Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: MrSafe on July 31, 2011, 06:19:58 PM
-
Hi. I have just started using Avast and find that it is always trying to connect to the internet even though I have switched off automatic updates. I have disabled the Web Shield because it was stopping my connection completely, so there should be no reason for Avast to connect to the internet (I find that the Network Shield still protects me & the File System Shield should catch anything in the Temporary Internet Files folder before it can do any harm). I have blocked all connection attempts by Avast.exe and AvastUI.exe with my firewall and find that I can still update by allowing Avast.setup, which does not try to connect until I tell it to. I would like to know why Avast is persistently trying to connect and what information it would send. Thanks.
-
This is normal for avast to do this. It tries regardless to connect to the internet connection even when you open the GUI. BUT WHY STOP IT THOUGH AS IT DOES THIS TO TRY AND UPDATE!
Norton did similar thing
You can stop it as follows.
Create a dial up networking short cut to desktop click that if you want to connect to the internet!
open ie8 or ie7
under tools /internet connections/ options /never
and thats it
-
Since you are not saying where it's connecting and on what occasion, it's hard to say.
In any case, the theory that the File System Shield protects your browser via its cache just like WebShield... is wrong. There's no reason the web browser has to save everything to its cache, or save it there before it actually uses the data. Also, the File System Shield doesn't scan all the filetypes (unless you set it to scan all the created files, but that would slow down your system noticeably). The Network Shield also doesn't duplicate the WebShield's functionality, it blocks the connections according to the URL, not according to the page content (i.e. blocks different pages).
-
Hi. I have just started using Avast and find that it is always trying to connect to the internet even though I have switched off automatic updates.
Besides the answers you already received, I want to add a little detail.
Avast checks for available updates every 240 minutes (that's the default).
Some of those checks are negative (no update available). From those times that Avast actually finds an available update, if you set it to automatic update, it performs the update.
When you set it to manual update, the "checking" part is still done (don't ask me why, because I still think it shouldn't check when in "manual", but that's the way it is). The "manual" setting is only stopping Avast from actually applying the available update.
The third option is "ask". It "checks" for available updates, and when it finds them, Avast asks you whether to apply it in that same moment. (In this case, the actual check is still valid, because without it, you wouldn't be asked).
Although nowadays having a security tool that can't update its database from the Internet would be strange, there are certainly some situations when you want to avoid from Avast trying to connect, even if it is just for "checking" the availability of updates.
I hope that for Avast 7.0, the "manual" (NOT "ask") update will mean avoiding to even check for availability, unless the user "manually" checks for updates. At least, there should be an additional option, so to either:
- make it work as the current versions are in "manual" mode; or,
- to avoid the "checking" for available updates too when in "manual" mode.
That extra option would give the user more control so to adapt Avast to more different situations.
-
I'm afraid I do not understand the first reply, but it sounds like that would block my connection completely if those settings were there and I do not use dialup. The sites it is connecting to are all owned by Avast, the majority are in the following IP ranges:
74.55.xx.xx
46.4.xx.xx
174.120.xx.xx
75.125.xx.xx
I tried blocking AvastUI.exe and Avast.exe with my firewall and could still update by allowing avast.setup. I do not understand why Avast.exe or AvastUI.exe need to connect to Avast's servers when it is not updating and even after it has just updated. I thought the only files that do not go into the Temporary Internet Files folder are streaming videos, is that not so?
Thanks for all the detail, ady4um, I absolutely agree Avast should change that. I will block the unnecessary connections and only allow avast.setup to connect when I want it to! I suppose I can add Avast's many IP ranges to a network zone in my firewall, block it and reenable the Web Shield. I am very security conscious (does it show?) and don't want an antivirus ruining things!!!
-
Doesn't WebRep connect to Avast servers for it's ratings? That may be part of what you're seeing. Disable WebRep and see if that doesn't quieten things down some.
-
Seriously, why ppl worry so much why programs like avast! are connecting anywhere? It has many subsystems which rely on connection to their services. It's not like avast! is sending your documents to AVAST Software which is then reading it in an underground volcano secret base, waiting to conquer the world... Program generally connects for the ads inside avast! (free version), for news content inside avast! (all versions), CommunityIQ feature (all versions), WebRep (all versions), updating (all versions) and probably things i forgot and are there.
All these require occasional connection.
Traffic factor is also negligable as the data is usually so small you won't notice it even if you have a 56k modem or a very limited internet plan. But it does make connection so you will see it if you chase every packet your computer sends or receives. Which is a bit over paranoid if you ask me as far as avast! is concerned.
avast! is a verified, well known and trusted program. I'd bother with such thing on a new unknown product that may be questionable, but with avast! (or any other well known security program) a completelly pointless thing to do really. Days of static strictly offline antivirus programs are long over, they pretty much all use "cloud" like features to some extent and they use live connection to enhance protection or provide certain features that require connection (like WebRep).
