Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: bascheew on December 31, 2005, 10:31:42 PM

Title: Avast is slowing down my internet access.
Post by: bascheew on December 31, 2005, 10:31:42 PM
As of about 2-3 weeks ago I noticed my internet connection started to slow down dramatically.  Often IE will just hang on a URL (the status bar will slowly progress and the Windows logo will wave) until I kill Avast and then the page will come up immediately.   The internet runs fine when I stop On Access Protection and then slows down (and as I said sometimes hangs indefinitely on some pages) when I enable On Access Protection.  Any ideas?

I have Avast Home Edition version 4.6.744.
Windows Media Center 2005
Athlon 2400+, 1GB RAM.
Title: Re: Avast is slowing down my internet access.
Post by: galooma on December 31, 2005, 10:42:02 PM
Hi and welcome ,
There was an update a while back that may have inadvertently changed your standard sheild settings from normal to high . just check this by double clicking "A" ball and look at standard sheild setting. Beyond that i cold suggest a little utility called TCP optimiser that i tried out a while back . Made a significant difference to my pc performance http://www.infos-du-net.com/en/telecharger/SG-TCP-Optimizer.html
good luck  :)
Title: Re: Avast is slowing down my internet access.
Post by: bascheew on December 31, 2005, 11:11:35 PM
I checked and it was set at normal not high. 

TCP optimiser doesn't directly address my Avast On-Access Protection problem I'm having.  As I said as soon as I disable On Access Protection it fixes the slowdown.  Thanks for the suggestion though.
Title: Re: Avast is slowing down my internet access.
Post by: szc on January 01, 2006, 12:21:49 AM
Totally no need to "kill" whole resident protection as you mentioned... You just have to "kill" WebShield and it will give you the same effect. I am also experiencing the same for example when I want to take a look at some MSN messenger account profile. Can't see anything except dark blue background until I "kill" web shield for a moment, and then of course, I enable it again...

Also see what's your sensitivity in web shield... some tweakings may help. But for sure, you do not want to be without standard shield and some other providers. Standard shield is a standard part of On-Access Protection, so when you stop it, everything goes off. When you are having troubles with some web pages, but only if you are 110% sure that those pages doesn't contain malicious stuff (I mean, if you trust them 110%), then you should just terminate WebShield provider for a moment. As I said, only if you trust them !  ;)

Happy New Year !
Title: Re: Avast is slowing down my internet access.
Post by: bascheew on January 01, 2006, 01:26:45 AM
It's funny you mentioned MSN, because one of the pages that always hangs is when I log-in to Hotmail.  Maybe in this case it's related to Microsoft's Passport?

Also thanks for the tip.  It does un-hang once I stop the WebSheild service only.
Title: Re: Avast is slowing down my internet access.
Post by: DavidR on January 01, 2006, 04:51:34 PM
There used to be an issue with logging in to Hotmail (and similar pages), where you are redirected to an https page (which avast doesn't monitor) and then to another page. I can't recall what the resolution was (perhaps someone else can), I think it may have concerned a firewall/browser and web shield. The resolution may have been to manually setup the browser to use web shield's proxy.

So a forum search for can't log in to Hotmail might bring some info.

Do you use Zone Alarm?
http://www.avast.com/eng/webshield_issues.html#idt_6871
http://www.avast.com/eng/faq-home-webshield.html
Title: Re: Avast is slowing down my internet access.
Post by: szc on January 01, 2006, 05:07:09 PM
In my humble opinion sucha hassle for every single one of those new users, not familiar with tweakings of any program, especially not familiar with tweaking of antivirus providers. That should be simplified somehow... something like one-click-and-all-set option.
Title: Re: Avast is slowing down my internet access.
Post by: alanrf on January 02, 2006, 12:16:46 AM
I am not experiencing any problem logging into Hotmail (either with Firefox or with IE) and not seeing Web Shield causing interruption to any page delivery (I am also using ZoneAlarm) . 

While that is no comfort to those experiencing these difficulties it suggests that some other factor is involved.  Perhaps a member of the avast! team can offer some thoughts on how the affected users might isolate the problem.
Title: Re: Avast is slowing down my internet access.
Post by: szc on January 02, 2006, 12:31:41 AM
I have to say that I don't have problems signing into my hotmail account at all. However, problems starts to show up once you try to check on someone else's Hotmail profile... for example, from within MSN messenger, right click on some of your contact names, and chose VIEW PROFILE.

