Unusual and unjustified WEB blocking.

Avast Free Antivirus / Premium Security
1

I am developing a website, a simple webpage with a regular form that calls a CGI
when user presses the SUBMIT button.

It works fine when Avast’s Web Protection is disabled, but when it is turned on,
my CGI (Its a binary with EXE extension) receives a NULL (empty) string when
calling “QUERY_STRING”.

The HTML page doesn’t do anything in particular, no Java, no scripts… just plain
HTML code as follows:

<form method="POST" action="/cgi-bin/login.exe?login">

UserName:

<input name="T1" size="19" val="t1" style="float: left">

Password:

<input name="T2" size="19" val="t2" style="float: left" type="password">
<input type="submit" value="Submit" name="B1">
</form>

It works perfect if i disable Web Protection, but for some reason my PC doesn’t send
username or password if Web Protection is on.

Any ideas why?

2

What is your firewall (strange I know when it works on other sites I presume) ?
Zone Alarm Pro with its privacy function was one such firewall that had this issue, the passage of parameters.

This sounds more like conflict, hence the firewall question and now another question. Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?

3

Im not using (or used) any 3rd party firewall, only Windows firewall and the
same problem happens if I turn it off.

Im Using ad-Aware (free version) but problem occurs if i uninstall completely.

I was using Virtual-Box but the network it creates is now completely disabled
and Virtual-Box is uninstalled (it was giving me some trouble when i played
Age of Mythology over the LAN).

I think thats about it. Long story short, Web Protection ON = No form data for
the CGI. Web Protection off = Everything fine, CGI receives form data.

4

Guessing what should it be… but I’m almost empty…
Which is the browser being used?

5

It happens in all the browsers i have tested, IE8, IE7, and Firefox.
(currently using IE8)

I havent tested in Chrome or Opera.

Could it be my location? Im in Mexico, maybe its blocking my IP range?

(I have changed my IP several times and same problem happens, checked
in www.WhatismyIPaddress.com)

My PC’s network port is connected to the Port in my router, where other
3 PC’s besides mine are connected. The router is then connected to the
modem.

The other PC’s act the exact same way. (in case that tells you something)

6

Who is blocking? avast can’t do that… it’s only an antivirus.

7

I said that because i dont know how the WEB protection works internally.

Just a wild guess.

8

I will check this post again tomorrow in case somebody needs to know
any other details to be able to help.

Thank you. :slight_smile:

9

I have found the culprit. I dont know exactly how but seems like WEB Protection
delays the sending of parameters for a brief moment, my CGI tries to read the parameters
too quickly and doesnt read anything because no info arrived yet.

Using SLEEP 1000 (waits 1000 milliseconds) allows some time between the lag of the
arrival.

The strange thing is that even if Not using SLEEP 1000 the CGI works every 5 minutes
or so. The rest of the times its a complete blank. Im still puzzled by that.

Although it is working now, i would like to know why is this happening. :slight_smile:

10

Hi,
This is fairly interresting. I don’t think the delay is the reason here. Every packet may travel the net with a different speed and therefore you can not relay on exact timings. WebShield indeed does separate the headers and the body into two distinguished packets. So maybe your recv( ) call just recieves the first one on first read and the second part very soon after during another recv( ) call.

Lukas.

11

Hello Lukor,

Yes, thats what seems to be happening. I have to make several RECV calls
if i start right away, if i allow some milliseconds, one single RECV does the job.

12

However this is essentially a bug in your code :stuck_out_tongue: there is NO guarantee in how many packets the communication comes - if frequently use netcat for testing or telnet, there one packter equals one byte…