We have the same issue here. We use Telerik Fiddler, a very important Proxy tool for us for the debugging of HTTP requests, and Avast keeps resetting the Proxy while we are debugging, so debugging is basically made impossible through that.
Can I bump this as I’m having exactly the same issues and it’s really annoying considering I don’t have any of the firewall features for Avast?
Here are my logs from Process Monitor;
Exe: c:\program files\avast software\avast\avastsvc.exe
3:37:04.2638664 PM avastsvc.exe 2692 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer SUCCESS Type: REG_SZ, Length: 82, Data: http=127.0.0.1:8888;https=127.0.0.1:8888
3:37:04.2641615 PM avastsvc.exe 2692 RegDeleteValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer SUCCESS
3:37:04.3265197 PM Fiddler.exe 25308 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer NAME NOT FOUND Length: 144
Stack trace for the delete query;
0 ntoskrnl.exe SeLockSubjectContext + 0x3355 0xfffff80281f33bc5 C:\Windows\system32\ntoskrnl.exe
1 ntoskrnl.exe ObOpenObjectByName + 0x4218 0xfffff80281ef2468 C:\Windows\system32\ntoskrnl.exe
2 ntoskrnl.exe setjmpex + 0x3b63 0xfffff80281c0c413 C:\Windows\system32\ntoskrnl.exe
3 <unknown> 0x7ffc1be46d54 0x7ffc1be46d54
4 <unknown> 0x50dd3f97 0x50dd3f97
5 <unknown> 0x50dc6d63 0x50dc6d63
6 <unknown> 0x50ea1c93 0x50ea1c93
7 <unknown> 0x50ddb130 0x50ddb130
8 <unknown> 0x50dcb950 0x50dcb950
9 <unknown> 0x7ffc1be19c32 0x7ffc1be19c32
10 <unknown> 0x7ffc1be19b1b 0x7ffc1be19b1b
11 <unknown> 0x7ffc1be19ace 0x7ffc1be19ace
12 <unknown> 0x779b29fc 0x779b29fc
13 <unknown> 0x74a99e15 0x74a99e15
14 <unknown> 0x74a99ed3 0x74a99ed3
15 <unknown> 0x73b810de 0x73b810de
16 <unknown> 0x73b80fe7 0x73b80fe7
17 <unknown> 0x73c51371 0x73c51371
18 <unknown> 0x73b7c695 0x73b7c695
19 <unknown> 0x73b7c5b1 0x73b7c5b1
20 <unknown> 0x727b7b8d 0x727b7b8d
21 <unknown> 0x727b7557 0x727b7557
22 <unknown> 0x727db808 0x727db808
23 <unknown> 0x727dd974 0x727dd974
24 <unknown> 0x745fe89f 0x745fe89f
25 <unknown> 0x756b8744 0x756b8744
26 <unknown> 0x779a582d 0x779a582d
27 <unknown> 0x779a57fd 0x779a57fd
Can you upload .PML file from ProcMon?
Thanks for taking a look drake127!
Hi, it appears that that PML file is somehow broken. It is missing module information and we cannot match those addresses to our code. Can you use updated version of Process Monitor or check your save settings? Even without private symbols, the stack window should not read .
Would you be able to direct me to the version of Process Monitor you need me to use? This is what I’ve been using;
https://pasteboard.co/GW74jHn.png
Maybe it’s easier if I print the stack the Process and Stack tabs associated with the RegDeleteValue instead?
https://pasteboard.co/GW75CeV.png
https://pasteboard.co/GW760RR.png
Hi again, I found out that you need to disable Avast self-defense (Settings->Troubleshooting), restart your computer and then you will see proper modules in Process Monitor. The result should look like the attachment. When you have it, upload the PML file again. Thanks!
here you go drake, thanks again;
Any ideas or clues yet drake127?
Shame not to hear anything yet. I’m just going to uninstall it and try something else, thanks for trying!
Just encountered this exact proxy clearing issue on a Windows 10 (Build 1709) computer. Uninstalling Avast Free Edition eliminated the problem.
Update to the latest version (17.9.2322): https://forum.avast.com/index.php?topic=212045.0
I am facing the same issue using Avast Premier (17.9.2322) on Windows 10, 64-bit (1709). As mentioned in previous posts the registry entries for proxy settings get deleted by avastsvc.exe. There doesn’t seem to be a fixed period when this happens, nor a specific event that could trigger such strange behavior. Has anyone figured out the reasons? This is the only post I found that discusses the issue. It doesn’t make any sense for many users that have to use a proxy for various reasons.
Same exact thing here. extremely annoying and fucking dangerous from a privacy perspective, especially for those such as myself who live in a country where you need a VPN to access the internet and viewing the wrong political opinion can get you a visit by police. Seriously F Avast for not looking into this. In the middle of browsing the system proxy resets with zero warning unmasking all your traffic and preventing access to western websites. Windows and Avast are both fully updated. Avast is reset, IE settings reset, network settings reset. I’ve reset everything and the issue persists. The only option I have is to uninstall Avast because this behavior is far more dangerous than the low risk of malware.
Hi, comrades - same way (process monitor, proxy settings reseting) i found this forum )))
Tests (not sure how it sound on english version of avast just)
- Disabling browser-extension time2time recheck - not help
- Disabling\removing all components (free ver) (except realtime, software updater. avast-itself protection disabled) - helps
(still testing)
Not good advice and certainly not resulting in good protection.
I’ve reported the complaint to Avast.
Hello,
I have been bothered by the proxy setting being deleted for almost 6 months now until I found this forum/thread. All this time I thought it was Windows Update that was causing the problem (as I found in the other forum).
Our company bought more than 10 licenses and we need the VPN and proxy setting in our work.
Work around for web browsing can be done via Firefox proxy setting but other Windows proxy setting dependent such as skype etc. has caused too much trouble.
Some of my team eventually uninstalled Avast from their computers leaving Windows Defender running instead… not a very secured environment I suppose.
I was able to capture and reproduce the problem via procmon in my Windows 10 environment which is having the same problem… proof that Avast has been deleting the Proxy setting.
Time of Day Process Name PID Operation Path Result Detail
5:45:26.1757683 PM avastsvc.exe 2936 RegDeleteKey HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C3F4EA120CD88D91FDB2C5A6D307E77AC4A67B3D SUCCESS
6:23:30.5019661 PM avastsvc.exe 2936 RegDeleteValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer SUCCESS
6:23:30.5020261 PM avastsvc.exe 2936 RegDeleteValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride NAME NOT FOUND
6:23:30.5020384 PM avastsvc.exe 2936 RegDeleteValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL NAME NOT FOUND
6:23:30.5020659 PM avastsvc.exe 2936 RegDeleteValue HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect NAME NOT FOUND
I really hope Avast do something about this quickly. Otherwise, they will lose more users other than free version!
You could try the latest beta: https://forum.avast.com/index.php?board=15
Thanks, Asyn.
I’m trying it asap… hope this works!
You’re welcome.