Avast blocks webbrowser after few minutes

system · 2015-03-30T16:06:37.000Z

Check your event log and see if DNS clients events are present, error 1014

system · 2015-03-30T16:26:21.000Z

hm no, there are some '1014’s in it, but no error…

right before the issue occurred today there’s this:

30.03.2015 14:40:13 Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
30.03.2015 14:40:13 [00000944] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin80 ExpPrg 0 Fw 0 Fs 0
30.03.2015 14:40:13 [00000944] WaitForWscService( 840 ) → true, SCM OK wsc OK err 0
30.03.2015 14:40:13 [00000944] UpdateStatus AV OK status 2 sign 1
30.03.2015 14:40:13 [00000944] WaitForWscService( 840 ) → true, SCM OK wsc OK err 0
30.03.2015 14:40:13 [00000944] UpdateStatus AS OK status 2 sign 1

system · 2015-03-30T17:23:13.000Z

In your “Windows” event logs under system… it will say event ID 1014 DNS Clent Event

system · 2015-04-03T18:21:44.000Z

Hm, so repairing avast didn’t help.

dprout69 post:11:

In your “Windows” event logs under system… it will say event ID 1014 DNS Clent Event

There are few occasions when it says event 1014, but not ever in relation to the internet block :-\

I’m trying the clean reinstall tomorrow I think and will keep you posted.

Pondus · 2015-04-03T18:30:41.000Z

Tried this?
Delete all avast rules in comodo, restart computer, when comodo ask create new rules

system · 2015-04-07T10:34:06.000Z

Okay, clean re-install didn’t help…

Delete all avast rules in comodo, restart computer, when comodo ask create new rules

Going to try this now.

Asyn · 2015-04-07T10:54:44.000Z

OK, report back.

system · 2015-04-08T11:07:36.000Z

Soo, I removed the rule, restarted a few times since then (not purposefully) and Comodo doesnt even ask me to create a new rule…which seems strange, but okay. More annoyingly, it just happened again.

I was wondering, can such a block be caused by visiting certain websites? Or, by opening too many tabs simultaneously?
Because for me it seems like there’s a connection between the block and visiting opening gamestar.de and sport1.de at the very same time. Both sites are very trustworthy (one is a major gaming magazine, the other a major sports channel in Germany), so I don’t think it’s something harmful, but in retrospective the block could be related to me opening those 2 sites simultaneously.

It seems like a stretch to me, but I wouldnt know where else to look for causes

Asyn · 2015-04-08T11:10:45.000Z

To rule out an infection: Attach your basic logs. (MBAM, FRST and aswMBR…!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0

system · 2015-04-08T11:45:50.000Z

Here’s the MBAM log, I’m going to edit this posts when I have the others and bump the thread.

MBAM revealed I actually had some malware

aswMBR.exe just stops working when it comes to a specific file located in C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tool.Applications

Asyn · 2015-04-08T11:48:55.000Z

mue.92 post:18:

Here’s the MBAM log, I’m going to edit this posts when I have the others and bump the thread.

OK, please do so.

system · 2015-04-08T12:00:33.000Z

So, I added the other files, see the attachment post for more details

Asyn · 2015-04-08T12:33:14.000Z

OK, now you’ve to wait a bit…

essexboy · 2015-04-08T13:48:05.000Z

I see you have CIS installed as well have you tried disabling that ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File 2015-04-04 21:54 - 2015-04-04 21:54 - 00000000 __SHD () C:\Users\Wii\AppData\Local\EmieUserList 2015-04-04 21:54 - 2015-04-04 21:54 - 00000000 __SHD () C:\Users\Wii\AppData\Local\EmieSiteList 2015-04-04 21:54 - 2015-04-04 21:54 - 00000000 __SHD () C:\Users\Wii\AppData\Local\EmieBrowserModeList Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-04-08T14:24:37.000Z

Yes, I tried disabling CIS, the problem persists. It only gets solved by disabling avast. Of course, there might be an interaction I’m not aware of which causes the problem.

I really appreciate all your help btw I hope we get to the bottom of all this (how very selfish of me).

system · 2015-04-08T14:52:40.000Z

Have you try to set FF in Comodo FW as a Web browser ? See screenshot
Did you disable Behavioral Blocker in Comodo ? I understand that it interferes with Avast.

Pondus · 2015-04-08T15:05:28.000Z

you could also try to uninstall comodo! … and see what happens then

essexboy · 2015-04-08T16:41:04.000Z

As far as I can see from the logs there is nothing apparent that could cause this

system · 2015-04-08T18:42:27.000Z

Just a heads up, so I don’t keep you waiting. I’m going to wait if it happens again, re-install comodo and report back (in an appropriate amount of time). Thank you so much for trying to resolve the issue!

iroc9555 post:24:

Have you try to set FF in Comodo FW as a Web browser ? See screenshotDid you disable Behavioral Blocker in Comodo ? I understand that it interferes with Avast.

I set FF as web browser, maybe it helps

system · 2015-05-03T15:32:54.000Z

Hello, it happened once again a week ago, but it’s far less frequent than before…I’m not sure what it means and I might try deleting comodo, I’ll check back if I do!

Announcements