Avast Firewall issue with rundll32.exe

system · 2015-08-24T22:13:17.000Z

Approx. once per day Avast Firewall prompts me to decide whether or not to allow “rundll32.exe” to make an outbound connection. Looking under details shows this to be a function of “Microsoft Windows Production PCA 2011” trying to reach IP: 65.55.252.92 – which is a Microsoft server in Redmond, WA that is also called a “Bingbot” server.

Every time this prompt comes up I click “Allow” and have checked “Remember my answer” – yet every day Avast “forgets” that I have allowed rundll32.exe to contact that Microsoft server, so it prompts me again and again.

This is the only glitch I’ve experienced so far with the Avast firewall, as all the other choices I’ve made with other programs/processes trying to call home, whether “Allow” or “Block,” are remembered by Avast.

VirusTotal shows my “rundll32.exe” file itself is the real one from Microsoft (SHA256: 35402466fe6d02cc85a27171f55d9f7fd0aaf018d3cc410e46f0b43dce7ea080). I’ve run MalwareBytes, AdwCleaner, HitMan Pro, and Avast’s own complete system scan (set to scan for PUPs as well) and have found zero issues. I am running on a clean install of Windows 10 Pro x64. I am using Avast Premier 2015 v.10.3.2225 / def: 150824-4.

I appreciate any advice on how to get Avast to remember my firewall choice for this particular connection. Thanks!

DavidR · 2015-08-24T22:43:47.000Z

Sorry I can’t be more helpful, as I don’t have the avast firewall. But it isn’t the file being blocked by the file shield (why you don’t get any hits on VirusTotal), but the firewall not letting it connect.

For me rundll32.exe should really be a local system file, I believe the avast firewall is not liking its attempt to break free of the local system. This however is rundll32.exe on win XP Pro.

I’m not entirely sure if it should have permission to connect to the internet. I use Outpost Firewall Pro and my settings (application rules) don’t allow it to connect. The attached image would appear to confirm that it hasn’t tried to connect.

Hopefully someone using the avast firewall will see this and advise you further.

Announcements