Web Shield blocks internet inbound, intermittently.

Avast Free Antivirus / Premium Security
1

I have seen the other posts on this topic. I have not seen a solution or even an acknowledgment that there is a problem. So here is what I see.

Running XP. No software firewall. Avast 4.8-1229. Occasionally, two or three times a week, all browsers stop receiving internet data, in both Firefox and IE. In firefox it gets stuck at “waiting for http:…”). This also tells me in is getting past sending to the DNS server. So only inbound TCP/IP data is blocked. I cannot even see my router, 192.168.1.1. All other internet operations, in and out, are not effected. Email, P2P, pinging, etc are OK. If I disable Web Shield (or reboot), it is fixed. I also run Spyware Terminator, but I disabled it, and soon enough it happened again. And, just for fun I installed Avast on another computer that had been running AVG. It took several days, but it did it too.

There is a very real problem here, although it is not constant and I guess does not happen on all systems. Sure looks like it is blocking Port 80 inbound. Right now I am just running with Web Shield turned off. After reading what it does I don’t think it is very useful anyway. But, I do like to solve problems. Any ideas as to which way to pursue this? (I am a SW engr).

2

Can you activate logging in WebShield?
0. (Disable avast self-defense module: Program settings > Troubleshooting tab of settings.)

  1. Edit \data\avast4.ini file with Notepad (or use step 0 with other text editors).
  2. Find the section [WebScanner]
  3. Add the line:
    EnableLogging=1
  4. Restart Web Shield in XP\Vista (terminate and start again) or whole PC in case of Win98
  5. Browse (trying to access some webpages)

The log file are \data\log\ashwebsv.log and ashwebsv.ws.
They would be accessible when WebShield is terminated again.
Post them here or send by mail to rypacek (at) asw.cz
After that, disable the logging to avoid a big log file.

Oh, enable the self-defense module again after that if you have to follow step 0.

3

Hi, sorry to burst in if you dont want me to

But this really look like the same problem I have, only, I dont understand 65% of what is said in your posts… I’m no good with technical terms, I’m afraid ^^"
Anyway, in short terms, after DL’ing Avast! Home today, my Internet Explorer wont work, meaning, when I try to go on with it, I get a messege telling me that I dont have connection, but my MSN msg. is working perfectly, so I do have connection.

Is my problem similar to zbaba4’s or is it a completely different one?
(I know I’m probably a pain with all this, but I am a girl with no idea of what she’s doing at all. At least I’m not blonde…)

Oh, and I run on Vista, if that might have anything to do with it ^.^

4

Killingen

Cut out the I’m just a girl crap
plenty of posters of all ages and sexes have exactly the same apprehensions
At least you posted- some one will come along to help

Think Karen Carpenter
GIRL POWER

5

From what you say I would say your problem is different as the blocking is permenant not intermittent.

What is your firewall ?
Does it allow ashWebSv.exe internet access ?

  • If it does delete the entry for it and reconnect to the internet, start browsing, this will force the firewall to ask permission again.
6

I’m blonde… what’s wrong with that? :wink:

7

DavidR :
Ehm… I actually have no idea what my firewall is ^^" I know there’s the microsoft one coming with the computer, but other than that… I have no clue. I did, however, make that one allow Avast! to run and not get stopped, but it didn’t do any difference.
Like I said before, I have no idea of what all this stuff means, I just know my internet browser wont work when Avast! is enabled.
Basically, I need a “… for dummies” on everything that doesn’t have to do with installing programs and surfing the net on a computer ^.^"

Tech :
I love stereotyping. It’s fun!
But nothing is wrong with being Blonde. I was once.

8

Do you have some software that was installed when you buy the computer?
Maybe Norton or McAfee? They could have a firewall…

But if you don’t have one, just Windows firewall, some other software is blocking/conflicting with avast… probably a security one… can you guess which one?

9

At the moment I have NOD32 as my antivirus, but I have’nt really got a clue on how things work.
But even though I disable NOD(which makes me think I stop the firewall too?), Avast still stops me from being able to use my IE. Only way I can use IE is if I disable avast.

10

Tech… Thanks for suggestions. I have decided not tp troubleshoot this, just leave Web Shield disabled. I expect I would find some conflict with some other software. Then what? Typically I would disable something to make it all work only to find that a next release messes things up again.

This whole area of anti-Virus, Firewalls, Anti-Spyware, etc, is becoming a quagmire of apps bumping into each other. And it keeps getting worse with every release. I switched from AVG to Avast it became so invasive. Of course the classic example is Symantec.

Killingen… you are a victim of what I said above. With help you will find the conflicts and either disable features or uninstall programs. In general, do not run multiple apps doing the same thing. Of course it is hard to figure out that is happening. Disabling an app does not necessarily turn everything off. Unfortunately, even uninstalling doesn’t always remove everything, the classic example being Symantec. As I said, even if you fix it, be ready for it to collide again with updates. You are fortunate to isolate your problem to Avast. Try turning off Web Shield. Otherwise just don’t use Avast.

11

Disabling won’t help as it will still load virtual drivers which could still conflict with avast.

You would have to uninstall nod32, I don’t know if nod32 also has a suite that includes a firewall, check the Windows Security Center, that will say what firewall you have and more importantly if it is disabled.

12

According to Windows Security Center, it’s Window’s own firewall I’m using.
And I’ll try uninstalling NOD32 as soon as I get the time ^.^ Being a busy girl isn’t always easy ^^"

13

First hello to the initiator of the topic zbaba4 with the note that I am also SW engineer and agree in all aspects with your way of seeing things.

