[acraftylady]

Trying to help a friend that is on basic AT&T worlnet service so she gets no free tech help from AT&T. She is using windows 98, outlook express 6 and IE 6. This is one single home computer accessing the net with dialup. When she is in IE and clicks to get her mail this error pops up from outlook express.

The connection to the server has failed account postoffice.worldnet.att.net server mailhost.worldnet.att.net protocol SMTP port 25 secure (SSL): no socket error 10065, error number 0x800CCC0E.

I googled socket error 10065 and this is what I found was it means no route to host but I am an AOL user so I have no clue about outlook express or IE so can someone explain to me what's going on and how I can help her fix it. I think she is not getting her mail and when we tried to send mail we got that error also so I don't think it's sending either. Also wepages are loading fine but when she wants to buy something and gets to the last part of the check out, when she clicks continue she gets this page cannot be displayed and can't order anything. Only when on the last part of ordering from a website and not just one site it's every site she tried to buy from so would this be connected to the socket error?

 

[starwaves77]

Hi,

Working backwards here,
Have her test the browser by going to this link
Browser SSL Test

See if she gets "this page cannot be displayed" and if the other features for secure socket are working, make a note of what the test says,

Make sure that the SSL is actually enabled in her browser;
Open Internet Explorer, click on 'Tools' then 'Internet Options' ,
Click the Advanced tab, scroll to the Security section, and then confirm the settings for
SSL 2.0,
SSL 3.0,
TLS 1.0,
and PCT 1.0 are ALL checked,
------------------

Also check that your Explorer 'Security' settings are medium:
While still in Explorer, click on 'Tools', then 'Internet Options' ,
Click the Security tab, then choose the 'Internet' zone,
click the Default Level button.
Select the Low-Medium level, just temporarily, and test ....

When she connects to a secure site the connection should be established through port 443 or you will get 'this page cannot be displayed' , confirm that by having her go to her banking / shopping / credit card site and logging in, after that open a 'dos prompt' >

Click on Start / Programs / Ms Dos Prompt ,
At the blinking cursor type in:
netstat -a

All of her connections will stroll by, in the middle row check that you see the name of the secure website (exp: Wachovia) followed by :443, and to the far right you should see ESTABLISHED, that's the connection,

If you don't see the name of the website, you may see an IP Adress xxx.xxx.xxx.xxx followed by :443, if it doesn't 'name' the website,

Example: 192.56.78.137:443
Either way, you'll be looking in the middle row for :443 with either 'listening' or 'established' to the right of the adress,

Another way of testing this is by linking the website's adress with port 443,

Lets say she goes to amazon.com to buy something,
type in exactly> https://amazon.com:443
Note there is an 's' in 'https',

Does she access the 'secure' page when attempting to make a purchase?
--------------

Clear the Secure Sockets Layer (SSL) slate and AutoComplete history:

Open Internet Explorer, click Tools then Internet Options, then click the Content tab, Under Certificates, click 'Clear SSL State'

In Personal information, click 'AutoComplete'
In the 'Clear AutoComplete history', click 'Clear Forms'.
----------------
Make sure to delete all the 'temporary internet' & 'temp' files,

See if you break some ground with this,

 

[acraftylady]

Ok I have some new info. First of all I didn't realize it was only phone support she is not entitled to. On the AT&T help site I see she can e-mail or get live tech help. I didn't realize that yesterday until I got home on my computer and fished around on the site more. Also on their helps site is the latest goings on and it seems as of 3/29 their is an issue with some people tyring to retrieve their mail form the net and they are working on it so that could explain why we couldn't get the page yesterday but I could today from my computer.

Now in the help site it had step by step how to check the account. I went in outlook under tools, accounts and looked. All matches what they say except the last thing for connection is wrong but I have no clue how to fix it so I may have to contact them. AT&T says there should be a check mark in always connecto to this account using AT&T connection service. Trouble is it says Alta Vista now and when she clicks the drop down arrorw there is no choice for AT&T. As far as I know she has nothing to do with Alta Vista. I had her check this while I was on the phone with here so I don't remember the other choices but she said AT&T was not listed so I am guessing this is the problem but I have no clue what to do from here? I am no computer expert but I try and help people so first I will uncheck then recheck the box and see what happens. I will check out that site because their is still the issue of not being able to order stuff. I think she has Norton security or system works can't remember but I wonder if someone messed around in there if she is using a firewall with Norton or something?

