Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Knuckles on January 30, 2010, 11:54:20 PM
-
I haven't really noticed before with previous versions of Avast or other AVs, but Avast 5 seems to have a lot of TCP Out connections according to my firewall. Is this normal? What are these for? See attached for example.
-
yeah, noticed that too, many hosted by theplanet.com and for various reasons I don't like this ISP/server...but OK, sounds like many legit sites (ie not only avast) can't live without theplanet.com theses days...
-
Yes, me too - an incredible number of tcp connections either "listening", "established" or "closewait" coming from AvastSvc.exe (1088) - I never saw this with 4.8 - sometimes up to 50 or more. Surely this is taking up resources or slowing down connections ?
-
Yes, me too - an incredible number of tcp connections either "listening", "established" or "closewait" coming from AvastSvc.exe (1088) - I never saw this with 4.8 - sometimes up to 50 or more. Surely this is taking up resources or slowing down connections ?
doesn't slow down anything but see anyway what I posted there:
http://forum.avast.com/index.php?topic=54828.msg463899#msg463899
blocking all those doesn't prevent auto-update, so it has either nothing to do with that, or it's checking alternative servers... but it's mostly related to the IS ad. All these connections are of course not present in the paid version.
ps: to make things clear, the goal is not to block the ad, as I don't find it intrusive at all in the free version, but so many persistent connections isn't something acceptable. I don't run the "free" version anymore, so I'm not personally bothered, but I was tbh.
(http://forum.avast.com/index.php?action=dlattach;topic=54828.0;attach=43045;image)
-
Logos,
I believe you are correct - it is the IS advert. Every time the summary screen is opened AvastUI.exe will attempt an outgoing connection. If blocked from doing so, it will rapidly try up to 10 times, each to a different IP. It will then make no further attempt until you have moved to another of the Advast screens and return back to the summary screen - then there will be another 9 or 10 attempts to the same list of IP's.
If AvastUI.exe is blocked by the firewall, the advert is not shown. Presumably when it isn't blocked it should not need to go through the whole list of IP's each time to source the data for the advert.
Under normal usage, I would not bring up this screen very often - I usually do a full scan before making a weekly partition backup. The rest of the time I just let the AV get on with its job. Having the advert there doesn't concern me, and I would think the additional data downloaded each time for the advert would be fairly minor, so I will go back to leaving AvastUI.exe clearance through the firewall.
I find the approach rather interesting though!
-
My only pain in the rear about this as a dial-up user, is the attempt to make a connection when you open the UI, that never happened in 4.8 avast was clever enough to wait until a connection was established rather than attempt to establish one.
I hate this in any program that attempts to automatically connect to the internet on my system to that end there are very few programs I allow auto update too, avast being one. Now the avast update is clever enough not to try to update when there is no connection 'and' it doesn't try to establish a connection, so why this logic can't be passed on the advert is beyond me.
The advert is relatively unobtrusive, much less than the in your face advert of 4.8, but what is obtrusive is the attempt to connect.
I would also have thought avast smart enough to cache the advert (as presumably it did in 4.8 ), so it was available and would populate the UI automatically without requiring a connection. When a connection is established it could then check for updates in a) the virus signatures and engine and b) if you have the free version, the latest advert. The updated advert could then be cached and used the next time the UI is opened.
-
Yes it's true about the advert, the connection(s) are constant. However they are from AvastUI - I was talking about all the connections from AvastSvc.exe (1088) : that's not the same thing !
-
Yes it's true about the advert, the connection(s) are constant. However they are from AvastUI - I was talking about all the connections from AvastSvc.exe (1088) : that's not the same thing !
all the avastsvc connections are normal and expected on my system. But my bad, I missed the avastsvc.exe in your first post.
-
You should see a subsequent reduction in your browser making outbound connections as avast AvastSvc.exe (web shield) intercepts port 80 http traffic but I don't see any in my firewall listing for (1088) what ever that may be.
-
I think he referred to PID for 1088, it's actually 1288 here.