In my case it seems to be intermittend interferring with sunbelt firewall. Disabling sunbelt didnt help, I had to stop it running, then it worked. Disabling web shield helped independent of the firewall. As I couldnt find any logic, at the end I started un- and reinstalling of both products till my registry got corrupted. Thanks God there was an image backup of a day before…

It seems to be an unpredictable behaviour and if I proceed using avast, I will run it w/o web shield. Just God knows till when again.

14

Disable is not enough… avast is not compatible with other resident antivirus (well, unless you’re a very advanced user and tweak the installations, etc.).

15

From the last few posts, QED (if you know what that means) relative to my last post.

Changing apps in this area has become a regular hobby. I try to stick to free ones for that reason, but I have also had to ditch paid ones( Sunbelt, Spybot, eg). Most of the time a few weeks/months after I find an issue, there is an update to fix it a after a period of denial by techs from each company.

So, if anyone cares, here is my general stategy for protecting my system…
AV is the one must use app. WHichever one I use I try to strip it down to basic functionality.

If I am using a Spyware/malware protection program, I only use it for scanning not real time.

I have a router and don’t use a SW firewall. I know this doesn’t check outgoing.

And most of all, I use a program RollbackRx. I used to use Norton GoBack but it seems to be abandoned. I take "snapshots of my system twice a day automatically and manually before I start playing with apps. It runs in seconds, including reverting/restoring to an earlier time. It is the very best way to uninstall recently installed software. Image backups are fine, and necessary, but too slow.
I run automated scans every night.

So overall I am saying I have “reasonable” protection in real time, scan for issues often. Viruses, come and get me! I will just RollbackRx to an earlier snapshot.

16

“Quod Erat Demonstrandum” (literally, “that which was to be demonstrated”).
I think we don’t have to demonstrate anything… the facts, your computer, is showing that… I mean, that disable is not enough…

17

Great, now I have a new problem. I cant find the button uninstall -.- and when I go to find the files in my drive, it says I need permission to delete them -.- I so hate computers sometimes… EDIT: I found it! Yay me! I found out stuff! >.<

Anyway, I found out that if I disable the webshield, I can use Internet Explorer.
So, my next question is, what does webshield do? Does it completely stop checking of viruses coming in from the web, or something else?

18

Yes, it scans the Internet traffic (http) before any file is saved in your computer.

19

So, not having it running is kinda a bad idea, unless you have it do a scan everytime you shut down the system, no? (just trying to get an idea of what is really going on. The build-in help thingy isn’t making much sense to me ^^")

20

Hi
I have the same problem, and I did what was suggested by Tech. I noticed that the web shield blocks all www addresses, and it partially allows local addresses. I.e. I was able to open my router’s web interface (192.168.1.1), but JS didn’t function in it…
After all suggested manipulations I have AshWebSv.ws empty and AshWebSv.log contains following:

29.08.2008 0:21:17,“http://www.google.com/search?q=avast+web+shield+blocks+all+connections&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a","text/html; charset=UTF-8”,“GET”,HTTP Status: 302,0,357,664,920,920,666,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1164 ↔ 192.168.1.33:1165->74.125.39.103:80,SEQ: 1
29.08.2008 0:21:23,“http://yandex.ru/","text/html; charset=iso-8859-1”,“GET”,HTTP Status: 301,0,237,506,722,722,508,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1166 ↔ 192.168.1.33:1167->213.180.204.11:80,SEQ: 1
29.08.2008 0:21:23,“http://www.yandex.ru/","text/html; charset=windows-1251”,“GET”,HTTP Status: 200,0,10774,11167,726,726,11169,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1168 ↔ 192.168.1.33:1169->93.158.134.3:80,SEQ: 1
29.08.2008 0:21:28,“http://192.168.1.1/“,”","GET”,HTTP Status: 302,0,196,378,404,404,357,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1170 ↔ 192.168.1.33:1171->192.168.1.1:80,SEQ: 1
29.08.2008 0:21:28,“http://192.168.1.1/home.asp",“text/html”,"GET”,HTTP Status: 200,0,562,701,412,412,703,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1172 ↔ 192.168.1.33:1173->192.168.1.1:80,SEQ: 1
29.08.2008 0:21:28,“http://192.168.1.1/rpPanel.asp",“text/html”,"GET”,HTTP Status: 200,0,5146,5285,453,453,5287,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1174 ↔ 192.168.1.33:1176->192.168.1.1:80,SEQ: 1
29.08.2008 0:21:28,“http://192.168.1.1/status.asp",“text/html”,"GET”,HTTP Status: 200,0,10041,10180,452,452,10182,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1175 ↔ 192.168.1.33:1177->192.168.1.1:80,SEQ: 1
29.08.2008 0:22:23,“http://www.google.com/search?q=avast+web+shield+blocks+all+connections&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a","text/html; charset=UTF-8”,“GET”,HTTP Status: 302,0,357,1328,1840,1840,1332,\Device\HarddiskVolume1\Program Files (x86)\Mozilla Firefox 3\firefox.exe,PID: 4836,CON: 127.0.0.1:12080->127.0.0.1:1164 ↔ 192.168.1.33:1165->74.125.39.103:80,SEQ: 1

I’m using AVAST for several years now, and this is the first time such a disaster has happened… :frowning: