avast! Free "Shields" are corrupting downloads

So the last week has been very hectic for me due to some strange file corruptions that would happen while downloading a file (including cache files), that made YouTube videos, SoundCloud tracks, etc. would stop loading after a short period.
I first thought this was an issue with the flash player or firefox, but it happened while downloading files as well!

The download process would start, go on for a varied period of time, then finish in the middle of the downloading process. I read that a file being corrupted would do this, but since all of the files I downloaded did this, it had to be something on my side that corrupted the files.
My first assumption was that this must have been caused by a malware that has somehow gotten past my antivirus, so I performed a scan which turned out clean.

After pondering about the issue, something crossed my mind; avast! is searching all the files I download for malware!
I tried turning off the shields, and it jolly well indeed worked!

Conclusion:
Somehow during the scan, avast! is corrupting the files I download with some peculiar scan for malware, leaving me with unfinished files, including the videos stored in the cache.

I now need to switch off my shields in order to download a file or watch a video on YouTube. I am sure this is not intended, and should be fixed.

I use:
Intel i7 2600K 3.40GHz
8GB RAM
NVIDIA GeForce GTX 560
Windows 7 Home Premium 64-bit (6.1, Build 7601)

avast! Free:
Virus definition version - 120119-1
Program version - 6.0.1367

Any specific information about the site or files that are being blocked / corrupted? Any message, screenshot, chest, log, report,… ?

You’re not alone, I have noticed this as well. First I blamed the server (f.ex. when downloading Left 4 Dead 2 maps from l4dmaps) but turns out it was Avast all along. Also corrupts League of Legends patch installations etc. It’s quite frustrating to disable shields any time I need to download anything. uTorrent downloads files without issues however.

When trying to download LastPass .exe installer (from LastPass’s site and from Softpedia) both File Shield and Web Shield reported it as Trojan Dropper and quarantined them.
What’s going on?
Some months ago I had to give up on the Behaviour Shield because it would block a lot of legitim files and now this?

You only have to tell the behaviour shield that the process is trusted and add it to the list then you wont be asked again.

Also with your lastpass file you can run a check scan with virus total to make sure it’s not infected, if all’s good then report the false detection to avast.

I don’t know the exact reasons to block. Avast Team may need to look into this so to evaluate if this is a FP or whatever else.

In the meantime, as a workaround, I would suggest setting the relevant shields with “EXPERT” settings → actions → “ask” where pertinent / relevant. This should give you the possibility / opportunity to decide what to do, instead of avast acting by default.

I would if I had been given a warning; but it would just block. It took me the best part of two days to find the culprit.

I’m sorry for the slow response, but every site is being blocked. A download would start normally, but it would stop after a while no matter where I downloaded it from, I say.
I haven’t found any sort of indication like a log or a report that it is getting blocked. All I know is that if I turn the shields off, my downloads doesn’t suffer these symptoms.

EDIT: My laptop has started getting the same errors. I’m starting to think this is quite an error I’ve found here.

What he means is, he wants a specific link to a download (and a safe one at that) that has failed for you so we can try to see if we also have the same problem.

Do you use any download manager of any kind?

In addition…

First, set ON all shields.

Then, please delete the firewall rules related to avast (from whichever firewall you have, disabled or enabled, third party one, Windows firewall, or from avast firewall, hardware firewall… from all of them), save and reboot. The firewall rules will be re-created where necessary after the reboot (“learning mode” or equivalent).

Test, reboot AGAIN, test again, and report back.

I’m using Firefox’ built-in downloader.
As I said, it basically stops everything I download. Including buffering YouTube videos, SoundCloud tracks, and other files buffered through flash. I’ve tried using FlashGot, but it stops those too.

On the laptop, I use a proxy to connect to the internet. Somehow avast! shields are blocking that, too… and I have to go through that proxy to get online.

  1. Go to YouTube frontpage.
  2. Click on a video.
  3. Does it load correctly?

I will do this when I get home (4 hours). I don’t have access to the Windows firewall on the laptop.

EDIT: There aren’t any settings in the Windows firewall that mentions avast! and rebooting seems to suppress it the issue for a while.

