Avast blocks webbrowser after few minutes

Staticguy · 2015-03-30T12:44:38.000Z

What previous antivirus did you use? Did you use it’s uninstaller utility after you have uninstalled it via add/remove?
Did you try doing a repair of avast via add/remove?

system · 2015-03-30T12:54:36.000Z

Which Avast…? (Free/Pro/IS/Premier)
Which version…?
OS…? (32/64 Bit…? - which SP…?)
Other security related software installed…?
Which AV(s) did you use before Avast…?

-Avast Free Antivirus
-2015.10.2.2215

Win 7 64 bit, SP1
Comodo Firewall
I only use and have used Avast

Did you try doing a repair of avast via add/remove?
No I didn’t, trying it now (kind of thought an update was sufficent.) Though results might now be visible right now, it happens quite randomly.

Maybe you need to examine your firewall and if it’s interfering with Avast ???

Hmm maybe…but as I said, the issue is solved when I deactivate Avast. I have tried it with my firewall of course, but the issue persisted.

Thanks for the quick replies!

Asyn · 2015-03-30T12:56:22.000Z

If you’ve still problems after the repair, try a clean reinstall:

Download Avast Free Antivirus: https://files.avast.com/iavs9x/avast_free_antivirus_setup.exe
Follow instructions: https://www.avast.com/uninstall-utility (Run this tool for all prior installed Avast versions…!!)
Reinstall Avast with the downloaded installer from point 1.
Reboot.

system · 2015-03-30T13:01:20.000Z

Okay, did the repair, let’s see what happens.

Regarding the clean re-install, I’ve heard that the firewall should be deactivated while installing an anitvirus due to complications in the registry (or something like that). Is this something I should look out for, or can I just install it?

Asyn · 2015-03-30T13:07:14.000Z

mue.92 post:7:

Regarding the clean re-install, I’ve heard that the firewall should be deactivated while installing an anitvirus due to complications in the registry (or something like that). Is this something I should look out for, or can I just install it?

Never had any problems with Comodo.

system · 2015-03-30T16:06:37.000Z

Check your event log and see if DNS clients events are present, error 1014

system · 2015-03-30T16:26:21.000Z

hm no, there are some '1014’s in it, but no error…

right before the issue occurred today there’s this:

30.03.2015 14:40:13 Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
30.03.2015 14:40:13 [00000944] WriteAVASFirewallStat SignUpToDate 1 preVis0 IsWin80 ExpPrg 0 Fw 0 Fs 0
30.03.2015 14:40:13 [00000944] WaitForWscService( 840 ) → true, SCM OK wsc OK err 0
30.03.2015 14:40:13 [00000944] UpdateStatus AV OK status 2 sign 1
30.03.2015 14:40:13 [00000944] WaitForWscService( 840 ) → true, SCM OK wsc OK err 0
30.03.2015 14:40:13 [00000944] UpdateStatus AS OK status 2 sign 1

system · 2015-03-30T17:23:13.000Z

In your “Windows” event logs under system… it will say event ID 1014 DNS Clent Event

system · 2015-04-03T18:21:44.000Z

Hm, so repairing avast didn’t help.

dprout69 post:11:

In your “Windows” event logs under system… it will say event ID 1014 DNS Clent Event

There are few occasions when it says event 1014, but not ever in relation to the internet block :-\

I’m trying the clean reinstall tomorrow I think and will keep you posted.

Pondus · 2015-04-03T18:30:41.000Z

Tried this?
Delete all avast rules in comodo, restart computer, when comodo ask create new rules

system · 2015-04-07T10:34:06.000Z

Okay, clean re-install didn’t help…

Delete all avast rules in comodo, restart computer, when comodo ask create new rules

Going to try this now.

Asyn · 2015-04-07T10:54:44.000Z

OK, report back.

system · 2015-04-08T11:07:36.000Z

Soo, I removed the rule, restarted a few times since then (not purposefully) and Comodo doesnt even ask me to create a new rule…which seems strange, but okay. More annoyingly, it just happened again.

I was wondering, can such a block be caused by visiting certain websites? Or, by opening too many tabs simultaneously?
Because for me it seems like there’s a connection between the block and visiting opening gamestar.de and sport1.de at the very same time. Both sites are very trustworthy (one is a major gaming magazine, the other a major sports channel in Germany), so I don’t think it’s something harmful, but in retrospective the block could be related to me opening those 2 sites simultaneously.

It seems like a stretch to me, but I wouldnt know where else to look for causes

Asyn · 2015-04-08T11:10:45.000Z

To rule out an infection: Attach your basic logs. (MBAM, FRST and aswMBR…!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0

system · 2015-04-08T11:45:50.000Z

Here’s the MBAM log, I’m going to edit this posts when I have the others and bump the thread.

MBAM revealed I actually had some malware

aswMBR.exe just stops working when it comes to a specific file located in C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tool.Applications

Asyn · 2015-04-08T11:48:55.000Z

mue.92 post:18:

Here’s the MBAM log, I’m going to edit this posts when I have the others and bump the thread.

OK, please do so.

system · 2015-04-08T12:00:33.000Z

So, I added the other files, see the attachment post for more details

Asyn · 2015-04-08T12:33:14.000Z

OK, now you’ve to wait a bit…

essexboy · 2015-04-08T13:48:05.000Z

I see you have CIS installed as well have you tried disabling that ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File 2015-04-04 21:54 - 2015-04-04 21:54 - 00000000 __SHD () C:\Users\Wii\AppData\Local\EmieUserList 2015-04-04 21:54 - 2015-04-04 21:54 - 00000000 __SHD () C:\Users\Wii\AppData\Local\EmieSiteList 2015-04-04 21:54 - 2015-04-04 21:54 - 00000000 __SHD () C:\Users\Wii\AppData\Local\EmieBrowserModeList Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-04-08T14:24:37.000Z

Yes, I tried disabling CIS, the problem persists. It only gets solved by disabling avast. Of course, there might be an interaction I’m not aware of which causes the problem.

I really appreciate all your help btw I hope we get to the bottom of all this (how very selfish of me).

Announcements