Logging into my Hotmail e-mail account is not a problem in my case... I can't say anything in bascheew's name, we should get some feedback from him as well.
Title: Re: Avast is slowing down my internet access.
Post by: alanrf on January 02, 2006, 01:31:59 AM
I do not use MSN Messenger, but, in the interests of research I just installed it.  I set up a couple of my Hotmail accounts with profiles and added them as contacts in MSN Messenger. 

The profiles I set up were very simple (without pictures and just basic information) but  when I selected "View Profile" for any of the contacts the profile display opens immediately in Firefox (my default browser) and shows the contact info.

It occirs to me that it may be possible that MSN (and Hotmail for that matter) may have a slightly different sequence of http interactions in different geographical installations so my experience in California may not be identical to yours in Canada or others in Europe or elsewhere. 
Title: Re: Avast is slowing down my internet access.
Post by: Atomic_Ed on January 02, 2006, 02:57:10 AM
I am running the latest version of Avast Pro and have this same problem, just after the past updates of the Avast program occured.

I have an Athlon64 3200+ with 1.25gb Ram running on XP Pro x64 and now my system is running like a 386! The whole system is down to a crawl compared to before the updates and my Internet access is hit or miss whether a page will even ever load.

I read this thread and checked my webshield settings and they were in fact on high but even on standard it makes no difference. What is causing this horrendous slowdown?

I hope someone has an answer soon or I will have no choice but to uninstall Avast from my system, which I really do not want to do.
Title: Re: Avast is slowing down my internet access.
Post by: alanrf on January 02, 2006, 05:20:43 AM
Atomic_Ed,

have you identied any tasks in the Windows Task Manager that seem to have very high CPU utilization?  Have you tried turning off the various avast! shields one by one to see if you can identify one that is causing your problem? 

Does turning off the Web Shield remove the problem with web page loading?
Title: Re: Avast is slowing down my internet access.
Post by: Atomic_Ed on January 02, 2006, 10:17:35 AM
Atomic_Ed,

have you identied any tasks in the Windows Task Manager that seem to have very high CPU utilization?  Have you tried turning off the various avast! shields one by one to see if you can identify one that is causing your problem? 

Does turning off the Web Shield remove the problem with web page loading?

Yes I have checked Task Manager and have the same number of processes running with nothing new showing up. I have disabled the webshield and it made a big difference in speed and when I disable on access scanners, well everything runs quick again and the slowdowns go away. Definately something to do with the Avast resident modules but it seems as if the webshield is only part of it.
Title: Re: Avast is slowing down my internet access.
Post by: Lisandro on January 02, 2006, 02:48:55 PM
Definately something to do with the Avast resident modules but it seems as if the webshield is only part of it.
Maybe a driver is 'conflicting' with WebShield...
Do you use any local proxy? Do you have any other residents running in background?
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 03:48:05 PM
I use WebWasher (to filter ads). It runs as a proxy. Could that be the problem. The internet access is not slow here, but I can't scroll a web page before all items are loaded when the WebShield is on. If I set WebShield to "Pause" then all is normal. Must be a WebShield thing.

BTW:  Is WebShield necessary?  Won't Standard Shield catch all?
Title: Re: Avast is slowing down my internet access.
Post by: DavidR on January 02, 2006, 04:12:22 PM
WebWasher may have an effect if web shield is monitoring content and then WebWasher is filtering ads. You would need to ensure that the two proxies are working together and it would be better if ad content was removed before web shield monitors. That may well not be possible.

My Firewall can filter ad content, as can my browser firefox, all without having to use a proxy, so I don't need another ad blocker or the extra complexability.

Web Shield in my opinion is absolutly essential, Standard Shield is trying to catch something that is already on your HDD (which may be more difficult to remove), Web Shield can block before it gets on your HDD. No contest, protection in depth.
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 04:16:14 PM
I don't really know how to control this as avast! now uses the transparent "hook on" to the port 80. If I could use the old way (avast! beeing a proxy) I could choose who connected to the Internet. Then WebWasher could connect to the net and filter the ads, THEN avast! could scan the rest of the page, THEN IE6 could get the content :-)

The page is much smaller after WebWasher has scanned it (all commercial itemt are removed from the HTML code, not just hidden) so commercial images and scripts won't even reach IE (love WebWasher)
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 02, 2006, 04:22:41 PM
?  Where is igor?

