CFP3 blocking Avira AV daily update (Rule help needed)

Help for v3
1

Comodo is stopping my Avira AV from connecting home for updates. I have also tried to do it manually but cannot get a connection. This never happened before only since I did a clean install of the latest version. Could one of you clever chaps possibly give me a walkthrough on how/where to set a rule to allow this.

Thanks in advance.

2

Clever and clever, well, I’ll give it a try:

First, test with an manual update of Avira and see if it works.
Second, if not, locate ‘…\AntiVir PersonalEdition…\update.exe’ in Network Security Policy and check its rule wich should be ‘Allow IP Out From IP Any To IP Any Where Protocol Is Any’.
Also check the rule of Avira’s notify.exe, it should be ‘Allow IP In/Out From IP Any To IP Any Where Protocol Is Any’.

It may had happen that if an update has occured you’ve missed to answer the alert message. It lasts only 2 min as default and if you miss that CFP automatically denies access for the session.

Hope this will help.

3

Hiya bluesjunior,i have 2 rules for Avira like Snowhawk,this works ok for me.

Is the update timing out as sometimes when Avira servers are busy it does this for a bit?

Nice 1 Matty

[attachment deleted by admin]

4

Thank you very much for the replies guys. To cut a long story short I have had a whole lot of trouble over this today. In the end I had to uninstall Antivir and delete all reference to it on my PC and also in the firewall rules and Defence + Rules. I then reinstalled Antivir and this time it updated. I don’t know how to take a screenshot and post it as Riggers has but I went to “Define a new Trusted Application” and added Antivir.

I now have three rules in Network Security Policy which look like the following.

(1) C:\ProgFiles\Avira\AntivirPersonalEditionClassic\update.exe
Allow IP out from IP any to IP anywhere Protocol is any.

(2) C:\ProgFiles\Avira\AntivirPersonalEditionClassic\ avnotify
Allow IP out from IP any to IP anywhere Protocol is any.

(3) C:\ProgFiles\Avira\AntivirPersonalEditionClassic\avgnt.exe
Allow All Requests

Is this how it should look or should I alter it?.

5

Keep in mind that Antivir Free if thats what your using uses slowly servers. You might want to switch to Avast. I had a similar problem with Antivir free that updates took forever.

6

[at] blues

Almost right, but:

Your rule (1) is OK.

Your rule (2) should be: Allow IP In/Out From IP Any To IP Any Where Protocol Is Any

Your rule (3) not necessary at all, you can remove it.

And as Vettetech say, sometimes their servers are very busy and if automatic update fails it will take 24 hours to next autoupdate. Of course it works if you do it manually (n.b. if servers will respond).

7

Thanks again Snowhawk. I have altered them now and will see what happens over the next few days.

8

You’re welcome. Good luck!

9

Hi,I seem to be having the same problem.I have Avira Premium,when it automatically checks and finds updates, i get a comodo alert.Saying Update.exe is trying to modify c/documents/all users/application data/Avira etc.Every time, I click allow, and remember my answer. If im not at my computer,the alert goes unanswered,I get no update (:AGY).The manual update works fine,no alerts.In network security policy i have
(1) C:\ProgFiles\Avira\AntivirPersonalEditionClassic\update.exe
Allow IP out from IP any to IP anywhere Protocol is any.

(2) C:\ProgFiles\Avira\AntivirPersonalEditionClassic\ avnotify
Allow IP out from IP any to IP anywhere Protocol is any.

Can anyone help a noob please

10

Hi mike.

You can try to set avconfig.exe to Trusted Application in Defense’s Computer Security Policy.

I’ve done that, but I’ve forgot the reason for that :slight_smile: , maybe because of a problem like yours.

I’m not really shure if that helps, but give it a try.

11

Will try that Snowhawk.Thank you kindly

12
  1. Set update.exe as Trusted Application (Or Installer or Updater) in Defense+. Also make sure that preup.exe is allowed to execute update.exe and sched.exe is allowed to execute preup.exe
  2. update.exe only need TCP outbound connections to port 80( and UDP Out 53 if DNS Service is disabled), then Allow IP Out should work.
  3. the rules for avotify.exe don’t affect the update of virus databases. Actually the update will work correctly even if avnotify.exe is not allowed to execute.
  4. avgnt.exe does not longer use localhost connections, so the firewall rules for it are not needed
  5. Perhaps the servers are too busy and Comodo thinks that the reply does not belong to the connection as it takes too long. I suggest you to go to scheduler tab in Antivir and create 2 new Daily update job at different times.
13

Just to tell you my problem is resolved.Not sure which bit did the trick.I made update.exe a trusted application.Iwas also advised on the Avira forum to allow the following
sched.exe
avcenter.exe
avguard.exe
avgnt.exe
update.exe
avesvc.exe
avmailc.exe
avconfig.exe
preupd.exe
Anyway,Ive just updated Avira with no alert from Comodo,thank you very much for taking the time to reply to my problem (V)

14

I guess I can post my question into this thread instead of creating a new one.

I’m planning on buying a new laptop and I’m wondering which antivirus & firewall software to install there when the licence of original antivirus software expires. I thought one combination could be Antivir (free version) and Comodo firewall, so after reading messages above would you choose those 2 together if you were me? I have never used them yet. My university offers F-secure (including antivirus & firewall) for free, for us students but I have “plan B” in case the mentioned F-secure & Vista take too much RAM together.

15

Reguarding Vista home premium 1GB Ram I have a desktop computer (Vista Home P.) with only 1GB Ram and I find this a bit low on boot with CPF3 and CMF(Comodo Memory Firewall) the driver in CMF does not load unless I wait 1 to 2mins before I login.
So if F-secure needs 512 MB it would be very close at boot with only 1 GB ram.
Task Manager:-After approx 1hr 320mb 2mins after boot 400-500mb during the first 2mins it can rise to 856mb I could stop some other services or delay start to reduce this but I intend to increase Ram as soon as 1 year guarantee is finished.
Dennis