Avast Allows Google to Establish Connection

[Johnny4745]

I would like to know why Avast is opening a port to Google on my computer.  I don't use Google, I don't like Google, and I sure don't want Google connecting to my computer.

How would I block Google?


74.125.140.102  Connection Established

[DavidR]

If you can give more details on the connection it may help, as a lot of things will be going through the web shield proxy that aren't initiated by avast, just redirected so that the content can be scanned.

[Johnny4745]

I did a trace route on the connection.  The information leaves my computer and goes to Nashville, Tennessee, to the IP address:  12.122.148.14

Of course I don't know who is getting the information, the IP address only goes as far as the ISP, which is AT&T.

I need an application rule to block any attempted connections by Google, no matter what IP address Google is supplying.

[DavidR]

The problem is that many sites (probably the majority that you visit) will have links to google in one form or another, google-analytics.com being a major one.

So identifying what is responsible for the connection isn't going to be easy.

Blocking it or anything google is probably easier, you could block it in your HOSTS file but in all honesty doing that or blocking it in any other way is likely to have a big impact on your browsing.

EDIT:  That said the first IP you gave might well be registered to google but the domain name is 1e100.net, so any block on google associated domains (in a hosts file, etc.) isn't going to be easy either.

[Lisandro]

Port? Which port?
You can make a custom install and do NOT install Google for nothing...
Use NoScript and block Google Analytics.

[Johnny4745]

Local port 56980.

I use Ghostery to block tracking cookies.  It will block all of them, or you can choose which ones not to block.

I just recently did a clean install of Windows 7.  Google got on my computer when I installed Firefox.  Firefox automatically installs a Google search bar.  I removed the search bar.

I searched my whole computer for Google, and deleted every instance of Google I found, I thought that would take care of it.  I didn't know Avast had opened a back door for Google.

[bob3160]

Virtually every company and many individuals use Google analytics.
Stating that Avast opened a back door is a little bit misleading.

[Johnny4745]

It's not misleading, it's a fact.

Google does not show up in network connections, yet a connection is established.

I have the option to block Adobe, Firefox, Thunderbird, and even Microsoft.  I don't have the option of blocking a connection from Google.

If I change the rules in the firewall under friends from Allow to Ask, I'm not asked.  Internet activity is stopped.  I can't go to any website.

[bob3160]

Using the host file to accomplish that task was already mentioned.

[Johnny4745]

Here is my host file:

%SystemRoot%\system32\drivers\etc\hosts

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#   127.0.0.1       localhost
#   ::1             localhost

I see nothing in it about Google.  It does say it's a sample file.

Is there another hosts file?

[DavidR]

You won't see anything about google, the hosts file is there for you to edit, placing sites there that you don't want the computer to visit.

You use the examples format to create entries for google, etc.

127.0.0.1   google.com

127.0.0.1 is your local system (home) so when a connection is attempted to google.com it is redirected to the home IP and obviously nothing will be found (no connection made).

As I said this is fraught with issues as many sites have links to various google services, if you are determined to avoid google, switching off your computer is a definitive option. But like blocking google related services in the hosts file you will find your web browsing may well suffer adversely.

[Johnny4745]

Thanks for the information.  I'm going to try it.  I can always edit the entry in notepad.

[Charyb-0]

You could try running DebugView from Sysinternals to see if it will shed some light on this. This can be run from your desktop.

http://technet.microsoft.com/en-us/sysinternals/bb896647.aspx

or

tcpview

http://technet.microsoft.com/en-us/sysinternals/bb897437.aspx

[Johnny4745]

Thanks. I will try both.  I have already downloaded DebugView.  It couldn't connect to my computer, my router firewall is blocking it, so I will have to turn it off and try again.

The help files didn't download with the program, but I think I can figure it out.

I tried adding Google to the host file, and that didn't work.  The Google connection is still established, and I went to Google.com, and the page loaded.

Here is my host file now:

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host
#       127.0.0.1         google.com

# localhost name resolution is handled within DNS itself.
#   127.0.0.1   localhost
#   ::1             localhost

[Johnny4745]

I like TCPView.  It shows the Google connection, with an option to end the process or shutdown the connection.

I'm worried about using these options, because the connection is shown as Avast, only the IP address shows it's really Google that is using the connection.