part of my effort to fix the problem. It came up when I went to HiJack This. Thought that was what I was supposed to have used, then figured out it was something else, but not before using it. I can get rid of it, of course.
I installed Zone Alarm and after configuing a few things (yikes!), it seems to be helping. I had to tell it not to send out messages with .exe endings, and that caused a problem, cuz there are several programs that use that. But I was able to see when the explorer.exe one tried to send - and block it. Now those timeout messages are gone.
However, I have a different problem. Now when I’m shopping online, it won’t let me check out of any website, like Amazon. I had a shopping cart full of stuff saved there, and when I add an item, it removes everything else that was there. And when I try to check, it thinks the cart is empty. Is there something in Zone Alarm I need to change to get it to leave this stuff alone?
