Comodo Firewall and Avast 7

[hellion]

Hi Clockwork,

I believe ALL users that have Avast is experiencing this and will never know.

Disabling webshield will cause all browser data and other application information being sent over the internet to not be scanned.

I would rather not have a firewall than have that data not being scanned.

[clockwork]

What scenario are you afraid of?
Avira never had a web shield. I have been safe though.
And together with comodo, what should happen?
Now i use avast.

I rather want a firewall, than a web shield. Because without firewall, you dont have any control!

[Radaghast]

This is definitely an Avast problem. If you use the Windows 7 firewall and set the policy to disallow outbound connections without an explicit rule, launching a browser and trying to connect to any web site fails. As soon as one adds avastsvc.exe to the policy and allows it to make outbound connections, any browser will connect, even without a rule.

I don't personally use any Real-time antivirus products, but if I did, Avast 7 would not be on the list, at least until this is resolved. I'd rather have a good firewall anyday.

[clockwork]

Are you speaking about effects without the web shield?

And i wouldnt call it an avast problem. Because if "the file" wasnt from avast but malicious, it wouldnt be just a trojan problem. It would be also a firewall problem!

[hellion]

Hi Clockwork,

Honestly, I would like a Working Firewall and a Working real-time scanner.

[clockwork]

Sure.
I replaced several antivirus programs (used over time) with the portion of avast which covers the same sphere.
Data system protection.
It feels like the old programs, just better, with statefull.

I never installed all the other things. I just wanted an antivirus that detects things on my computer, and what i can use to scan new arrivals.

This situation has to be solved as soon as possible. And the firewall developer should take a look how their product can be bypassed by something like that.

[Radaghast]

Are you speaking about effects without the web shield?

And i wouldnt call it an avast problem. Because if "the file" wasnt from avast but malicious, it wouldnt be just a trojan problem. It would be also a firewall problem!

I'm talking about the fact that the Avast web shield is allowing connections for applications, for which no individual rules exist. Basically, anything that wants out via TCP port 80, won't be stopped, rules or not, providing avastsvc.exe has outbound access. I would, however, agree that the firewall(s) need to be looked at too.

[John Buchanan]

Just adding my 2 cents worth in.
Avant 7 does indeed currently have issues that they are trying to resolve.
It may be safe to say the web shied issue is Avast's issue and they need to resolve it.

[Radaghast]

I need to modify my earlier statement about this being solely an Avast problem. I'm in the process of tying other firewalls with Avast, to see which block and which don't. So far, CIS and Windows 7 firewalls allow Avast to proxy applications, for which no rules exist, or which have received explicit blocks. Outpost 7.5 blocks the browser, when told to do so.  I'll try some more and retest tomorrow.

[brightness]

I dont know what you mean with, the path is empty.

I mean the path is blank, with only a yellow folder icon on the left. You are correct that I often use the Purge function!

However, I would suggest that CIS adds Avast Software as a trusted vendor.

Thanks.

[clockwork]

The thing isnt that avast isnt trusted.
It gets in both lists erased by purging because one of its parts is not "present" all the time. Not "present" things get purged.

In defense+ it is ok to use safe mode. There you get the avast file rule restored next time it becomes "present" again.
I use custom mode in firewall. In this case, if you purge the firewall list, the entry will be "re"created after you got a question, but not automatically.

Since i use avast, i remove things from the firewall list manually. It would be nice, if the avast file would be permanent "present". Thats the point.

[Radaghast]

I mean the path is blank, with only a yellow folder icon on the left. You are correct that I often use the Purge function!

However, I would suggest that CIS adds Avast Software as a trusted vendor.

Thanks.

A couple of things. First, Avast is on the TVL. Second, avast.setup is a visualised file, that is, it doesn't exist anywhere with that name. This is why, when you run purge, CIS can't reconcile the entry with anything physical and hence offers it for removal. By the way, it helps to look at he the files the purge option offers for removal, before actually accepting.

[brightness]

A couple of things. First, Avast is on the TVL.

Sorry, I forgot that avast is actually from Alwil Software. Thats why when I looked for avast software in the TVL it did not exist.

Thanks.

[Radaghast]

Initial results of testing the ability of firewalls to block requests from browsers and to a lesser extent, other applications, when Avast Web Shield is enabled, is as follows:

Windows 7 Firewall - Fail
CIS firewall - Fail
Outpost 7.5 - Pass
Online Armor Premium - Pass
PCTools IS - Pass

In brief:

1. Clean Image (not virtual)
2. Install firewall - reboot
3. Install Avast 7 - reboot
4. Test Web shield is working
5. Connect to any site with a browser
6. Block the browser in the firewall
7. Attempt to connect to any site with a browser
8. Disable Web Shield
9. Attempt to connect to any site with a browser

CIS and Windows 7 firewall fail at step 7, that is, it's possible to connect to any non-https site, when there is a rule blocking the browser from making any outbound connections. The connection is allowed vis the AvastSvc executable.

On the face of it, it looks like a bug in the firewall, so I'll create a full bug report. If anyone has anything to add, please post.

 

[Radaghast]

Sorry, I forgot that avast is actually from Alwil Software. Thats why when I looked for avast software in the TVL it did not exist.

Thanks.

[attachment deleted by admin]