Although I don't know how it works but how about unchecking "Use intelligent stream scanning"?

Also, if you'd like to "chain" the proxies in the way you like, you can go for the good old ways.  Please use the links below.

http://www.avast.com/eng/my_isp_wants_me_to_u.html

http://www.avast.com/eng/on_my_pc_i_am_runnin.html
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 04:30:02 PM
But if I add WebWashers proxy port here (8080) and uncheck the "Ignore local communication". Won't avast! check twice (first on port 80 before WebWasher and then again later after WebWasher on port 8080) and slow down things even more that now?

I see that with the standard settings avast! will monitor port 80, and hook on before WebWasher (scanning things WebWasher later removes), and that's a waste (it removes HUGE items :-)

I can't remove port 80 from the list either can I, or is that safe (all traffic on port 80 from IE is routed trough WebWasher on port 8080).

Or will other programs (not routing through WebWasher as a proxy) then be unprotected (if they use port 80 directly that is).

Help.  Technical avast! person needed :-)
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 04:47:44 PM
Just to clearify what I'm looking for :-)

I want it to work like this:

  Internet -> WebWasher -> WebShield -> Internet browsers

I do NOT want it to work like this:

  Internet -> WebShield -> WebWasher -> Internet browsers

nor like this (if I just add WebWashers proxy I suspect this is what I get):

  Internet -> WebShield -> WebWasher -> WebShield -> Internet browser
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 02, 2006, 04:56:29 PM
Non-transparent proxy.

1.Open the file avast4.ini located in C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA in Notepad.
Find the section [WebScanner]
2.In this section add the following two lines:
UpstreamProxyHost=localhost
UpstreamProxyPort=8080

3.Restart the Web Shield provider – terminate and then start again
4.Configure your browser to use Web Shield as its proxy (server: localhost, port: 12080).

Transparent proxy.

1.Open the file avast4.ini located in C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA in Notepad.
Find the section [WebScanner] in this section add the following line:
OptinProcess=my_proxy.exe
(Replace the my_proxy.exe value with the real process name of your proxy app.) If the OptinProcess line is already present in the avast4.ini file, you can add another process name to the list by separating them by commas. E.g.:
OptinProcess=my_proxy.exe, my_browser.exe

2.Restart the Web Shield provider - terminate and then start again

Sorry, but I don't know what is the process name of Web Washer...
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 05:01:29 PM
I saw that article. But won't that do the exact opposite of what I want?
(i.e. scan the web-data BEFORE WebWasher has filtered it at all).

Which one of these are true with the standard configuration
(monitor port 80, ignore local comm, IE set to proxy on WebWasher):

1) Internet -> WebWasher -> WebShield -> Browser
2) Internet -> WebShield -> WebWasher -> Browser
3) Internet -> WebShield -> WebWasher -> WebShield -> Browser

The trick is to get it to scan ONLY data between WebWasher and browser...   Or is that what happends with the standard settings.
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 02, 2006, 05:08:05 PM
Did you try the way for non-transparent proxy?

For transparent proxy, I am not sure but setting "redirected HTTP port(s)" in Web Shield configuration only as 8080 may do the trick.
Title: Re: Avast is slowing down my internet access.
Post by: Lisandro on January 02, 2006, 05:11:32 PM
Is WebShield necessary?  Won't Standard Shield catch all?

But if I add WebWashers proxy port here (8080) and uncheck the "Ignore local communication". Won't avast! check twice (first on port 80 before WebWasher and then again later after WebWasher on port 8080) and slow down things even more that now?

If you use Standard Shield at HIGH sensitivity, you can disable WebShield.
But, WebShield + Standard Shield at NORMAL sensitivity, at least for me, uses less resources.

All traffic on port 80 from IE is routed trough WebWasher on port 8080).
So, why don't you uncheck 'Ignore local communication' and set WebShield to 8080 port?

Or will other programs (not routing through WebWasher as a proxy) then be unprotected (if they use port 80 directly that is).
If any other HTTP traffic passes through the port 80 and WebShield is not configurated to scan it... it won't scan.
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 05:17:57 PM
All traffic on port 80 from IE is routed trough WebWasher on port 8080).
So, why don't you uncheck 'Ignore local communication' and set WebShield to 8080 port?

