Avast Firewall gets turned off automatically!

I’m using the latest version of AIS, and for some reason the firewall gets turned off automatically after some time… I cant tell exactly when, but this has been happening for the past 5 days… I’m pretty sure that my PC is not infected as I have 3 resident shields running - AIS, MBAM, SAS…

I know 3 might be a bit too much, but wanted to run 3 of them because AIS and MBAM didnt warn me when opening this infected file, it detected it AFTER opening and executing it only… So I decided to add SAS as well… Since the specs on my PC are good it shouldnt make much of a difference in the performance… Also there are no known compatibility issues between these 3 for the moment right ?

But anyway is there a log or something that records firewall activity - like what caused it to turn off, whether it was manually done or not ? the FW activity log doesnt mention anything…

Can someone help me sort out the issue? :-\

Hi,

Can you please state your specifications of PC?

As so far there were no incompatibilities among SAS and MBAM. Last few days I have used both products (paid versions) but leaving one as On-demand. MBAM also track malware before execution too. But with SAS Pro, it processes heavily when definitions get automatically updated at start up and it runs automatic startup test too. As my guess it may interfere with avast. And if you research more you may see that MBAM has more detection rate than SAS.

1st you may try disabling Windows Firewall & SAS automatic protection n see if it works.

Cheers…

I know that MBAM tracks malware before they execute… So does Avast… but thats not the case, they failed to stop it at the execution but removed it AFTERWARDS… Stopping it before it got spread would have saved me the trouble of performing scans and removing them… Which is why I have SAS running real time…

I know that SAS is a bit heavy on the startup so I have disabled it on startup… So I manually run it everytime I login but have real time protection…

You have misunderstood my post… Avast FW and Win FW are said to have no conflicts… Same goes with MBAM + SAS + AIS, there are so many people who use all of these together without any problems… I wanted to know how the Avast FW could have gotten disabled automatically and whether I can track what did it by referring to a log or something…

I have no answer exactly why you should WF turn off. But once I had same problem and another member offered me to turn off WF n try out. As he suggested, it solved.

There are many who use MBAM + SAS + AIS. But most have one On-Demand, either MBAM or SAS.

Giving a try won’t be worthless.

Cheers…

Yeah I know but as I have said in my first post I dont know when/how it gets turned off… I had it running with windows FW for so many months so I know for a fact that its not the issue… the ONLY difference was I turned on real-time protection of SAS… But then again I have seen users in this forum who run ALL 3 of them REAL TIME… So again I’m not sure why it happens… If only theres a log that gives out the time/reason the FW stopped…

Giving a try wont be worthless but since I dont know exactly when it goes off, it wont help much…

Alright, as if you prefer you may try Firewall Logs under Firewall menu, and make sure to set - Show log for > ‘Activity’ to show activities that has been carried out.

Cheers…

Thanks Mayura for the assisst :), but it doesnt mention anything about being turned off… I mentioned it in the first post. Hope theres another log… MBAM has a log that mentions when the protection is turned off and when it gets back on… I think Avast also has a log like that… :-\

You are welcome :slight_smile: Did you check out ‘Application Rules’ for avast! FW service?

Cheers…

AND try this if it helps, you can locate another log here.

C:\ProgramData\AVAST Software\Avast\log\

Cheers…

ooo Thanks! :smiley: There you go! ;D These are the errors(There are more but these are the most recent ones)! Now hope someone with an in-depth knowledge about the Avast FW will tell me what they mean ;D

29/04/2011 4:40:54 PM GetBestInterface error 1231
29/04/2011 4:40:54 PM SendARP error 87
29/04/2011 4:40:56 PM SendARP error 87
30/04/2011 2:43:46 PM GetAdaptersInfo error 0
30/04/2011 2:43:57 PM SendARP error 87
30/04/2011 2:43:57 PM SendARP error 87
30/04/2011 2:43:59 PM SendARP error 87
30/04/2011 2:43:59 PM SendARP error 87
2/05/2011 9:38:17 PM SendARP error 87
3/05/2011 9:33:54 PM SendARP error 87
4/05/2011 12:55:31 PM SendARP error 87
4/05/2011 12:56:35 PM GetAdaptersInfo error 0

But then again I’m not sure if this is a reason why the FW was turned off… :-\

btw These were found in the error log, they might be about the FW… Hope someone can help me decode it ;D

Sat Apr 02 12:06:43 2011
→ topLevelExceptionFilter addr=0 code=c0000005
Sat Apr 02 12:06:43 2011
→ Calling generateExceptionReport
Sat Apr 02 12:06:43 2011
→ Returning EXCEPTION_CONTINUE_SEARCH.

