Firewall warning

Avast Free Antivirus / Premium Security
1

Hi :slight_smile:

I’ve got the following firewall warning (see below) after beeing prompted for a program update and accepted it.

Two things keep me worrying:

The target IP is from Houston, TX (see enclosed firewall report) and I did not get the usual “you need to restart …” message at the end of the update. ???

I am runing W XP and since a few days now, I keep getting a full desktop of shortcuts (to documents, pictures …) when starting the computer.

I am a little concerned ???

Thanks for your help

06/14/2004 23:01:54 Executable File Change Accepted Information Outgoing TCP C:\Archivos de programa\Alwil Software\Avast4\Setup\avast.setup pc PC-EOXDE6F6F9FI Normal 1 06/14/2004 23:01:54 06/14/2004 23:01:54

Application has changed since the last time you opened it, process id: 2228
Filename: C:\Archivos de programa\Alwil Software\Avast4\Setup\avast.setup
The change was allowed by user.

---- Modules changed: 1 ----
C:\Archivos de programa\Alwil Software\Avast4\Setup\avast.setup
---- New modules: 0 ----

Whois report (partial)

OrgName: Everyones Internet, Inc.
OrgID: EVRY
Address: 2600 Southwest Freeway
Address: Suite 500
City: Houston
StateProv: TX
PostalCode: 77098
Country: US

2

Yeah, this seems OK.

  1. Update 412 → 418 didn’t need restart
  2. Six of our updating servers really ARE located in Houston, TX. For a list of our servers IP’s, please refer to our FAQ: http://www.avast.com/i_kat_314.html#idt_1366

Hope this helps,
Vlk

3

Let me guess your using Sygate?

If you are then check out this thread. Sygate Probs

Not all updates need restart, the same is true of windows.update, some patches don’t require reboot.

If you are not using Sygate, but another firewall, the action is correct if you have just updated your avast program then your firewall recognises it has changed and asks for confirmation that it is ok to access the internet.

This is a good thing to stop virus infection effectively hijacking (changing) a program file that has permission to access the internet. If you have just upgraded a program and you get this warning, then click allow, etc. If you have not just upgraded the program (it could be infected), then click deny, etc.

Different firewalls have different levels of sensitivity, from:

Totally ignorant, having once given permission to a program access even if that program changes it is still allowed access. This leaves you vulnerable and is BAD.

Sensitive to change - Many programs will wait until the program upgrade has completed, and wait until the next use of the program and not challenge each and every sub section of the upgrade (see sygate below).

Over sensitive - Sygate, it seems for a single update, this can generat tens of permission warnings. There are many posts on these forums relatint to the sensitivity of sygate, a search for ‘sygate probs’ )without quotes) will return many.

I am runing W XP and since a few days now, I keep getting a full desktop of shortcuts (to documents, pictures ...) when starting the computer.

Sorry I can’t help you with that, there is insufficient information. Where does the shortcut path point, view the shortcuts properties.

HTH David

4

Thanks Vlk and DavidR :slight_smile:

And yes I’m using sygate and pretty happy with it.

My shortcuts point to some of my docs and pics in “my documents” folder.

I have also found an email that I sent months ago, in the “ougoing” mail outlook folder (wasn’t there last time I run the computer).

I have found this thread (http://computing.net/windowsxp/wwwboard/forum/60851.html) in another forum and it seems to describe the same problem.

Thanks again :slight_smile:

5

The problem described in the link you gave appears to be the oposite of yours, they have disappearing shortcuts, not a growing numbers of shortcuts.

Now you say that the shortcuts point to your docs and pics in My Documents. If you can recognise these docs and pics, hopefully you can identify which program that is placing them their and disable the creat desktop shortcut.

Other than that I can’t see any way of stopping it as it doesn’t appear to be a standard windows setting.

This should be discussed on the off topic thread as it doesn’t relate to avast, unless it can be attributed to a virus and I haven’t heard of this behaviour.

If you haven’t already got some form of adware/spyware protection, look for the programs at the end of my signature. See this thread for more useful links: http://forum.avast.com/index.php?board=1;action=display;threadid=1509

6

Thanks again