-
RejZoR, I agree. If one doesn't trust their security program, then why are they running it at all? ::)
-
...It's not like avast! is sending your documents to AVAST Software which is then reading it in an underground volcano secret base, waiting to conquer the world...
;D 8)
-
;D 8)
What are you smiling about Asyn ;D
-
What are you smiling about Asyn ;D
I'm not allowed to tell. :-X ;D
-
I'm not allowed to tell. :-X ;D
Than give me $500 and I'll leave you alone ;D
-
Than give me $500 and I'll leave you alone ;D
That's quite cheap. :P
-
I didn't expect so many replies, thanks, sort of!
Gopher John: I didn't install WebRep, so that's not creating any connections.
RejZoR: I haven't seen any ads in Avast and don't have the features you mentioned. Security should always be as high as possible, otherwise why install an AV? People trust lots of things they shouldn't, often the bigger the company the less trustworthy! I even block Google Analytics (and not by the Google Analytics Opt-out, which is another privacy/security risk). Control of my pc and information is responsible, not irrelevant. I agree that chasing every packet would be over-paranoid, so I don't. The size of the info it sends is irrelevant, especially if compressed or concatenated. Why does Avast send anything? An AV should prevent this, not cause it. Do you know what information it is sending? I do not think they would conquer the world with my info, I just wonder what they ARE doing. Nor do I care whether they have their base in a volcano or an office, they cannot have access to my pc. By the way, Avast sometimes blocks access to your website because it contains "malicious" content:
http://forum.avast.com/index.php?action=profile;u=1713/ (http://forum.avast.com/index.php?action=profile;u=1713/)
Gopher John: I am using it for security, which I protect without exception. If in doubt, find out. I continue to use it because I have taken control of it.
Asyn:I'm not allowed to tell. :-X ;D
Privacy, I like it
-
Avast sometimes blocks access to your website because it contains "malicious" content:
http://forum.avast.com/index.php?action=profile;u=1713/
I thought it might stop, so I took a screenshot:
(http://img155.imageshack.us/img155/3315/avastn.jpg)
http://imageshack.us/photo/my-images/155/avastn.jpg/ (http://imageshack.us/photo/my-images/155/avastn.jpg/)
-
Avast sometimes blocks access to your website because it contains "malicious" content:
http://forum.avast.com/index.php?action=profile;u=1713/
(http://img827.imageshack.us/img827/4156/avast2.jpg)
Trying to get the best resolution possible!
-
I'm using avast! for years and i haven't got any such warning on my page. Ever.
As for avast!, if you don't trust a well known security company like avast!, why do you even use it or even use internet for that matter? I mean, do you know where all Windows itself connects? You'd be terrified. Not to mention 3/4 of all programs. But in the end they all bash at avast! because it transfers few unimportant bytes over the net.
-
It is not a matter of trust, I use the internet because I make myself safe. Yes, I checked every connection my pc makes and allow certain things to connect to certain sites using the correct ports and block anything that is not of benefit to me. For example here is how I configure svchost.exe in my firewall:
-
I am not terrified of Windows because I control what it is doing and do not allow others to bypass my security. If those few bytes Avast send are unimportant then why does it do that? And in that case everybody should block it. I am not "bashing at" Avast, I am querying the information it sends. I did not expect to be criticised for being secure on the forum of an antivirus software. When you say they all bash at Avast for the information it sends it makes it sound like these people are being ignored when they also want to know what is being sent.
-
Sorry, but if you cannot make a trust with the security vendor then we just cannot help you.
If you have such paranoia and doubt in avast! then uninstall it, unplug the computer from the internet and turn it off just to be sure. This might sound sarcastic but quite frankly they won't go and change the whole program just because 1 person feels over-paranoid because of few connections done by the program that is internet aware and requires it to operate.
And for the Windows itself, are you inspecting every packed and its content to be that sure? A pack of port rules makes absolutelly no difference if Windows tarnsfers all the stuff through Windows Update when you do the regular update. never thought of that? So much for calling avast! acting as trojan. I'm not saying Windows does that but i'm just proving the point to you.
-
If you have such paranoia
Questioning what information it is sending is not paranoia it is security and privacyunplug the computer from the internet
Unplugging it from the internet is not necessary because I am secure. and turn it off just to be sure. This might sound sarcastic
Turning it off just to be sure is totally unnecessary once secure and, therefore, blatant sarcasm.but quite frankly they won't go and change the whole program just because 1 person feels over-paranoid
they all bash at avast! because it transfers few unimportant bytes over the net
so it is not just 1 person and I hope security is not considered over-paranoia at avast.connections done by the program that is internet aware and requires it to operate
It is operating fine after blocking the connections, so they are not needed to operate.And for the Windows itself, are you inspecting every packed and its content to be that sure
No I am BLOCKING every unnecessary packet and its content to be sure.A pack of port rules makes absolutelly no difference if Windows tarnsfers all the stuff through Windows Update when you do the regular update. never thought of that
Yes I have. So they only get access when I want to update and can make no other connectionsSo much for calling avast! acting as trojan
A Trojan is something that sends information from your computer to its author without your permission, like Avast does. That is something an antivirus should NOT do. Avast pay for the servers to receive all this, so I am questioning whyI'm not saying Windows does that but i'm just proving the point to you
Which part of your comment proves anything? This is the website of a security software and I am trying to ensure I am secure. The blatantly sarcastic, insulting and uninformative way you are trying to prevent me from doing so adds to my concerns.
-
I can't speak for Avast!, but I see privacy and security as 2 separate issues. Maybe not quite an apples/oranges comparison, maybe more like limes/lemons? Yes, they often share many things in common, but still the two issues still should not be confused.
Anyway, a quick scan of this topic leaves me thinking no one has asked you if you have noticed the "community" options in the main settings yet.
-
MrSafe, if you know "so much" then how come you don't have a clue about what CommunityIQ is and what it does? Or WebRep? Or Behavior Shield? Oh noes, its sending data back to AVAST Software!!!!!
These days they are all sending data back. But its not like they are uploading your documents and pictures. They are uploading suspicious samples, statistical data, decisions made by user etc etc.
I think you know you need a two way communication for such things to work.
If you're looking for a prooduct that just downloads definitions and that's it, good luck. I don't think you'll find any these days. Maybe ClamWin but then again, would you rely on it? I know i wouldn't...
-
I see privacy and security as 2 separate issues
Whether there is any difference or not I expect both and most people will put them together under general safety
In previous comments here: I didn't install WebRep, so that's not creating any connections
CommunityIQ feature
and don't have the features you mentioned
As I have already stated I do not have the WebRep or CommunityIQ features. I disabled the Behavior Shield and Avast continues to try to connect to the internet, just less persistently. That is the first real piece of help I received here. I looked up the Behavior Shield in the help file, but there is no description so I Googled it.
its sending data back to AVAST Software!!!!!
Finally, that is correct.uploading suspicious samples, statistical data, decisions made by user etc
It started before Avast had detected anything suspicious and before I had many any decision with it. It does not check with me that I want to upload this information, what if these samples contained something I did not want anyone else to see? My source code, for example. And what statistical data? If you knew these things previously why have you not mentioned them until now? Instead of trying to shut me up with your insulting comments.
-
You do have CommunityIQ as its an inegral part of avast!. Can be turned of but i see little point in doing that. Same for disabling or removing Behavior Shield or disabling updating.
Its like having a car with ABS, EBD, ASR, ESP and then turning everything off because of god knows what reason. Everything here connects for a reason.
In all the years that i "work" here as freelance support don't recall anyone ever be so persistent on anything in avast!. It seems like you have this fixed idea of not liking avast! and no argument will ever change your mind. This is how it works, few hundred million users don't mind how avast! works, just you. I really can't say anything else.
If you feel like you don't trust avast! product or AVAST Software as a company then i suggest you simply uninstall it and use something else. Or nothing at all since i don't think you'll find anything that works like you want it.
-
I think that there is a middle ground here.
For MrSafe, I would like to say that in the Avast forum is very rare to find some censorship or alike. I don't think that users here are denying you an answer or telling you that your questions are not welcome. You need to consider that the average forum user here is not part of Avast Team. The "exact" technical answer may need some specific Avast developer to invest some time to explain "every" module that tries to send some kind of data. As you can read in this topic from several answers from several different users, there are several modules trying to do their best which may include sending information.
I am not so sure that any developer would like to invest such time to explain in such a detail every module that sends some kind of data (or request it).
I am also not sure that there are many reasons to request such a detail explanation. The "necessary" explanations are out there, whether it is the help file, or some knowledgebase article, or in this forum.
I indeed can understand the concerns. And I think the question is still valid. But just as you won't ask Google for an answer about how they choose their ads to be displayed to you in particular, it is somehow unrealistic to ask the same from Avast Team.
An Avast developer also "chipped in" in this topic. That is not rare, but it is not happening in every topic.
So a more general answer has been provided. Several examples of the goals to those connections have been mentioned.
You may trust Avast Software, or you may decide not to. If you (or anyone else) finds something "strange", they are always welcome to ask a "specific" question about a "specific" situation. A real "trojan" won't give you such an opportunity.
You are free to block anything you like, as with anything in your computer. You received some answers or tips about that strategy. If you still think you are safer closing some shield, or blocking some connection, that's still your choice.
