Firewall alert - avast! acts as server

Avast Free Antivirus / Premium Security
1

I am running avast! 4.8.1195 and ZoneAlarm Pro 7.0.462.000. I have most programs configured to ask for permission, to help me understand when and why things are happening on my computer.

Can someone tell me if it is normal or acceptable for ashWebSv.exe to act as a server?

Here is the ZoneAlarm Security Alert:

“avast! Web Scanner and components are trying to act as a server. Application: ashWebSv.exe”

ashWebSv.exe also wants to access the internet, which makes sense, but I want to know if I specifically have to grant ashWebSv.exe server rights?

2

Allow it, it is the web shield which filters http traffic so it can be scanned before it gets to your system. The web shield is a localhost proxy it isn’t actually a server but ZA thinks it is acting ‘like’ a server if by denying server rights you can’t browse, then you know you answer.

There is another minor program update available, 4.8.1201, so you can do a manual program update and no doubt ZA will ask again ;D

3

Like David said, server here means local proxy… You can allow it.
Into the firewall settings, the following programs should be allowed to connect:

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner Service)
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (avast! Update executable). This is a temporary file that just appears when an update (check) is about to launch, and disappears again afterwards.

Don’t need rights to connect:
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)
C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service). Although, ashServ.exe sends ping packets to find out if the Internet connection is alive. You can turn this off by checking the “My computer is permanently connected to the Internet” box in the avast Program Settings > Update (Connections) page.

4

Snagglegrain,

I have run each of the versions of Avast! 4.8 including the beta ones from 4.8.1169 through to the current 4.8.1201 in conjunction with Zone Alarm Free firewall. I specifically block all items approved for for internet access in ZA from acting as servers to the internet - ie. all items in the Internet Server column are red crossed, and that includes ashWebsvr.exe. This does not cause any problems (as has been said, it is not a true server) and the Web shield does work properly, as indicated by its scanned count. For further evidence of it working you can click on the Web shield customise, then in the advanced tab tick Show detailed info on performed action. This is not something I would leave ticked for an extended period, as the on screen messages will drive you crazy, but it does clearly show it working.

I must add that this is on an XP-Home SP2 system and using Internet Explorer 7. I don’t know whether it holds good if you are using Firefox or another browser.

5

Indeed it does not scan outbound connections and I think it shouldn’t have, in ZA means, the server action.

6

I believe accepting connections from local host (i.e. from a browser) is also “acting as server”.
I don’t know if the firewall can recognize (in advance) whether the program will accept connections from localhost only, or from network as well…

7

The above responses tally up as Allow, Allow, Block, Block, Allow?

8

Your system your choice, some firewalls act differently and localhost proxies really aren’t servers in the normal sense. If it works without it no problem, if it doesn’t you know what to do.