 

[acraftylady]

OK I just got back from her computer. I couldn't find where the PCT 1.0 is listed but the TLS 1.0 was not checked so I unchecked the other two, re-checked them and checked that one. Then when I opened outlook express I still got that error but when I went to connections AT&T was now in the drop down list and I selected it and checked the box so at least that settings is the way it's supposed to be according to AT&T help site. We signed off and back on but still getting that error with mail.

Now she managed to recover her password because AT&T has a phone in feature where it will read your password over the phone so she has it written down again and stored away where she knows it will be from now on.

When we went on the help site for AT&T we cannot connect for live chat because we get this page cannot be displayed but it works from my computer so something is obviously wrong with her browser. I can't get to any sites where the little lock should come up so I couldn't do the DOS prompt suggestion you said. Tried to go to my cell phone company and check my account but the log in page won't display. Tried to go to my credit card company and same thing when I click the log in page to log in and check my account, same for AOL.com to check my mail so she can't get into her AT&T mail from the web either because of this. Went into Internet options and it was set at medium so I put it at medium low and still cannot get in, set it to low and same results.

Lets say she goes to amazon.com to buy something, type in exactly> https://amazon.com:443 Note there is an 's' in 'https',

I forgot to try doing the 443 thing so tomorrow if possible.

Clear the Secure Sockets Layer (SSL) slate and AutoComplete history:

Also could not find where it said clear SSL slate. I see it when I go into my IE but I swear that button was not there in her IE but maybe I was getting tired and not seeing things right so I will have to check again when I get back there.

When I went to the verisign site and scanned that worked and here is what is says.

Current browser version MSIE 6.0
recommendation- no upgrade. You browser supports strong encryption and contains the recommended level of security.

Secure browsing support- your browser is capable of securely communicating with web site certificates.

strong encryption support- your domestic browser currently supports strong enctryption 128- bit SSL sessions.

Digital certificate support- your browser can utilize personal digital id's for secure access control and e-mail.

Any help you can give to fix this would be greatly appreciated.

 

[VirtualMe]

I don't think this is it but try it just to eliminate one more possibility.

Start Norton SystemWorks

click on Options

click Norton Anti-Virus

click Email

Under Email Scanning

What to Scan

Remove the check marks from...

Scan incoming Email

Scan outcoming Email

Open Outlook Express and see if she can recieve her email.

If by chance she can recieve her email, after her email finishes downloading leave Outlook Express open and connected to the internet.

Put the check marks back by the...

Scan incoming Email

Scan outcoming Email

It may be of help to dowload Hijack This

Unzip it into a permenant folder. Do not leave it in or put it in a TEMP folder, as this will not let it make backups in case something goes wrong.

Then click HijackThis.exe

Click Scan

The Scan Button changes to a Save Log button.

Click the Save Log button to create a file named Hijackthis.log.

A dialog box will pop up. Use it to select the location where you will save the log. (I save mine to desktop so it is easy to find)

Close the program.

Open the Log in Notepad.

Highlight the entire contents.

Copy and paste the contents of the HijackThis log into your post.

Wait for help! DO NOT FIX ANYTHING WITHOUT SOMEONE HELPING!

IF you get an error saying msvbvm60.dll is missing,
Download and run the MS visual basic 6.0 runtime files first.

 

[acraftylady]

Thanks, I'll see if I can get over there again tonight and try that stuff. I ran adaware and spybot yesterday and I did up date them before I ran them. There were a few pieces of spyware but not much. I had installed those a few months ago and told her to run them every once ina while so I think she is doing that. I will do a hijack this log and post it.

 

[acraftylady]

OK, I am on her computer now and can be here another hour so I hope someone can reply in that time. She has Norton Internet security 2003 but she was supposed to renew her virus and firewall subscription in December and February and she didn't because she didn't know she was supposed to pay for that ever year and never got a message for her Norton so none of that is functioning. Could that be what's causing the problem? I just have Norton Antivirus 2003 so with the Norton Security is the firewall and virus two seperate payments? It seemed like it was in looking around in ther but I am not sure. I am trying to find where in Norton Security I click to get to the page and pay because she want's to do that. Also recycle bin is protected by Norton and when I try and emtpy it the un-erase wizard comes up so.

I forgot here's her hijack this log if it matters still.

Logfile of HijackThis v1.97.7
Scan saved at 1:25:10 PM, on 3/30/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\ENCOMPASS\ENCMONTR.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\TEXTBRIDGE PRO 8.0\BIN\INSTANTACCESS.EXE
C:\PROGRAM FILES\AT&T\WNCLIENT\PROGRAMS\WNCONNECT.EXE
C:\PROGRAM FILES\AT&T\WNCLIENT\PROGRAMS\WNCSMSERVER.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\HPFTBX12.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\NISUM.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\LUCOMSERVER.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.worldnet.att.net/ie4/search/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.robofind.com/home.html?Click -YES- To Proceed
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet Service
F1 - win.ini: run=HPFSCHED
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [Change Lines] C:\chngline.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\BIN\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Encompass_ENCMONTR] C:\Program Files\Encompass\ENCMONTR.EXE
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\BIN\REGIST~1.EXE
O4 - Startup: PowerReg Scheduler.exe
O12 - Plugin for .mid: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .wav: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {21BBAC00-2C8B-11D3-82C3-444553540000} (AsyncFileRead Class) - http://live.av.com/cobrand/microportal/altavistatracker/rsafd.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {1A4DA620-6217-11CF-BE62-0080C72EDD2D} (MarqueeCtl Object) - http://activex.microsoft.com/activex/controls/iexplorer/x86/marquee.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {E389B374-BB5A-4A73-ACF4-3CE63E4C1DE9} (Brxpdf5 Control) - http://a19.g.akamai.net/7/19/7125/1235/ftp.coupons.com/brxpdf5.cab
O16 - DPF: {E2CF5C45-7CCC-11D4-9BD1-0080C6F60B6A} (CouponsComBrxpdf2 Control) - http://ftp.coupons.com/brxpdf2.cab
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://kohler1.view22.com/view22/V22RTE.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.142/code/PWActiveXImgCtl.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37911.5646643518
O16 - DPF: {B69F2A9C-E470-11D3-AFA3-525400DB7692} (Actimage Room Control) - http://ib.armstrong.com/ib/databases/actimage30717.cab

 

[starwaves77]

Hi Virtual ME,
That is a good idea, I have a friend who couldn't "open" their Outlook at all [not a connection issue] and when they applied the Norton tweak like you mentioned to disable the virus scan, it opened perfectly,

Craftlady,
The important checks in explorer/advanced/security were the ones you made for PCT 1.0, SSL 2.0 and SSL 3.0, if that is now checked your good,

Double check>
Open Explorer, click Tools / Internet Options / Programs
From the e-mail menu item select Outlook Express,

At any secure site ~ you get 'this page cannot be displayed?' even Amazon.com ?, I went to Amazon and the 443 port was not 'established' until I used the 'log in', during that sequence, port 443 became an 'established' connection, so you should be able to go there, do the 'netstat -a' command, then click on the 'log in' and then check for that port in 'netstat' again, without having to 'proceed to checkout' etc,

When you mentioned you could not find 'where it said clear SSL slate' don't worry, your not seeing things, it's not in her version,

 

[acraftylady]

I get the page cannot be displayed at any secure site and darn it all I forgot about trying the 443 because I didn't have long to work on it so it will have to wait. I found the Norton page to renew her stuff and it wouldn't let me on so it's any site I think where the lilttle lock needs to come up as all regular sites are fine and I can get into yahoo mail fine.

The important checks in explorer/advanced/security were the ones you made for PCT 1.0, SSL 2.0 and SSL 3.0, if that is now checked your good,

Ok the 2.0 and 3.0 are checked but I need to know where to find PCT 1.0, it's not in the list under those two but there is TSL 1.0 in that list and it's unchecked. I tried checking that yesterday but it made no difference.

