Avast 7 and Comodo Firewall

[mchain]

@Hellion post:9

Hi Iroc,

My Comodo firewall working OK here. Did you check if you still have your exclusions for each other progs in place after the upgrade ?

The only exclusions I have are in Avast. Excluded are cmdagent memory process and the Comodo install folder.

Have you tested properly?

Clear your Comodo rules and block your browser and see if you can access webpages.

Glad I came across this topic. No idea whatsoever.

As a test, I changed the rules for FF from Web Browser to Blocked Application. FF would not connect. Changed back again to Web Browser, connectivity back. Could this bug be OS specific? Maybe just Win7? Does anyone see a pattern here?

[system]

@NON post:18

If you enable “Scan traffic from well-known browser processes only” in Web Shield Expert Settings, this behavior should be changed.
This option is disabled by default, and with default settings all traffic via port 80 and some are redirected to AvastSvc.exe and firewall cannot stop them.
If you want to use firewall effectively, you have to enable this option.

Had the same problem with webshield with the Windows 7 firewall and this is the fix.

[system]

Hi All,

I would just like to report back on my findings…

I added all Exclusions mentioned by Iroc and I enabled the “scan well known browser processes only” and my situation has not changed.

Firefox blocked, but I can browse freely.

Windows 7 Home Premium x64 | Comodo latest | Avast latest

[NON]

@Hellion post:23

Hi All,

I would just like to report back on my findings…

I added all Exclusions mentioned by Iroc and I enabled the “scan well known browser processes only” and my situation has not changed.

Firefox blocked, but I can browse freely.

Windows 7 Home Premium x64 | Comodo latest | Avast latest

Firefox is “well-known browser” so avast redirects Firefox’s connection even with “scan well known browser processes only” enabled.
I remember there is an option called “Excluded processes” in Web Shield settings, so if you exclude firefox.exe then you could block Firefox by Comodo. Of course, web shield doesn’t work with this settings.

[system]

Hi NON,

I want to be able to control my applications, but also receive maximum protection from Avast.

EDIT: Another Comodo thread where Avast 7 has rendered a user’s FW useless - https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.0.html

[system]

Hi all,

Sorry for double post, but no one has responded in 24 H.

This is a really big security issue!

[NON]

Set Firefos’s proxy settings to localhost:12080, then Comodo can block firefox connection.
localhost:12080 means Web Shield, so Web Shield can scan Firefox traffics.

I would say this is how Web Shield works, so it can’t be helped if you want further control.
At least I don’t know the way to do it.
And I don’t see any reason to manually allow/block Firefox connections…

[system]

Just thought I’d let you know the problem’s not confined to Comodo firewall, it also happens with the Windows 7 firewall and it’s not just about firefox. You can easily try this.

Install Avast 7 and make sure everything works correctly
Change the properties of the Windows 7 firewall profiles, so that ‘Outbound connections that do not match a rule are blocked’
Try to make a connection with a browser - it should fail because there’s no rule to allow the connection.
Now add a rule to allow AvastSvc.exe to make outbound connections.
Reopen you browser and try to make a connection. This time it will succeed, even though it still doesn’t have a rule of it’s own.
Now open any application that uses a direct connection over TCP port 80 for updates and try to update. It will also succeed, again without an explicit rule

These connections work because they being routed through the Avast proxy and it shouldn’t be happening this way, it’s making a mockery of the firewall(s). There again, the firewall(s) should be able to block these connections…

Edit: If an explicit block rule, for the browser, is added to the firewall, connections can still be made. This is in a firewall where block rules take precedence over allow rules.

If anyone has tried any other firewalls it would be good to know if they also allow these connections.

[system]

Hi Dogstar,

Please view this post in the Comodo forums.

Radaghast did some tests with Firewalls - https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.15.html

[system]

@Hellion post:29

Hi Dogstar,

Please view this post in the Comodo forums.

Radaghast did some tests with Firewalls - https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.15.html

Thanks, I’ll take a look.

[system]

Hi,

I really wish someone on the Avast team would post on here so we know something is being done.

I have a feeling this Issue with Comodo is being ignored.

[system]

@Hellion post:31

I really wish someone on the Avast team would post on here so we know something is being done.

+1

Eventhough it seems a Comodo bug and it is not seen in Windows XP, there are a lot of W7 users running Avast! free ( no firewall ) and Comodo firewall who might not be aware of this.

Radaghast, a Comodo’s hero, already file a bug report after he ran test with several firewalls.

https://forums.comodo.com/firewall-help-cis/comodo-firewall-and-avast-7-t82382.0.html;msg588619#msg588619

I have to point out that this behavior also occurs with W7 firewall so beware.

[MrMaxaMan]

I will wait until this problem is sorted out before I update to Avast 7.

[NON]

@Dumper post:33

I will wait until this problem is sorted out before I update to Avast 7.

Well, avast6 also have this “problem”.

[system]

@NON post:34

@Dumper post:33

I will wait until this problem is sorted out before I update to Avast 7.

Well, avast6 also have this “problem”.

Perhaps you don’t really understand the problem, but I can assure you, this issue doesn’t exist in Avast 6.

[system]

Hi,

I agree with Dogstar,

This issue is not present in Avast 6

[carfal]

Hi. The suggestion to

enable "Scan traffic from well-known browser processes only" in Web Shield Expert Settings

i think is the best work around for now.

I did discover however (using Snagit v11 in this example) that if i first left the “Scan traffic from well-known browser processes only” option enabled and did an “upgrade check” from within Snagit that a pop up from Comodo would appear (the option to “Remember me” i would leave unticked).

If i then disabled the “Scan traffic from well-known browser processes only” option, Comodo popup DID NOT appear and access was granted. Of coarse the whole point of this thread is that this should not happen.

Now the important bit. If i now re-enable the “Scan traffic from well-known browser processes only” option and run the “Upgrade check” from within Snagit, access is now also granted without warning whereas before, it didn’t?? Somehow the previous illegal “allow” is remembered. I guessed that a reboot would fix this and sure enough it did.

So it seems that by testing this issue by turning the “Scan traffic from well-known browser processes only” on and off in one session will in itself wreak havoc and give undesired results.

So to summarise, enable “Scan traffic from well-known browser processes only” in Web Shield Expert Settings and reboot. Now run your tests and see if this solves your issues.

Hope this helps.

[system]

Hi,

Tried Release 2 and the problem still persists.

[system]

Hi,

an program update was available today.

I installed it. (I was running Avast 7 R2)

The problem still persists.

My Firefox and Thunderbird still work normally (With no rules or explicit block rules, except https is blocked in FF though)

I have “Scan traffic from well-known browser processes only” Enabled, but I’m pretty sure the Mozilla processes are Very well known.

I really hope a Fix will be presented, or at least a reason why not.

At the moment I feel that Avast is not even aware of this issue, nor do they care.

[system]

Same issues here, had to roll back to version 6 so comodo would function correctly.

This is a serious issue and should have been addressed immediately, as it also effects other firewalls as well, like windows 7’s firewall.

Not to mention most with this issue wouldn’t even be aware of it…