-
PID for me of 1420 for me but that PID is pretty irrelevant in the entries, unless it is something other than a PID.
-
PID for me of 1420 for me but that PID is pretty irrelevant in the entries, unless it is something other than a PID.
the PID reference is completely irrelevant in this thread if you want my opinion ;)
-
It's normal. Avast! 5 integrated all the local proxies of Avast! 4.8 to AvastSvc.exe. So, it checks for major internet traffics for email clients, messengers, and browsers.
-
It's normal. Avast! 5 integrated all the local proxies of Avast! 4.8 to AvastSvc.exe. So, it checks for major internet traffics for email clients, messengers, and browsers.
yep, just what I meant in one of my posts above. The thing is it's still weird that many connections persist for a little while even after the browser is closed for instance, sometimes they close fast, sometimes not that fast, and that would happen also without Avast. That's another topic.
-
It's normal. Avast! 5 integrated all the local proxies of Avast! 4.8 to AvastSvc.exe. So, it checks for major internet traffics for email clients, messengers, and browsers.
yep, just what I meant in one of my posts above. The thing is it's still weird that many connections persist for a little while even after the browser is closed for instance, sometimes they close fast, sometimes not that fast, and that would happen also without Avast. That's another topic.
??? I thought you mistook AvastUI.exe, which seems to be related with updates according to igor, for AvastSvc.exe... Everybody else seems to be talking of the latter.
-
It's normal. Avast! 5 integrated all the local proxies of Avast! 4.8 to AvastSvc.exe. So, it checks for major internet traffics for email clients, messengers, and browsers.
yep, just what I meant in one of my posts above. The thing is it's still weird that many connections persist for a little while even after the browser is closed for instance, sometimes they close fast, sometimes not that fast, and that would happen also without Avast. That's another topic.
??? I thought you mistook AvastUI.exe, which seems to be related with updates according to igor, for AvastSvc.exe... Everybody else seems to be talking of the latter.
I never mistook anything ::) I just missed that one poster here was referring to avast.exe and not avastUI.exe. See the other thread I started and referred to here: it's about avastUI and nothing alse. See also the screenshot I posted there, and here again, it's all about avastUI.exe (you see it now? :) ) . Igor suggested that the connections could be about avast updates >>> looking for servers etc... and as mentioned in one of my previous posts here it's just not that, not that at all...all these connections can be blocked and Avast "free" will still auto-update properly...OK I don't want to repeat again what I just said ::)
-
I never mistook anything ::) I just missed that one poster here was referring to avast.exe and not avastUI.exe. See the other thread I started and referred to here: it's about avastUI and nothing alse. See also the screenshot I posted there, and here again, it's all about avastUI.exe (you see it now? :) ) . Igor suggested that the connections could be about avast updates >>> looking for servers etc... and as mentioned in one of my previous posts here it's just not that, not that at all...all these connections can be blocked and Avast "free" will still auto-update properly...OK I don't want to repeat again what I just said ::)
Nobody is talking of avast.exe but I admit that there is another person who is talking of AvastUI.exe...Olddog but the OP, DavidR, and mhf seem to be talking of AvastSvc.exe. To my eyes, you appeared to have mistaken/hijacked the topic...but I guess it is not a huge problem as long as the different function of each process is clear. ;)
-
gulp - sorry about the PID (copy/paste error).
So it boils down to saying that all's OK ?
-
gulp - sorry about the PID (copy/paste error).
So it boils down to saying that all's OK ?
I guess so. It works the same on the computers of everybody here and igor didn't come up to tell a thing although I feel his presence.
-
Yes it's true about the advert, the connection(s) are constant. However they are from AvastUI - I was talking about all the connections from AvastSvc.exe (1088) : that's not the same thing !
all the avastsvc connections are normal and expected on my system. But my bad, I missed the avastsvc.exe in your first post.
;)
-
gulp - sorry about the PID (copy/paste error).
So it boils down to saying that all's OK ?
yep, all the avastsvc connections are OK, they just reflect your browser and email client traffic via web shield and mail shield ;)