Why Is AvastUI.exe Dialing Out To India?

[Asyn]

@DonZ63 post:20

The only baseline software reason I can determine avastui.exe is used for is the WebRep feature.

WebRep doesn’t need avastui, afaik.

[DavidR]

@DonZ63 post:20

The only baseline software reason I can determine avastui.exe is used for is the WebRep feature. I don’t use that feature.

The avastUI.exe is the graphical interface and is used by many shields, I believe that the alert windows are also handled by the avastUI so if that isn’t running, I guess you wouldn’t see the alert window. You could test that by downloading the eicar test file whilst you don’t have the avastUI running.

I don’t believe it is required by the WebRep to display the WebRep information, as I believe that would be done by the browser as essentially it is a pop-up displaying the data when you click on the webrep icon, etc.

@DonZ63 post:20

I personally detest “cloud” concepts and processing. To me it equates to giving vendors a built-in spyware backdoor; something by the way that MS has built into their OSes since day one. The risks of clould compting far outweight its benefits.

I guess you are going to have a hard time with that one, as it seems that this is the way most AVs are going. I’m no cloud fan as when your internet is down so to is that element, but it rather depends on how heavily the AV is dependant on cloud processing.

@DonZ63 post:20

As far as my situation goes, I could live with the Avast advertising but not when DNS resolution is to questionable sources.

Also closely look at the WhoIs data from my original screen shot. You will notice that the Indian city mentioned is Bombay. Has that city not been named Mumbai for sometime?

The resolution of the IP address isn’t something in the control of avast, that is down to whatever application (TCPView) resolves it and the DNS server it used to resolve the IP address.

Get the IP resolution wrong and the whois details taken from the domain name (resolved IP address) will also be wrong. As Vlk said “Reverse DNS lookup is often bogus.” perhaps, bogus should be replaced by wrong.

As you found doing a whois on the wrong domain name returns a different IP address, so the problem is one of incorrect resolution of the IP address…

[Asyn]

@DavidR post:22

…I believe that the alert windows are also handled by the avastUI so if that isn’t running, I guess you wouldn’t see the alert window.

You’re wrong about this Dave.

[igor0]

I would add: “That, however, may change at any time, even via a virus definition update”.

[Asyn]

@igor post:24

I would add: “That, however, may change at any time, even via a virus definition update”.

Hope you tell us before.

[system]

I unblocked avastui.exe and checked to see what it connected to. IP is 75.125.212.75 with no DNS resolution for two connections. This is an iPlanet IP so I assume it’s OK. The other two connections are to avast.com, IP 207.218.232.82.

Still would like to know what avastui.exe does. It just stays in a perpetual wait state for port 443.

[DavidR]

Yes, avast has a number of hosted servers at planet internet.

[system]

@High_Treason post:10

Why is is that software today always seems to like connecting to the internet for no apparent reason, I must say, on top of all the scareware, logic bombs and shovelware this does seem suspicious.

How do you think that some free products cover their costs? They need advertising, and may be also sell “aggregate” data?! As for Indian IP addresses, that is one of the “benefits” of the “wonderful” cloud that every one is so hot about these days.

I wish Avast were a bit more upfront on this. I was thinking of buying a few professional licenses for our small office but this now worries me a bit. I will wait for an answer befroe I decide next week.

[igor0]

Please read the thread again… there is no Indian IP - it’s just a problem with the reverse lookup on the original poster’s machine.