I don't think any "common" user of this forum is able or knows enough technical details so to answer your question more specifically. If a developer wont answer it, then as with other things is still your choice what to do in your system.
You are still welcome to ask about doubts. If you can provide specific behaviours or situations with specific details, then maybe someone can answer (but the possibility that your question would not get a satisfying answer is also opened).
-
Yeah, normally I hesitate to say "move away from Avast!" on their forums, I try not to crap on others doorstep, so to speak. But this is simply the way it works, and if you really need total transparency, another product might be better for you. I would say "trust Avast!", but you appear to live by Sandboxie's motto of "trust no software". ;)
I'm betting there is a reason Avast!'s connections are not all totally transparent, as you apparently want them to be, and it isn't that they are trying to be sneaky and run off with your source code. Most users would be driven nuts by all the connection requests.
Really, the managing of data coming and going is between you and your firewall, as it should be. And Avast! is still blockable via your firewall, is it not? So, block Avast!. Easy peasy, as the Brits would say. Although thats not very nice of you, making using Avast! a near total one-way street. What it sounds like you desire is a near-corporate/business style of security program. Anyway, you always have the option of blocking, but I don't think you will see an option for "display request for all attempted connections" in the near future, if ever.
-
RejZoR:
OH MY GOD! YOU WORK FOR AVAST?
I have switched off CommunityIQ, whether I 'have' it or not is mere wordplay. I would not disable those features on a car unless they were a potential safety threat, or somehow sending out information to the manufacturer. Everything connects for a reason and I am questioning that reason. I have not expressed any dislike of Avast and am still keeping an open mind.they all bash at avast! because it transfers few unimportant bytes over the net
This is how it works, few hundred million users don't mind how avast! works, just you
Once again you are contradicting yourself on this point in an attempt to add weight to your sarcasm. I will probably uninstall Avast when I have finished reviewing it UNLESS I CAN FIND OUT WHAT INFORMATION IT IS SENDING AND AM TOTALLY SATISFIED THAT MY SECURITY AND PRIVACY ARE TOTALLY UNAFFECTED. In future can you please not keep repeating the same points without addressing the issue. Do you really think that is professional or helpful to Avast Software?
ady4um:
Thanks again for another relevant and competent post. You posted while I was writing this, but I will leave the above paragraph unedited. I have, of course, already noticed that my freedom of speech is being respected by the avast! forum itself and I fully understand what you mean about the seperate modules (I sometime even sympathise with Microsoft because of the size of Windows & the number of features that can cause problems!). I believe that certain 'irritants' here are not closely related to the development of avast!, although they are possibly in some way relative to the broader team. In a previous comment on this thread RejZoR mentioned the Behavior Shield and after trying Avast without that the connections it makes are very few. I had assumed from the name Behavior Shield that this was a Comodo Defense+ type strategy that stops applications accessing other applications. Saying that, my firewall just popped up again for AvastSvc! I am mostly happy with avast!, but consider this to be a VERY important point. I believe you do, too. I hope that avast! will make the changes you mentioned in your previous post to prevent this causing issues to others. Then I would say that that avast! has very little competition, if any.
Gargamel360:
You also posted while I was writing this, but I believe that the previous paragraph to ady4um is relevant to you, too. I would not have it as a one-way street and would contribute, but would rather have more transparency and know EXACTLY what I am contributing. On reflection I see that I could add any sensitive data to the exceptions in avast!'s settings and trust that this would be respected, but think that many users would not know about this option.
-
1. RejZoR: OH MY GOD! YOU WORK FOR AVAST?
2. I will probably uninstall Avast when I have finished reviewing it UNLESS I CAN FIND OUT WHAT INFORMATION IT IS SENDING AND AM TOTALLY SATISFIED THAT MY SECURITY AND PRIVACY ARE TOTALLY UNAFFECTED.
3. I had assumed from the name Behavior Shield that this was a Comodo Defense+ type strategy that stops applications accessing other applications.
4. ...but would rather have more transparency and know EXACTLY what I am contributing.
1. No, he doesn't and he never said so, btw.
2. Feel free to uninstall avast! at any point. It's your system anyway.
3. Well, it's no HIPS.
4. How should this work..?? While you would prefer a more verbose transfer, most users would just hate this. Think about it.
-
When u open avast user interface in the section current status= safe it has an advertisement in the bottom,maybe that why it conects to the internet everytime u open that gui.
-
I really don't know why the hell you're complicating so much. I already told you like 3 times what kind of things are using internet connection. I don't know why you even bother with it if you clearly don't like it from first minute...