Should I uninstall Norton for now do you think? I am confused aobut Norton Internet Security. I know you pay for the virus updates but is their a fee for the security part or is it all rolled into one payment?

I am sorry I can't give all information at once but it's hard for me because I know my XP system with AOL very well but this will be a learning tool for me as I love helping people figure out computer stuff.

 

[starwaves77]

Test this: type the this in your address bar,
https://amazon.com:443, see if you get to the website, then test one of your personal 'secure' sites, just substitute your website for 'amazon.com' and see if you can log in,

"Ok the 2.0 and 3.0 are checked but I need to know where to find PCT 1.0, "

PCT 1.0 is listed with the SSL ones you checked in the 'security' section ...

I know you pay for the virus updates but is their a fee for the security part or is it all rolled into one payment?

All one payment, and not paying for the subscription won't affect this.......

------------

The hijack log is very clean, nothing in there that would be affecting this, just a few minor cleanups>

Run Hijack again, put a check in the following, then click on the 'FIX' button,

C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.robofind.com/home.html?C... To Proceed

O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - Startup: PowerReg Scheduler.exe

O16 - DPF: {E2CF5C45-7CCC-11D4-9BD1-0080C6F60B6A} (CouponsComBrxpdf2 Control) - http://ftp.coupons.com/brxpdf2.cab

 

[acraftylady]

Ok I don't know when I can get at her computer again but I will try that stuff and get back on what happens.

PCT 1.0 is listed with the SSL ones you checked in the 'security' section ...

Ok in security there is no PCT 1.0 listed for me to put a check by. I am looking in internet options, advanced, and under security the only thing I see in that list is TLS 1.0 with the other two no PCT, same on my computer but I will look again when I get on her computer and see if I am just not seeing right in there.

 

[starwaves77]

Craftlady,

Also check her outgoing mail server settings in Outlook:

Open her Outlook Express,
Open the 'Tools' menu, select 'Accounts'.
Select the 'Mail' tab.
Select her server (AT&T)
Click 'Properties', then click the 'Servers' tab,

Look at the 'Outgoing mail (SMTP) setting'
You should see mailhost.worldnet.att.net, if not type it in,
Also make sure the 'Incoming (POP3) mail server' is postoffice.worldnet.att.net

Close all the windows and Outlook too,
Open Outlook again, test her mail accounts online,

 

[acraftylady]

Thanks but I already checked all that, found a nice diagram on the AT&T help site to guide me through. The only trouble was the last one for connection said alta vista and AT&T was not in the drop down. After changing something that someone else said finally got that to show up in the list and we have it set at AT&T and all other stuff in there is worded exactly as should be as far as I can see. She is not home so it might be a few days before I can get on her computer again. It may take me a week working on this but as soon as I get all the other info asked for I will post right back.

 

[acraftylady]

When I try this https://amazon.com:443 page cannot be displayed. Same thing when I try it with discover card or any site so what does that mean?

Also I checked again and there is no PCT in the security spot to tick, is that important?

I check the error messag again when opening outlook express and I just realized there are two, one is kind of smushed up close against the other one so I thought it was the same but the port number is different.

The connection to the server has failed account postoffice.worldnet.att.net server mailhost.worldnet.att.net protocol SMTP port 25 secure (SSL): no socket error 10065, error number 0x800CCC0E.

The connection to the server has failed. Account: 'postoffice.worldnet.att.net', Server: 'postoffice.worldnet.att.net', Protocol: POP3, Port: 110, Secure(SSL): No, Socket Error: 10065, Error Number: 0x800CCC0E

 

[acraftylady]

OK I just googled that second error message with the port 110 and lookie what I found on an AT&T worldnet page. Look where is says troubleshooting. Would this have anything to do with the e-mail problem? I know you said Norton was not involved and I did uncheck e-mail scanning even though her subscription ran out and that made no difference but I am wondering since her subscription ran out and e-mail protection is enabled if that would cause problems, same with Norton security trying to access secure sites? I know a few days ago I checked the AT&T service board and they said their were e-mail problems but now the service bulletin says it's fixed and she has had this mail problem for a month, only just now getting around to wanting it fixed.

http://www.wurd.com/cl_email_faq_norton.php

 

[VirtualMe]

I wouldn't think the subscription running out would keep her from accessing SSL sites.