You mean remove 80 and just have 8080 there?  Yep, that would check only the traffic between the browser and WebWasher, BUT if one program or browser accesses Internet using 80 (and not through WebWasher on 8080) that program can download web content that is not scannet at all :-(

If I keep BOTH 80 and 8080, won't Web Shield then can TWICE (before WebWasher AND after WebWasher).....   Hmmmm....  Tricky...

If the broswer uses proxy on 8080 I want that traffic to be scanned, else I want 80 to be scanned. AND traffic between WebWasher and Internet should never be scanned (that will be scanned on 8080 later instead, right :-)

:-/
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 05:22:59 PM
If you use Standard Shield at HIGH sensitivity, you can disable WebShield.

I use Custom setting for the Standard Shield. What need to be ON to make it safe. I have selected to scan some files types only (but added more than the standard). DLLs, OCXs and all program-file type are scanned. Also CLASS, scripts, web-pages extensions, JS, SWF and other binary types...
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 02, 2006, 05:24:39 PM
Lars-Erik, how about using Web Shield as non-transparent proxy only for the browser, then?  As I showed, there are two ways of setting Web Shield.
Title: Re: Avast is slowing down my internet access.
Post by: Lisandro on January 02, 2006, 05:29:01 PM
AND traffic between WebWasher and Internet should never be scanned
If you set port 80 and check 'Ignore local communication', I think you will have what you want: avoid scanning between WebWasher and browser:
Internet > WebShield acting as a proxy at port 8080 for IE > at local communication you will pass the traffic from 8080 to 80 and WebShield will take it.
Maybe I'm wrong  ::)
Title: Re: Avast is slowing down my internet access.
Post by: Lisandro on January 02, 2006, 05:32:01 PM
But added more than the standard: DLLs, OCXs.
They're scanned as text (binary files) and I don't think this will help that much.

Also CLASS, scripts, web-pages extensions, JS, SWF and other binary types...
If this is a part of WebShield scanning, why do you do that? Let them to WebShield...
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 07:39:13 PM
AND traffic between WebWasher and Internet should never be scanned
If you set port 80 and check 'Ignore local communication', I think you will have what you want: avoid scanning between WebWasher and browser:
Internet > WebShield acting as a proxy at port 8080 for IE > at local communication you will pass the traffic from 8080 to 80 and WebShield will take it.
Maybe I'm wrong  ::)

No I want the opposite: Avoid scanning between WebWasher and the net, and ONLY scanning between WebWaser (after its filter) and the browser.
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 02, 2006, 07:42:14 PM
But added more than the standard: DLLs, OCXs.
They're scanned as text (binary files) and I don't think this will help that much.

Also CLASS, scripts, web-pages extensions, JS, SWF and other binary types...
If this is a part of WebShield scanning, why do you do that? Let them to WebShield...

1) Are you saying all extra extensions addad to the standard shield is scanned as TXT files only?  Why is the default list full of binary files then?  I have only added some types to the allreday existing list...

2) Probably becuase webshield is quite new. I have used avast! longer.
    AND:  What if a JS, SWF or similar file is copy from somwere else (a CD)
    WebShield only scan port 80 traffic. I can get a SWF or JS file on CD too.
    If you don't have that in the list then, it won't be scanned, right... ?

Do you have a setup for Standard Shield that scans all binary files and possible script files (very tight) but no unneeded files as an example?

BTW:   I'll add my settings (from the Avast4.xml file (or Avast4.mdb)).
           Then you might comment on what is redundat (not necessary):