-
Asyn:
1.He said:In all the years that i "work" here as freelance support
2. I am less likely to uninstall it now I know that RejZoR's attitude is not representative of avast!
3. I looked up the Behavior Shield in the help file, but there is no description so I Googled it
4. I know most users would hate that, but think it should be either in the settings for those who need it or an option for it to be logged
boombastik:
I noticed that the GUI makes one connection when you open it. It is a lot more than that, but thanks for pointing it out
RejZoR:
I have already addressed the issue of you repeating yourself, but failing to get the point. I have already pointed out to you that I have disabled/uninstalled the 3 features you mentioned. I will repeat myself again for your benefit:In future can you please not keep repeating the same points without addressing the issue
I have not expressed any dislike of Avast
I sympathise with your obvious problem, but if you really want to help avast! I suggest you go and "work" for one of its competitors.
-
I know most users would hate that, but think it should be either in the settings for those who need it or an option for it to be logged
It seems, you suggest to program a version for everyone. (Or in this case, one for you.)
But that's just impossible, imo. Sorry.
-
I do not require this only for myself, but for everyone who uses it. avast! blocks other software from sending information, does it not? Do you see why that is important?
-
avast! blocks other software from sending information, does it not?
Huh..?? What do you mean...???
-
avast! blocks malicious software from connecting to the internet, ie, trojans, as any antivirus should, but then sends information itself. Did I really have to explain that?
-
Do you think the sending of any data is in and of itself malicious?
-
Since I have been posting on this forum for about one year Mr.Safe is the second poster that I have seen who is complaining about avast! connecting to the internet.
I would think that if this were a real problem then
1. You would read about it in product reviews of avast!
2. Avast wouldn't have
As of early 2011, avast! antivirus has more than 140 million registered users and 120 million active users.
https://blog.avast.com/about/ (https://blog.avast.com/about/)
Not very likely that this is a problem.
Just saying.
-
Gargamel360:
To be honest, I very much doubt that is is malicious. However, I am not certain of this and would very much like some transparency on the matter. I recommended my previous antivirus (AntiVir) to many people and, although I personally had no problems with it, found I could no longer do this because of the number of people who were becoming unhappy with it. Really, I would like to be able to recommend Avast because of its impressive features, but think this one single issue too important to ignore. The trust we give to our AVs is possibly higher than any other software, except probably our operating systems and firewalls.
Nesivos:
You are probably right (I certainly hope so!), but I feel I have to be sure. I have never seen this mentioned anywhere either, so I partly feel I have no reassurances about it and wonder why nobody ever mentions it or seems to be aware of it. It's a sad fact that as companies grow they get more hungry for people's information, so I think it is a valid question. Looking at it this way, the vast number of users adds to my concerns and my persistence!
-
Gargamel360:
To be honest, I very much doubt that is is malicious. However, I am not certain of this and would very much like some transparency on the matter. I recommended my previous antivirus (AntiVir) to many people and, although I personally had no problems with it, found I could no longer do this because of the number of people who were becoming unhappy with it. Really, I would like to be able to recommend Avast because of its impressive features, but think this one single issue too important to ignore. The trust we give to our AVs is possibly higher than any other software, except probably our operating systems and firewalls.
Nesivos:
You are probably right (I certainly hope so!), but I feel I have to be sure. I have never seen this mentioned anywhere either, so I partly feel I have no reassurances about it and wonder why nobody ever mentions it or seems to be aware of it. It's a sad fact that as companies grow they get more hungry for people's information, so I think it is a valid question. Looking at it this way, the vast number of users adds to my concerns and my persistence!
The reason that no one says anything about it is because it is not an issue.
There comes a time in life that we have to trust those who know and this is one of those times that you just have to trust 140 million avast! users. If you can't do that then no matter what anyone says will never convince you that this is not an issue and IMO you should just move on with your life.
Good luck I hope you work it out.
-
Well, one thing to consider is Avast! is not an open-source program. They have a vested interest in keeping parts of how their program work as close to the vest as possible. So they will be transparent up to a point....stopping short of divulging certain things. Included in what they are trying to protect might be some of its calls out, what they do, and what purpose they serve.
-
I really don't know what's MrSafe trying to achieve here. Either he's totally paranoid (beyond any healthy levels) or he's just plain trolling. Over the years i've tested pretty much all security programs and they all behave like avast! does, so why the hell he's hanging on to avast! and complaining over how it works, over and over and over again? This is avast! and that's how it's working. Accept it or don't use it. It can't get any simplier than this. I mean why don't you install Norton and go bother their tech support why it sending data somewhere. Or other 50+ security programs that also do this... It's how they work. Just accept it already geez.
-
Dunno, he wants more than he will likely get, but I don't see the harm in him asking or wanting to know.
Why does it bother you so much, Rejzor?
The moon is not yet full, but you are getting angry like your weresheep form is coming out. ;D
-
trust those who know and this is one of those times that you just have to trust 140 million avast! users
If they know what it is sending then I wish they would tell me.