Have you configured avast → settings → updates → proxy settings?

In addition, since when this is happening? Was there any change / update / (un)installation? Or was this right since the first time you installed avast?

Which security tools you had before avast? And now, besides avast?

Does the router have any firewall?

Something (probably old or bad firewall rule) is blocking access to avastsvc, so nothing will get connected. Some remnant of some other security tool may be conflicting too (in which case, there is a need to run the adequate removal utility).

What do you mean with:

rebooting seems to suppress it the issue for a while
?

I’ll do that on my laptop :>
My desktop doesn’t need any proxies, and I can connect to the update server.

This started about a week ago. I’ve been using avast! for 4-5 years and the issue probably came with the latest update. My client updates automatically, and silent/gaming mode is active so I don’t know when the update came.

I’m using Malwarebytes Anti-Malware for scanning the computer, and I use Toolwiz Care for maintenance. The Windows firewall is ofc on.

I don’t have access to the router, and I assume yes. No recent changes there.

avast! can indeed connect to the update server, so the firewall isn’t blocking it completely in that case. I’m quite sure the issue isn’t there but rather in the software itself.

After rebooting I can watch videos and such for about 20min or so, then it would start being all derpy. The issue is in the cache maybe?

My client updates automatically, and silent/gaming mode is active so I don't know when the update came.

Do you mean definitions autoupdates, or also the program itself?

We have seen firewall issues several times after a program update for avast is performed, even when it seems that the firewall rule is correct. So deleting the relevant rules and re-creating them usually solves this type of problems.

But your case seems to be different (at least partially), since you are able to connect (for at least a period of time).

Maybe you could try disabling “game mode” in avast for some time, so at least you would be able to see any potential messages? (BTW, do you have the Status Bar options enabled and the pop ups settings too?).

I don’t see (until now at least) something in avast that would block a download after some period of time. I mean, either it blocks it, or it doesn’t.

You may want to try uninstalling multimedia related tools. For example, uninstall all from adobe (like “flash” and “macromedia shockwave” for example), and be sure to uninstall all versions of them. Then reboot and install the latest stable versions.

I would do the same with JAVA (which can install more than one version in parallel, and they are left behind if you don;t uninstall them manually). JavaRa may be useful for this. So finally you would use only the latest stable JAVA version available.

After rebooting, I would try also updating your web browser, if the problem still presents itself.

Or maybe you should uninstall avast, run the removal utility (several times, each for each version of avast you ever had) and install the latest stable (and reboot) http://www.avast.com/uninstall-utility.

Maybe someone else has some additional tip / clue / idea.

Both, I believe.

I will try disabling gaming mode. Not sure which status bar/pop-up settings you are referring to :stuck_out_tongue:

I know, right? My theory is that the search process somehow corrupts the files when it’s finished, or it “pulls” the file out prematurely for scanning.

That were my thoughts exactly as I discovered the problem. So I updated to JRE 7, Uninstalled and re-installed Flash player (both 32-bit and 64-bit), hell, I even updated to Firefox’ Nightly build 12!

I already tried re-installing avast! but as I said, the issue were on my laptop as well, so the issue is somewhere else…
I’m trying to find out what my desktop and laptop have in common, but I can’t seem to find anything unique about them.

@Satsujinlol,

Please don’t get offended, as this is not my intention, but your last post didn’t really answer much.

I mean, can’t you check your settings?

Well, then go ahead and review your settings → updates. If your PROGRAM was updated (set to automatically update), then the firewall rules MIGHT need to be deleted so they could be correctly re-created (although your description of the problem doesn’t fit 100% the usual case where this is needed).

[quote="ady4um post:14, topic:660047"] Maybe you could try disabling "game mode" in avast for some time, so at least you would be able to see any potential messages? (BTW, do you have the Status Bar options enabled and the pop ups settings too?). [/quote] I will try disabling gaming mode. Not sure which status bar/pop-up settings you are referring to :P
Again, please do your part. Review the "settings -> Status bar", and "settings -> pop ups".
[quote="ady4um post:14, topic:660047"] I don't see (until now at least) something in avast that would block a download after some period of time. I mean, either it blocks it, or it doesn't. [/quote] I know, right? My theory is that the search process somehow corrupts the files when it's finished, or it "pulls" the file out prematurely for scanning.