See if anything here helps.

Error: "The connection to the server has failed. . . . " when sending or receiving email with Outlook

http://support.microsoft.com/default.aspx?kbid=302339

 

[acraftylady]

I wouldn't think the subscription running out would keep her from accessing SSL sites.


I wouldn't think that either but I am grasping at any kind of a solution since I am so puzzled about all this. I will read through the symantec site. The Microsoft link says if you are connected to the net through MSN and she is using AT&T worldnet. Maybe I will disable everything in Norton just for the heck of it and see what happens. When I looked in Norton Security 2003 it said her virus defs expired in December and Norton Security in February and she said this has been going on for a month maybe more I bet so I was thinking if it started in February when the security ran out that was the problem.

Does anyone know if their is a way to actaully call Symantec to renew?

 

[starwaves77]

Running Norton can affect this, but 'not paying' for their subscription will not. I would go back and disable the 'email scan' and leave it that way till this is figured out, also disable Norton itself, right click on it's icon in the tray and see if it has an option for 'auto protect', disable it for now,
------------

There is another feature in her AT&T software that should automatically restore any incorrect settings called the 'auto restore', load up her AT&T software, and look for the auto restore feature,

AUTO RESTORE

-----------------
Run the 'netstat -a' command: start / run /ms dos prompt ,
And see what is 'listening' on your secure site connections, go to your secure links with the :443 port added like before, then open the netstat command, and try and find what port the website is using, or if you do see 443,

--------------

Here's Microsoft's configuration for Outlook:

Configuring Outlook

There is a file used by AT&T to keep track of all the settings, it's called account.txt, reg.ini, or acctinfo.txt. Do a search using FIND for them, open the one with the most recent date to review the settings for AT&T. If you find blank entries for different settings, then use the 'auto restore' feature to reset them.

She might also have a 'FIX IT' button. Go to Start / Programs / AT&T Worldnet Software, see if it's listed in the menu, if so run it, if not you can get it by upgrading the connection dialer
FIX IT

 

[acraftylady]

Thank you, all that seems useful but it will be a few days before I can get to it. I have a feeling her AT&T software is older but I will check what version and see if I can find those things or see about upgrading it.


Also when I try the 443 thing do you mean even if it says page cannot be displayed when accessing that way I can still run the net stat command? That's where I am a little confused because using 443 still won't let us access anything, says this page cannot be displayed not matter what site we try that with secure or non secure.

 

[starwaves77]

Also when I try the 443 thing do you mean even if it says page cannot be displayed

Yes, only now we know your not going to connect using it as part of the address you type, but still check to see how your computer is using it with the 'netstat -a' command from DOS, follow those steps in my previous post on how to check,

When you get 'this page cannot be displayed' from Amazon, it's because it cannot connect through port 443 for some reason, , ,when you go to Amazon.com without adding :443, you will connect normally, but you won't see the padlock in the bottom right corner, once you log in, it will open port 443 to secure the connection and now you see the padlock. So when you type in :443 as part of your address the website is now connecting through that port and you will automatically have the secure [padlock] connection whether your logged in or not, and when you use the netstat -a command it will show that connection is 'established' through port :443

For sure, shut down her Norton anti-virus, disable the firewall if it's running, don't think it is though, and upgrade her AT&T software, you can download that directly from the site your using to study this,

Bty, how did this all come about? Was this a sudden occurrence? What was happening right before she lost this connection?

If you haven't done this already, it is important to delete all the temporary internet files, cookies, temp files, history,

The other easy thing to look at is her 'hosts' file, it might contain some corrupt address's, however it's much easier for you to just delete that file and let windows rebuild it,

Using FIND, do a search for "hosts" , use the quotations and it will eliminate other similar names, it should come back with hosts in the windows folder, RIGHT click it and delete,

Reboot and it will recreate the default version. Test her mail.