I appreciate that Avast have to protect their information, but don't we all?
Thanks Gargamel, but you probably don't want that pesky sheep to come and irritate you!
Anyway, in an attempt to reassure myself I switched off all avast! features, added all my hard drives to the exceptions and AvastSvc tried to connect. I thought it might be trying to report something it had previously detected so I uninstalled and reinstalled it with everything deselected so that it only installed one language pack, the core files and no shields. Even though it had absolutely no information about anything suspicious to report AvastSvc tried to connect. This proves that it is not only sending information regarding suspicious things it has detected. Sounds like an effort, but it only took a few minutes.
-
I forgot to mention that while I was doing this my system tried to connect to Avast's servers via NetBIOS and Windows Explorer also tried to connect to them.
-
MrSafe, are you saying that you have set both VPS and Program updates to "Manual" (Avast -> Settings -> Updates) and disabled the Web Shield, and you're still seeing some connections originating from AvastSvc.exe?
-
Hi Vlk,
I am not sure how VPS is implemented or configured in avast!, but automatic updates were definitely disabled and when I reinstalled it I did not install any of the shields or other features, but you have to install a language pack so that is the only thing that was selected. Immediately after reinstalling avast! it automatically tried to scan, but I cancelled that immediately so that it would have no detections to report. Then I went into to the settings and disabled everything I could. At first AvastSvc.exe only triggered 1 firewall alert, but later it made several more attempts.
I have put a lot of effort into my posts on this thread to ensure their accuracy and clarity, but for now I have other things I must do and may not be able to post (I will if possible) so if anyone is concerned about this then please conduct your own 'experiments/analysis'.
In the meantime, I hope you will appreciate my post on this page:
http://forum.avast.com/index.php?topic=82531.15 (http://forum.avast.com/index.php?topic=82531.15)
-
MrSafe, are you saying that you have set both VPS and Program updates to "Manual" (Avast -> Settings -> Updates) and disabled the Web Shield, and you're still seeing some connections originating from AvastSvc.exe?
I'm guessing news snippet inside interface is also creating connections, in free versions there are also ads that use net connection. And you also have those community features for FB and Twitter which i assume also use something. Plus i've heard before that avast! was still checking connection even though users disabled updating entirely.
-
Not from AvastSvc.exe (at the moment at least).
-
I'm guessing news snippet inside interface is also creating connections, in free versions there are also ads that use net connection.
Both, tray ads and the ads / offers displayed inside the main GUI of Avast, have no (simple and known) way to be avoided (in the Free Edition). So any of those might trigger connections (but I don't know which specific program / process / service will show up in the firewall log).
And you also have those community features for FB and Twitter which i assume also use something.
If that is indeed the case, then that's a problem. The posts / reports of the OP clearly said he DISabled "everything" he could, and in the last installation of Avast he avoided any "optional" the Avast setup program was allowing to be "non installed".
So those features (and alike) should be either
A_ not even installed, hence not connecting; or,
B_ installed but DISabled, hence not connecting.
So, no "community", no "social", no "credit something", no "shield", no "web something", no "protecting web something sandbox / safe...", not "network something"...
So, either the user hasn't really opted out "everything" (?), or "something" is still connecting to some place. I'm not saying this is completely and absolutely 100% wrong, and I'm not imposing on Avast Software to publish any specific information. Hey, there might be also a possible bug, who knows.
Of course these are not common and usable settings / situations / conditions. The OP is just testing the connections and wants to find out what are they doing (their goal), and if those connections are avoidable. Again, whether Avast Software is able and willing to provide a satisfying answer (that won't make the software "unsafe"), is another issue.
Plus i've heard before that avast! was still checking connection even though users disabled updating entirely.
As mentioned before in this same topic (and in others too), the "manual" update is only avoiding the "downloading and applying updates" parts of the update process. The "checking for available updates" part is performed in any case (but in "manual update" mode/setting, it shouldn't IMHO and I hope they change this in the near future).
Either way, the OP posted that he deliberately allowed for database updates (and ONLY for them), so "checking for available updates" (whether Avast actually finds an available update or not) *is* indeed allowed and NOT part of MrSafe's questions.
At least, that's how I understood it.
-
Mr.Safe, I actually registered just for you.
I happened on this page because I too was looking why this process was throwing out so many network requests. It is alarming how quickly and suddenly you were attacked. I am in awe how you maintained your composure in the realm of users like Nesivos and RejZoR
Nesivos:
"Since I have been posting on this forum for about one year Mr.Safe is the second poster that I have seen who is complaining about avast! connecting to the internet."
Gopher John:
RejZoR, I agree. If one doesn't trust their security program, then why are they running it at all?
RejZoR:
Too many to list... but his logo next to his name, "We are supersheep, resistance is futile!" ... really didn't realize he took that to heart...sheesh.