That were my thoughts exactly as I discovered the problem. So I updated to JRE 7, Uninstalled and reinstalled Flash player (both 32-bit and 64-bit), hell, I even updated to Firefox’ Nightly build 12!


Those are not exactly the choices I would take. I mean that updating is not the same as “clean up first and install latest STABLE version only”. JRE 7 is still considered not as stable, and you could still have other versions installed in parallel, so please re-read my suggestion about it.

For Flash you should uninstall ALL versions and clean any remnants (Revo uninstaller + CCleaner as examples). Then reboot and install ONE version, the latest stable, for IE ONLY (for now, until the problem is solved). Also, no 32 + 64 bits. Only the one that actually needs to be there (and the adobe flash web site will let you know which version is correct if you use IE).

Uninstall Firefox. All versions you could have. Solve the connection problem with IE first. If your downloads work correctly with IE, and with no beta or special releases of any add-on / add-in / plug in / whatever… then you could try using the latest STABLE version of Firefox.

[quote="ady4um post:14, topic:660047"] Or maybe you should uninstall avast, run the removal utility (several times, each for each version of avast you ever had) and install the latest stable (and reboot) http://www.avast.com/uninstall-utility.

Maybe someone else has some additional tip / clue / idea.
[/quote]
I already tried re-installing avast! but as I said, the issue were on my laptop as well, so the issue is somewhere else…
I’m trying to find out what my desktop and laptop have in common, but I can’t seem to find anything unique about them.

Well, with all the extra / non - stable versions, you could also try avast → web shield → EXPERT settings → “…well known browser only”. This is not the best setting for daily use, but only for you to narrow down the problem. Now, this setting is only IN ADDITION to the previous suggestions. Once the basic tools are working, then we can improve it with those other additional browsers + plug in + add on + whatever.

You say this is happening in 2 different systems. Are both using the same connection? Simultaneously? Or these are 2 separated systems not using the same network (as, one in the office and one in your house)?

Please report back.

I never get offended online, so there you go.
I didn’t look too much into the avast! settings before posting this. I actually looked into it afterwards, and that made me look really dumb.

I checked it, and I had already enabled it.

Everything is checked in the Status Bar, and “0 web & network objects were infected and blocked”, nor anything else suspicious in the monthly report at the Popups tab.

By “updating to JRE 7”, I meant removing JRE 6 and thereafter installing JRE 7.
As the problem persisted after installing another clean, completely different version of Java, I bally well presume that even though the version is “unstable”, the problem lies elsewhere.

That is pretty close to what I did.
I removed all the previous versions of Flash, installed the 64-bit version, tested, uninstalled the 64-bit version, installed the 32-bit version, tested, shrugged, then installed 64-bit again.
No change whatsoever.

Pretty similar to JRE 7, The problem persisted even after uninstalling it, and installed a completely different build with no further changes about the issue.

As I’m not a complete moron, I did all that before looking into the antivirus.

No difference.
Anyhow, I were playing with the settings in there, and I found something rather interesting, I say!
If I were to go into Expert Settings → Actions → Suspicious, and select “Ask” in stead of “Abort connection”, the error is slightly different.
In a YouTube video, normal behaviour while the “Abort connection” is chosen would be that the video cuts off and finishes the loading bar. However, if I chose “Ask”, the loading bar would not finish and call it a day. The loading bar would stop, and the buffering “ring” would show, like when you lose your connection while loading. Is a dialogue box supposed to appear, perhaps?
I thought this would be interesting for people who are familiar with how avast! operates.

Irrelevant note: I also added firefox.exe to the exception list because I don’t want to disable everything in order to watch YouTube videos…

Sorry if this didn’t answer the question. I’ll try doing another re-install as soon as that will become relevant.

Well, the weird thing is: my laptop and my desktop are rarely on the same network.
My desktop computer is the one I use at my apartment.
The laptop is the one I use at school, going through their proxy servers.
Somehow, both systems got the same issues roughly at the same time. I am using avast! on both systems, along with Firefox and Skype. I can’t find any other relation other than them being connected to the same network 2 weeks ago simultaneously.