<STANDARD--ScanFlags>367</STANDARD--ScanFlags>
  <STANDARD--ExecScanFlags>7</STANDARD--ExecScanFlags>
  <STANDARD--BlockFlags>4096</STANDARD--BlockFlags>
  <STANDARD--Flags>4</STANDARD--Flags>
  <STANDARD--Exceptions>*\PAGEFILE.SYS,*\WIN386.SWP,*\SYSTEM.DA?,*\USER.DA?,C:\WINDOWS\TEMP\*.TMP,C:\MSDOS.SYS,C:\WINDOWS\TEMP\_AVAST4_\UNP*</STANDARD--Exceptions>
  <WS--Flags>25</WS--Flags>
  <WS--ExcTypes>APPLICATION/X-RTSP-TUNNELLED;AUDIO/*;IMAGE/GIF;IMAGE/JPEG;IMAGE/PNG;TEXT/CSS;VIDEO/*</WS--ExcTypes>
  <WS--HttpScanParamFlag>1</WS--HttpScanParamFlag>
  <WS--BlockEnable>0</WS--BlockEnable>
  <WS--AutoRedirect>1</WS--AutoRedirect>
  <WS--IgnoreLocalhost>1</WS--IgnoreLocalhost>
  <WS--HttpRedirectPort>80</WS--HttpRedirectPort>
  <STANDARD--ScanExtensions>?,ACE,ARC,ARJ,ASP*,CAB,ECE*,GZ*,LHA,LZH,RAR,TAR,ZIP,ZOO</STANDARD--ScanExtensions>
  <STANDARD--OpenExtensions>?,{*},386,AD?,ASP*,ASX,BAS,BAT,BIN,CH?,CLA*,CMD,COM,CPL,CRT,CSS,DLL,DO?,EML,ECE*,EXE,HLP,HT*,INF,INS,ISP,JS*,MDB,MDE,MHT,MS?,NWS,OCX,OV?,PCD,PDF,PIF,PO?,PP?,PRC,PRF,REG,RTF,SCF,SCR,SCT,SHB,SHS,SWF,SYS,VB?,VSD,VXD,WS?,XL?</STANDARD--OpenExtensions>
  <STANDARD--BlockExtensions>CLA*</STANDARD--BlockExtensions>

Also the packers are set to this streng (all of them, not just WS--):

<WS--ScanPackers>EXE;ZIP;MIME;RAR;ARJ;TAR;GZ;CAB;ARC;ACE;ZOO;BZIP2;WinExec;LHARC;CPIO;RPM;7ZIP;CHM;ISO;TNEF</WS--ScanPackers>


Title: Re: Avast is slowing down my internet access.
Post by: Atomic_Ed on January 02, 2006, 10:09:26 PM
Definately something to do with the Avast resident modules but it seems as if the webshield is only part of it.
Maybe a driver is 'conflicting' with WebShield...
Do you use any local proxy? Do you have any other residents running in background?

I was also thinking it might be a driver as well but ai run Avast Pro on my XP x64 system which is a laptop and as such I only have the core hardware drivers needed to run the system. Most of which there are not many options yet. One exception is my ATI Radeon 9600 Mobility graphics chip where ATI offers x64 driver updates frequently. So after all the slowdowns I went ahead and downloaded and installed a newer radeon driver just to see if that would help but it didn't help. I always have 35 processes running after a clean boot and still showing the same 35 processes even now after the slowdowns.

I also thought possibly a spyware or malware issue, but ruled that out by scanning with various anti spyware apps and also the system returns to normal speeds once Avast is disabled.

Not sure what happened with the recent program changes to Avast but apparently my system does not like them at all.
Title: Re: Avast is slowing down my internet access.
Post by: Lisandro on January 03, 2006, 02:50:01 AM
1) Are you saying all extra extensions addad to the standard shield is scanned as TXT files only?
 Why is the default list full of binary files then?  I have only added some types to the allreday existing list...
I'm not expert on this... but as further I could read in forums, yes, just scan as binaries (not unpack for instance).

Do you have a setup for Standard Shield that scans all binary files and possible script files (very tight) but no unneeded files as an example?
I never succeed to find a good group of settings for that... I've tried but some time after I've got avast! Pro and (un)fortunatelly I didn't need to dig more here.
Maybe Igor could give us a help...
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 03, 2006, 05:14:11 AM
AND traffic between WebWasher and Internet should never be scanned
If you set port 80 and check 'Ignore local communication', I think you will have what you want: avoid scanning between WebWasher and browser:
Internet > WebShield acting as a proxy at port 8080 for IE > at local communication you will pass the traffic from 8080 to 80 and WebShield will take it.
Maybe I'm wrong  ::)

No I want the opposite: Avoid scanning between WebWasher and the net, and ONLY scanning between WebWaser (after its filter) and the browser.

I had been aware of your intension and the answer has already been in front of you.  I didn't simply cut and paste.

1.Open the file avast4.ini located in C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\DATA in Notepad.

2. Find the section [WebScanner] in this section add the following two lines:
UpstreamProxyHost=localhost
UpstreamProxyPort=8080

3.Restart the Web Shield provider – terminate and then start again

4.Configure your browser to use Web Shield as its proxy (server: localhost, port: 12080).

In this way, you can chain the proxy communications as you wanted.

Browser/Web Shield(12080)/Web Washer(8080)/Internet(80)

However, if you already put Web Washer's process name in [Web Scanner] section, you have to delete it.

Gotta go.
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 03, 2006, 05:34:30 AM
Do I have to change anything in the WebShild setup dialog as well?
Or should I just leave the "Transparent WebScanning" setting at "80"?

Just worried that it would make it go through WebShield one more like;

  Browser -> WebShield(12080) -> WebWasher(8080) -> "Transparent WebShield"(80) -> Intenet (80)

instead of

  Browser -> WebShield(12080) -> WebWasher(8080) -> Intenet (80)

BTW:  Is there a way to test what programs/proxies Internet access goes through?
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 03, 2006, 05:42:05 AM
Just noticed something else that is weird (and not good I think) :-(

With my old setting ("Transparent scanning" at "80", IE6 proxy set to WebWasher at 8080),
the WebShield of avast! isn't scanning anything (if I turn on the "Show details" it just show the
start URL, none of the elements on the page are scanned by WebShield at all).

In the setup dialog the number of scanned files is always "1" for each page loaded and the "last
file scanned" is always the main web-page adress (web-page files are scanned anyway when
stored in the cache because I have the ".htm" in the "Standard scanner" file extension list though).

Isn't this a security hole?  If a program acting as a proxy can access the Internet w/o WebShield
hooking on to that request and scanning the traffic?  Why isn't the traffic at port 80 scanned?

If I enter the "UpstreamProxyHost=localhost" and "UpstreamProxyPort=8080" then the web-page
files are scanned (after WebWasher has done the filtering, the ads removed are not scanned, and
that was the point too :-)  But again - scary that WebShield hasn't scanned anything before :-/
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 03, 2006, 07:47:55 AM
Lars-Erik, If you don't have any communication monitoring app e.g. with a personal firewall, for example, it is bit difficult to confirm how the communications are working but I think you were almost there.

As a transparent proxy, Avast! Web Shield scans only HTTP communications of applications in its list by default.  So, you don't need to put Internet Explorer, Firefox or Opera in "OptinProcess=" line in the ini file since they are already in the (hidden) list out of box.  In other words, Web Shield does not scan the communication of Proxomitron or Web Washer, which explains why you found that Web Shield is not scanning any communication through Web Washer.  Furthermore, this assures that you don't need to worry that Web Shield may scan communications between Internet and Web Washer at port 80.  Means, if you set Web Shield as a non-transparent proxy, it should not scan HTTP communications twice but once.

So, just follow the instruction I wrote in my previous post.  As for testing, try to download eicar anti-virus test files in "Download area using the standard protocol http" section at this page (http://eicar.com/anti_virus_test_file.htm).  Forget about "Download area using the secure, SSL enabled protocol https" since WS doesn't provide HTTPS protection.
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 03, 2006, 07:56:19 AM
Yep. Turned on the "Show detailed info" and testet with some webpages.
And now it only scan the files that are not filtered out by WebWasher!

But what happends to other application trying to access web-pages now?
Will they still be scanned transparent, or will they not be scanned at all?
(in other words, must I add the 12080 proxy to all web-browsers now?)

That would be another security hole (then maybe its better to add WebWasher
to the "application-list" and use the normal transparent WebShield anyway?)

BTW:  The "Standard" scanner is also scanning all the web-pages (the html, js
and other files) as they are read from or written to the cache. Actually they are
scanned here BEFORE they are scanned by WebShield (checked by having the
"Show detailed info" on for both. Seems a bit like double work, but I don't see
how to avoid it (it must scan .js files etc when you open, copy or write too..)

Will the "Standard" scanner actually be enough (since the files are scanned
there first when written to the cache, a virus will be stopped there first)?
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 03, 2006, 08:43:11 AM
Yep. Turned on the "Show detailed info" and testet with some webpages.
And now it only scan the files that are not filtered out by WebWasher!

That's natural as I wrote above.

But what happends to other application trying to access web-pages now?
Will they still be scanned transparent, or will they not be scanned at all?
(in other words, must I add the 12080 proxy to all web-browsers now?)

If you'd like to have Web Shield scan local HTTP communications at port 8080 only once I think you need to follow the instruction I posted.  Edit:  And yes, about other HTTP apps, as long as they are on the (hidden) list, they will be scanned by Web Shield in non-transparent way.  If they are not on the list, you can add them to "OptinProcess=" line in the ini file.  However, normally, you don't need to do this.

