Many tcp connections established by AvastSvc.exe

system · June 21, 2011, 2:31pm

I found I can’t connect to websites (partial files weren’t downloaded.), including the control panel of local router.

I knew that AvastSvc.exe create some TCP for proxy.

When I typed netstat -b

netstat -b :
There are about 1000 TCP connections with status ESTABLISHED, for example


TCP    127.0.0.1:12080        MyPCName:SomePort          ESTABLISHED   x ~500
 [AvastSvc.exe]

TCP    127.0.0.1:SomePort        Feather:12080          ESTABLISHED    x ~500
[System]

1.What did it happen? and how not to happen again?
2.Do flash games (IE) causes this? (I saw my brother opened some flash games and then can access no web(Error: Connection reset(firefox))
3.Is 1000 the max limit of concurrent TCP connection? (I can’t access CP of router)
I think this limit is different from the limit of TCP half-open.

OS: Windows 7 Home Pre (Chinese)

It seems fine after reboot…

DavidR · June 21, 2011, 2:54pm

It is the web shield proxy, your browser http traffic is redirected through the localhost proxy so that inbound traffic can be scanned.

The avastsvc.exe isn’t initiating the connection, but acting on the part of your browser.

system · June 21, 2011, 4:05pm

First of all, thank for your reply.

Other tools (ping, tracert, nslookup) work. (avast just scan http/https)
I have a doubt that firefox opened a few connections (19) compared to 1000 avast did.

Is there too many TCP connections so no new connection is able to be established?

DavidR · June 21, 2011, 4:33pm

Avast doesn’t monitor https traffic.

As I said avast isn’t initiating these connections, that would otherwise be down to your browser if the web shield wasn’t being used. A single web page can be made up of many, many connections, all the images, links to off-page/site scripts, etc.

I don’t know what other connections you want to establish ?

This would appear to be an associate firefox request coming back in through the proxy to your browser:
[firefox.exe]
TCP 127.0.0.1:64751 MyPCName:12080

I have no idea what these are:
[¨t²Î]
TCP 127.0.0.1:65405 MyPCName:12080 ESTABLISHED

Whilst they use port 12080 they aren’t directly associated to the avastsvc.exe. Have you got some sort of local network and do you use any other proxy ?
As this would appear to be monitoring local traffic.

This isn’t an area I’m familiar with at all as I don’t use a network.

Have you changed any of the avast settings in relation to redirection as local communication is meant to be ignored ?

system · June 22, 2011, 6:48am

“Ignore local community” is enabled.

This problem has be the only one since I used avast free.
This rare issue wasn’t caused by firefox but ie/flash, which connections remain after IE/Flash is closed?

DavidR · June 22, 2011, 12:26pm

I never said it was caused by firefox as all browser http connections are treated in the same way.

I’m at a loss as to what else to suggest as these are all local connections. The same netstat -b on my XP Pro system doesn’t turn up anything like this and you will see mose are in a closed wait state.

Active Connections
Proto Local Address Foreign Address TCP MyPC:1052 localhost:1053 TCP MyPC:1053 localhost:1052 TCP MyPC:1054 localhost:1055 TCP MyPC:1055 localhost:1054 TCP MyPC:1066 localhost:1067 TCP MyPC:1067 localhost:1066 TCP MyPC:1068 localhost:1069 TCP MyPC:1069 localhost:1068 TCP MyPC:2875 xml.weather.com:http ESTABLISHED 2132 [YahooWidgets.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]
CLOSE_WAIT 400 [MailWasherProApp.exe]

The results on my wun7 netbook are even less:

Active Connections
Proto Local Address Foreign Address State
TCP 127.0.0.1:1074 Netbook1:1075 ESTABLISHED [thunderbird.exe]
TCP 127.0.0.1:1075 Netbook1:1074 ESTABLISHED [thunderbird.exe]
TCP 127.0.0.1:1076 Netbook1:1077 ESTABLISHED [thunderbird.exe]
TCP 127.0.0.1:1077 Netbook1:1076 ESTABLISHED [thunderbird.exe]
TCP 127.0.0.1:1078 Netbook1:1079 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1079 Netbook1:1078 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1080 Netbook1:1081 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1081 Netbook1:1080 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1096 Netbook1:12080 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1098 Netbook1:12080 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1099 Netbook1:12080 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1101 Netbook1:12080 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1117 Netbook1:12080 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:1126 Netbook1:12080 ESTABLISHED [firefox.exe]
TCP 127.0.0.1:12080 Netbook1:1096 ESTABLISHED [AvastSvc.exe]
TCP 127.0.0.1:12080 Netbook1:1098 ESTABLISHED [AvastSvc.exe]
TCP 127.0.0.1:12080 Netbook1:1099 ESTABLISHED [AvastSvc.exe]
TCP 127.0.0.1:12080 Netbook1:1101 ESTABLISHED [AvastSvc.exe]
TCP 127.0.0.1:12080 Netbook1:1117 ESTABLISHED [AvastSvc.exe]
TCP 127.0.0.1:12080 Netbook1:1126 ESTABLISHED [AvastSvc.exe]
TCP 192.168.1.65:1100 l3:http CLOSE_WAIT [AvastSvc.exe]
TCP 192.168.1.65:1102 l3:http CLOSE_WAIT [AvastSvc.exe]
TCP 192.168.1.65:1103 l3:http CLOSE_WAIT [AvastSvc.exe]
TCP 192.168.1.65:1104 l3:http CLOSE_WAIT [AvastSvc.exe]
TCP 192.168.1.65:1119 wy-in-f132:http ESTABLISHED [AvastSvc.exe]

system · June 22, 2011, 1:09pm

I don’t what it is.

Normally, my computer have a few “ESTABLISHED” connections being like to yours.

Hope someone else had similar experiences.

system · June 23, 2011, 4:49am

wht firewall do u use?

do u have many computers using the same network?may be i can help u…

system · June 23, 2011, 5:05am

Windows 7 firewall.

This computer is connected to a router directly.
No other computers in the network were powered on.

system · June 23, 2011, 5:32am

i recommend comodo firewall intall it and wait for it to give alerts of any unknown connections and if it does so tell it to block it and if comodo gives no alerts then everything is fine then it must just happening because u use too browsers to surf the web or u use the same network connection for many computers[i dont specify whether u use them together or not]…

Many tcp connections established by AvastSvc.exe

Announcements