Could this be caused by some sort of virus that avast!, Malwarebytes, and Toolwiz Care can’t find? Because at the time both systems were on the same network, I was browsing the Deep Web on the laptop. I haven’t found any indications that my security was breached, but it might have some relevance.

Avast needs to scan “everything” that connects, so making an exclusion for firefox is, IMHO, a bad idea.

I still think you should try with IE only at first, solve the problem and only then continue with firefox.

If avast says 0 files scanned, 0 sites…, for each shield, then avast is not working.

Since you have PROGRAM updates set to “automatic” (which is not the default), then again, something in the firewall rules could need correction. Deleting the relevant rules, saving and rebooting is the first step I would take in such case.

The “only” thing that sounds odd IMHO (in the sense that the symptoms “fit” the firewall rules being the solution) is that you are able to connect “for some time”. Yet, avast scans zero traffic ???

Have you tried the removal utility http://www.avast.com/uninstall-utility? I mean running it several times, each for each version of avast you ever had, in Windows Safe Mode.

There is a chance some remnant of another security tool is causing a conflict. Previous AV tools removed (not just “uninstalled”)? http://singularlabs.com/uninstallers/security-software/

I don’t have all the other software you mentioned, so the combination of those tools could be also something you should look into.

Still better than turning off the shields :stuck_out_tongue:

I’ve struggled to install Flash Player on Firefox because of another issue I have with Adobe’s installers. Having the same issues with the IE version, apparently… Anyhow, it’s Firefox I want it working with. Sowwy :<

I think you might have misunderstood my post:

Meaning it is scanning, but hasn’t found any infected and blocked.

I think I can answer this with a quote!

Yup.

Re-tested. It is more persistent now even after rebooting.

I just removed everything on the list, and installed a clean version. Nope, Chuck Testa.

Nope.

[strike]Who would’ve thought… Toolwiz Care apparently has a real time shield of some sort.
The “Start Toolwiz Care when Windows starts” option has re-checked itself! I’ll report back if I get the error after removing it.[/strike]
I bally well indeed got the error again, ol’ chap!

I must thank you for your effort in this! You have been actively responding to me for days now, and I haven’t even been giving my best effort in fixing this… You are surely the best support I’ve come across so far, and I haven’t even thrown in 1 cent for this software. I’ll consider buying the full version if this problem is gone :]

On another note, I almost felt reluctant to re-downloading it when I saw who the host is… CNET. The biggest disgrace to the Internet!
After distributing P2P tools, and giving us various methods of downloading copyrighted content for free, they turn their backs and start paying to get SOPA and PIPA through! This will be my last download from them.

For your reference:

files.avast.com/iavs5x/setup_av_free.exe

Now, about firefox and IE, of course I understand you want FF. My point is that solving the problem with a standard stable IE version might be easier, and then you would know how to “transfer” the experience to FF.

FF uses “several” versions, but the web shield will only be 100% compatible with the stable ones (not so much with beta, night releases and alike).

Avast also uses, if necessary, flash for IE. That’s why I suggest first to use and set IE as default web browser with the stable version of flash and JAVA.

About the firewall, have you looked in the advanced settings of the Windows firewall? What about router?

About having an exclusion to FF (or to the web browser), I still suggest against it. You should try to narrow down which of the shields is involved in this problem (pausing each of them, one at a time, and testing some download or some other action that you know what is expected so to compare it). According to the specific shield, maybe we can find some workaround, more secure than excluding the browser.

You mentioned the exclusion for FF in the File System Shield. Even if it is not the Network Shield nor the Web Shield, I’m not convinced this is the best possible workaround.

I am just a simple user, not an avast developer, so I am not able to look deeper into avast itself. Still, I can’t think of some feature in avast blocking a download only after certain time. You could still test excluding the download folder (where you save your downloads) from the File System Shield, BUT you should manually scan every download when it’s finished. Of course, FF should not be excluded in this condition / situation, so to be able to compare the 2 cases. This folder exclusion opens a potential temporal hole for your security, so please be aware of this and use this method only for a brief test period.