Fri Apr 29 11:31:29 2011
→ topLevelExceptionFilter addr=76fee39e code=c0000005
Fri Apr 29 11:31:29 2011
→ Calling generateExceptionReport
Fri Apr 29 11:31:31 2011
→ Returning EXCEPTION_CONTINUE_SEARCH.

Fri Apr 29 11:31:37 2011
→ topLevelExceptionFilter addr=76fee39e code=c0000005
Fri Apr 29 11:31:37 2011
→ Returning EXCEPTION_CONTINUE_SEARCH.

Wed May 04 19:02:25 2011
→ topLevelExceptionFilter addr=6c24dc90 code=c0000005
Wed May 04 19:02:25 2011
→ Calling generateExceptionReport
Wed May 04 19:02:25 2011
→ Returning EXCEPTION_CONTINUE_SEARCH.

SendARP error common for me too. but other two not in mine. You better Google until someone go through your issue.

Cheers…

can you upload unp******.mdmp file in the ‘log’ directory?

Cheers…

Done - click the link below to download them… Can you find the cause by looking at them ? Thanks again! :slight_smile:

http://www.sendspace.com/file/36b8sz

Hi,

I’ve checked those minidump files. Crashes of programs can be found as below,

unp33134183.tmp : Crash of AvastUI.exe, AshBase.dll
unp86191549.tmp : Crash of Google Chrome Real Player Plugin
unp251887968.tmp : Crash of afwServ.exe (avast! Firewall) and stop service

As my knowledge it may happen due to new driver or program update like Microsoft Visual C++ Package installed via another software installation or windows update. avast! use Microsoft Visual C++ Package too. So overwritten of files might be the reason of sudden crash. May be it cause due to Bad Sectors too, but I hope you haven’t got any of em.

It took some time to check and analyze:)

If you are still suffering from this error, the recommendation is trying repair or fresh install of avast!

Cheers…

Thanks Mayura for taking your time to help me out. The only new thing I installed was my VGA drivers - I actually reinstalled it had the latest version and I removed it completely and had to reinstall… Other than that I installed the latest version of VirtualBox… Thats pretty much it… Still dont know what caused it :-\ If it happens again will reinstall Avast, but dont know if it will help with this as this started happening a few days ago…

DraKuL,

Before you make any drastic changes, I would make one of your resident (either SAS or MBAM) as on-demand. You have 3 resident scanners now, and they are most likely causing a conflict. As a test, turn one of them (SAS or MBAM) to on-demand and see if this fixes your problem.

In addition, did you put your resident software into each other’s software exclusions? If not, please do so to avoid conflicts.

I do not see a reason to uninstall/install until you test out the above first. Report back on your findings. Thank you.

Yes, I have excluded Avast on MBAM, and I forgot about SAS, so just excluded Avast on that as well… Also MBAM is excluded on SAS and vice versa… Didnt exclude anything on Avast yet - but since Avast FW is being disabled, as long as I exclude Avast on both of them it should be fine - theoretically…

If the problem persists, will exclude others on Avast and if its still there will go back to 2 resident scanners… I stated why I added a third in the earlier post, but if they cause conflicts I will disable one of them, most likely SAS… Because AIS and MBAM were running fine for a pretty long time and I think this started hapenning after I added SAS realTime, again the problem is I am not aware of the exact time this happens and therefore I cannot put a pin on whats causing it… Right now I have all 3 running realTime and so far the FW is enabled…

Thanks!

Ok so I didnt have SAS running today but it still got turned off… the FW I mean… I didnt have any “odd” program running… Does anyone know how to check for the cause of this? Is there a way to pin point to the program thats causing this? Any help is highly appreciated…

I had the computer running from 1pm, and now its 5pm when I noticed it wasnt running bu inbetween I kept checking if it was running or not, so it wasnt turned off instantly and I wasnt running any new program between the time it was running and stopped…

I know you mentioned that in the past you tried turning off Windows FW, which you had running with AIS and SAS Pro. Now that you have SAS Pro as on-demand, try turning off Windows FW as well leaving only AIS and MBAM as resident. Reboot.

Have you upgraded to the current version of Avast 6.0.1125 yet? If not, please do so and see if this fixes the problem. Thanks.