Windows firewall blocked programs

[system]

I know Avast! allows all blocked programs in Comodo Firewall to access the Internet when web shield is active (tested it myself), I’ve also heard it does the same for Windows 7 firewall; is this true?

If so, is there any real security reason why the web shield can’t be disabled permanently? thx

[system]

Personally, under the Web Shield settings, I have “Scan traffic from well-known browser processes only” checked.

My thinking is that I allow well-known browser processes by default, so at least they get scanned. Everything else I allow is (hopefully) a trusted application, and everything else is blocked.

I am using Windows 7 firewall with Windows Firewall Notifier, and it is true the same with Comodo.

[DavidR]

It isn’t avast allowing blocked programs, but comodo not able to differentiate that program going through (being filtered into) the avast localhost proxy (avastSvc.exe).

There is another couple of topics about this and by all accounts it is comodo not using the latest filter driver (used in win7) but still using the old driver, which is almost exclusively banned in win7.

I can’t recall the topic offhand, you could try a forum search.

[system]

I think DavidR is referring to this post here:

http://forum.avast.com/index.php?topic=93953.90

@lukor post:103

Guy, I want to clarify few things here:

Avast version 7 uses supported API of Windows 7, that is created solely for the purpose of redirecting network connections. It uses it to redirect connections. It is new in avast7, however Windows7 is not such a brand new OS and the redirect api (REDIRECT layers in WFP) are there since the Win7 launch (2 years? More?). There is no other supported way of doing it.

In some of the previous comments from COMODO, they said they use TDI as well as WFP on Win7 and stated that they are not able to fully filter all traffic on Windows 7. TDI interface is entirely deprecated with Windows 7 and almost banned in Windows 8 (no compatibility Logo with TDI drivers for example, performance hits on Win7). Avast is trying to be more compatible and nicer to newer OSs and this is why we are also trying to eliminate TDI drivers from our code and replace it with the Microsoft supported equivalents. The first step was this redirect driver, previously on TDI, now correctly on WFP.

We will never change it back and will continue to remove other TDI drivers from our products.

Thanks.
Lukas.

Whatever, by all accounts I can find, and by my own experience, the Windows 7 Firewall will NOT block applications with Web Shield activated. I have all the latest MS updates that I am aware of.

[DavidR]

Yes, that’s the topic I was thinking about.

I don’t know about the windows 7 firewall (I don’t use it), unless the user has set the win7 firewall to monitor outbound traffic and also sets the rules governing connections.

I know there are some that are using Windows Firewall Control, a more user friendly interface, I don’t know if they are also having this issue with blocked applications being able to tunnel through the avast localhost proxy unmolested by the windows firewall.

So the “Scan traffic from well-known browser processes only” enabled (that you mentioned) shouldn’t redirect their http connections/traffic through the proxy and hopefully the windows firewall would then block them.

[system]

@DavidR post:5

So the “Scan traffic from well-known browser processes only” enabled (that you mentioned) shouldn’t redirect their http connections/traffic through the proxy and hopefully the windows firewall would then block them.

Correct, that works. Ideally I’d like to scan all traffic I allow with WebShield if possible, but not sure I want to go to a third party FW. So for now I’m using what I think is a reasonable compromise.

Haven’t used Windows Firewall Control, but I’m using Win Firewall Notifier, which I think is an even lighter type of WFC, so I think they would work the same. I tried TinyWall, a similar app, and it does work the same.