I'm pretty sure this thread will be deleted because we are making this up... afterall, how can you and me SUDDENLY be having this problem given the MILLIONS out there who aren't!
So not to threadcap with my dire predictions on the fate of this thread, let me divulge a few thoughts of my own.
1. The files sending data back to Avast.
Avastsvc.exe
avast.setup
AvastUI.exe
2. Common sense tells us that the programs will send data back and forth for the following
a) Program updates (checked every 240 minutes (4 hours))
b) Virus definition updates (checked every 240 minutes (4 hours))
c) Renewing free registrations (1 time a year)
d) Credit Alerts (costs $10/month)
e) Avast Community
f) Avast Community recommended features
g) Avast Community social networking features
h) Webrep
The sheep want you to believe everything Avast is is righteous. I'm not so sure given how much effort was diverted into trying to pull the wool over your eyes Mr. Safe ;)
I mean technically, in order for the "Avast Community" to work, you would have to have a list of every file on your computer, or submit every file to a list (upload the file to Avast's servers). Since this isn't feasible, the next best option is to create a checksum that would represent that file. So more than likely, Avast is sending a "secret code" back to homebase alerting them of every file you open and how often you access that file. It is basically the ultimate of ultimate spyware. You would then have to trust Avast to immediately delete the file and lookup history for your IP. If not, they know more than your government.
Also running an antivirus requires read privileges for your ENTIRE hard drive, password files and all. If you want to trust it to remove "virii" you also have to enable WRITE access.
The fact that people are saying you shouldn't question your antivirus software is *ridiculous*! And if the response is "you're free to uninstall it" then you should consider not walking away from avast, but RUNNING!
Unless you like lambchops... mmmm.
P.S. IANAL, nor even a citizen of the Czech Republic so I have no idea the rules or government oversight (if any) they must submit to.
-
CommunityIQ doesn't index your files or list them all or upload them entirely or anything like that. It just logs the data what was the infection name of a very specific (detected) file, it's path, filetype and maybe basic structure which is analyzed by the engine itself, user decision when not in auto mode, user decision in Auto Sandbox mode etc. It logs this, packs it and sends to AVAST Software which can then based on this aggregate statistics and get more feedback from its userbase on what are the malware trends, how users behave when something gets detected etc. If you know all this you can provide better protection and make automatic modes better so users don't have to make decisions they don't understand. And that's the whole point of CommunityIQ.
Users giving automated feedback to the vendor so they can improve things.
-
I searched the knowledgebase and it is painful to find technical info for modern versions of avast. It seems there is a lot of glossing over things which is disappointing. For instance:
Q: What should I know about using avast! 4 together with a firewall?
A: Once you install avast! 4, you will be receiving warnings by your firewall, because avast! tries to connect to our servers - it looks for virus definition file updates and for program updates. You should allow avast! to connect, otherwise the update feature will not work. Here is some useful information:
1) Servers that avast! connects to:
URL: http://www.asw.cz/iavs4pro
IP: 195.70.130.34
URL: http://www.avast.com/iavs4pro
IP: 64.246.6.135
URL: http://www.iavs.net/iavs4pro
IP: 207.44.156.15
URL: http://www.iavs.cz/iavs4pro
IP: 62.168.45.69
Why a professional product can't tell me these things makes it so I cannot recommend to the boss (CEO) to switch Antivirus.
The problem MrSafe may have had was with Web Shield. As I thought it might work is it sets up a proxy on localhost and scans traffic web traffic over that, however on my machine all web requests were not going to 127.0.0.1, but back to avast's servers?
I tried getting information about web shield, but I have to go back to documentation for 4.8 to get something beginning to look helpful. http://www.avast.com/download-documentation#tab3 And it only states that Win98 used to do this and setting the network to route through a proxy is no longer needed on NT based OS'. I'm running Avast free 6.0.1203 and no other antivirus program.
Why should all my web traffic be diverted to Avast's servers?
-
1. The files sending data back to Avast.
Avastsvc.exe
avast.setup
AvastUI.exe
And how did you come to the conclusion that they are "sending data back" (which applies to the original post as well)? Except for avast.setup, which may submit some stuff - such as the false alarms you want to report, files you send from chest, suspicious files from the Community, the connections are there simply to download or look-up something.
I mean technically, in order for the "Avast Community" to work, you would have to have a list of every file on your computer, or submit every file to a list (upload the file to Avast's servers). Since this isn't feasible, the next best option is to create a checksum that would represent that file. So more than likely, Avast is sending a "secret code" back to homebase alerting them of every file you open and how often you access that file. It is basically the ultimate of ultimate spyware. You would then have to trust Avast to immediately delete the file and lookup history for your IP. If not, they know more than your government.