(then maybe its better to add WebWasher
to the "application-list" and use the normal transparent WebShield anyway?)

I think it makes thing easier and you can do that by adding the process name of Web Washer "OptinProcess=" line in the ini file but it makes the communication as below.

Browser/Web Washer(8080)/Web Shield (12080)/Internet(80)

Which you don't seem to like since this makes Web Shield scan the communications before Web Washer.  This is why I recommended the other way, means, direct HTTP communications of your browser to port Web Shield(12080) instead of Web Washer(8080).  In fact, why not just give it a try and examine the results with eicar test?

Will the "Standard" scanner actually be enough (since the files are scanned
there first when written to the cache, a virus will be stopped there first)?

At least, DavidR is against it.  ;)
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 03, 2006, 08:50:51 AM
(then maybe its better to add WebWasher
to the "application-list" and use the normal transparent WebShield anyway?)

I think it makes thing easier and you can do that by adding the process name of Web Washer "OptinProcess=" line in the ini file but it makes the communication as below.

Browser/Web Washer(8080)/Web Shield (12080)/Internet(80)

Which you don't seem to like since this makes Web Shield scan the communications before Web Washer.  This is why I recommended the other way, means, direct HTTP communications of your browser to port 12080 instead of 8080.  In fact, why not just give it a try and examine the results with eicar test?

Since the WebShield doesn't scan all files (not images) it might not be that much difference.
And it might be nice to know if there is any virus in the element WebWasher filters out :-)

BTW:  If WebWasher works OK after using the "OptinProcess=WWASHER.EXE" could it be added as
default? Then people using it doesn't have to "hack" to get WebShield working on their system too.
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 03, 2006, 08:53:32 AM
Will the "Standard" scanner actually be enough (since the files are scanned
there first when written to the cache, a virus will be stopped there first)?

At least, DavidR is against it.  ;)

Doesn't that imply that you will get TWO virus warnings?

First one from the "Standard" scanner when the browser tries to store the file in the cache.
Then one more when the "WebShield" scans the content of the load webpage.

Or will the WebShield never detect it since it was stopped by the "Standard" scanner?

Is there a way to test that (a link for downloading a test virus :-)

Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 03, 2006, 08:57:39 AM
BTW:  If WebWasher works OK after using the "OptinProcess=WWASHER.EXE" could it be added as
default? Then people using it doesn't have to "hack" to get WebShield working on their system too.

I wonder if this is a good idea since once added to the hidden list, users cannot configure it as they like, which is, IMO, not good for local proxy.  :-\
Title: Re: Avast is slowing down my internet access.
Post by: Lars-Erik on January 03, 2006, 09:02:50 AM
BTW:  I'm afraid I was a bit tired in this thread I realize now :-)

I doesn't matter were WebShield scans the stream. The commercials filtered
out by WebWasher is never asked for anyway. Beacuse of the order of things:

1) HTML page is loaded from net to WebWasher.
2) WebWashers filters that and send to browser.
2) Browser asks for objects in document (that is ALLREADY filtered).

The browser can't ask for the ads as the links are allready gone :-)

So the normal transparent scanner with the "OptinProcess=WWASHER.EXE"
is the better way to do it then (and much easier to configure as well).
Title: Re: Avast is slowing down my internet access.
Post by: Umath on January 03, 2006, 09:26:50 AM
BTW:  I'm afraid I was a bit tired in this thread I realize now :-)

Then, it must be easy for you to guess how I am tired of this by now since we could end this discussion long time ago. (Sigh)

AND traffic between WebWasher and Internet should never be scanned
If you set port 80 and check 'Ignore local communication', I think you will have what you want: avoid scanning between WebWasher and browser:
Internet > WebShield acting as a proxy at port 8080 for IE > at local communication you will pass the traffic from 8080 to 80 and WebShield will take it.
Maybe I'm wrong  ::)

No I want the opposite: Avoid scanning between WebWasher and the net, and ONLY scanning between WebWaser (after its filter) and the browser.
Title: Re: Avast is slowing down my internet access.
Post by: bascheew on January 04, 2006, 01:43:30 AM
I'm not using a proxy or software firewall or any other Virus software, so most of this discussion doesn't really address the problem.  Anyone else have any suggestions or ideas?