Again, no idea what might have given you the idea that the avast! community works that way - it certainly does not, there's no list of all existing files, nor the list of hashes of all existing files.
On the other hand, when the "file reputation" feature is introduced in the next version of avast!, it actually would be something similar. But we are talking about statistics here - matching a file signature to a particular IP address (i.e. storing thereof) is irrelevant - what matters is just the count, and possibly age, of that file.
I searched the knowledgebase and it is painful to find technical info for modern versions of avast. It seems there is a lot of glossing over things which is disappointing. For instance:
Q: What should I know about using avast! 4 together with a firewall?
A: Once you install avast! 4, you will be receiving warnings by your firewall, because avast! tries to connect to our servers - it looks for virus definition file updates and for program updates. You should allow avast! to connect, otherwise the update feature will not work. Here is some useful information:
1) Servers that avast! connects to:
URL: http://www.asw.cz/iavs4pro
IP: 195.70.130.34
URL: http://www.avast.com/iavs4pro
IP: 64.246.6.135
URL: http://www.iavs.net/iavs4pro
IP: 207.44.156.15
URL: http://www.iavs.cz/iavs4pro
IP: 62.168.45.69
Why a professional product can't tell me these things makes it so I cannot recommend to the boss (CEO) to switch Antivirus.
I'm afraid your quote is from quite a few years ago.
Such a list still exists, it's stored in <avast>\Setup\Servers.def of your avast! installation. The thing is that everything has grown a bit bigger in between - the list is currently a few hundreds of servers, and may actually change from day to day (to balance the loads on the servers, to allow server maintenance, to add new servers, ...). So I can't really imagine you'd enter these rules into your firewall, and verify the rules every day.
On the other hand, you can set up a mirror in your company (with the managed avast! clients) - so only one computer will access the internet, all your local workstations will update from that local mirror.
The problem MrSafe may have had was with Web Shield. As I thought it might work is it sets up a proxy on localhost and scans traffic web traffic over that, however on my machine all web requests were not going to 127.0.0.1, but back to avast's servers?
That doesn't make any sense - avast! is certainly not redirecting all your web request to avast! servers, that would DDoS the servers immediately :)
I'd say there's something wrong with how you track the connections or the tools you use for that, but I'm just guessing.
-
I am sorry I have even participated in this topic. This topic is already "trashed", in a practical sense.
The original questions were technical and specific (and valid), although maybe not specific enough to get a direct answer from people actually knowing those technical answers.
Most posts in this topic are useless, for anyone reading the topic. Almost no concrete information.
If someone from Avast Team wants to add something, great. If for any other user these questions are not "acceptable", then I would tend to think that by now there is no point in adding any new comment of such kind. If anyone else wants to say (rant) about how bad this forum works, or to quote some specific info that proves nothing at all (and shows the limited ability to search for the current real info), then please make all of us a favor...
Obviously anyone is free to keep posting whatever, if it is "inside the rules" of the forum (essentially be respectful, and try your best not to throw false information).
Some actual information was given, including from Avast Team members. The info may or may not answer some of the questions, but it was still useful (for someone).
Now we have people throwing out accusations, guesses, assumptions and what not, and making them appear as facts, without having any kind of real proof. I would even say that I, a simple common user, could easily demonstrate those phrases to be wrong. I won't bother.
MrSafe, I'm sorry your topic went this way. In an open forum, it certainly can happen some times. It has happened to me too. Please do NOT interpret this specific topic as a generalization of Avast's forum. I still have some hope that some more real answers or useful information can be posted.
-
Well, i never understood ppl who expect explanation of things they are not required to be explained. In fact no one explains them in detail. If you'll ask Symantec, Trend Micro, AVG or anyone else about some specific core logic, they won't give you a detailed answer. Why would they? It's a trade secret as such and it just cannot be disclosed.
I also don't quite understand MrSafe part where he's mentioning "sending data to avast!". Sending what data? Sending a ping request to avast! update server to check if its online will trigger an outbound alert in firewall, but it's just a ping packet. Or whatever they use to check, be it a handshake UDP packet or whatever. I mean it's a difference between a small packet and a large chunk of data being sent.
-
It appears MrSafe has motives other than simply acquiring information and understanding things: https://badwarebusters.org/main/itemview/25859
-
Don't feed the troll.
-
Well, reviewing the topic, there is a setting that was never mentioned.
Avast -> Settings -> Updates -> Updates Parameters -> "My computer is permanently connected to the internet".
With this setting UNchecked, Avast tries to connect to the servers to assure a connection is possible/available.
With this setting CHecked, Avast doesn't need to check the availability of a working connection.
This may reduce the number of connections seen in the firewall (or whichever tool is being used to test/check/log the connections).
This comment of course doesn't contradict any other post in this topic.