Author Topic: Google Analytics code in Avast GUI?  (Read 25371 times)

0 Members and 1 Guest are viewing this topic.

Offline -midnight

  • Massive Poster
  • ****
  • Posts: 2416
Re: Google Analytics code in Avast GUI?
« Reply #30 on: November 24, 2013, 11:20:06 PM »
??? ???

Yes, but that doesn't give the originator, browse the web and you are going to get hundreds of scans by the web shield as all page requests in the browser get routed through the localhost proxy. But it doesn't say what originated the connection.

Which is the very thing I have been banging on about in this topic, the avast statistics are sadly lacking in detail.

Sorry.  :-[

CitizenOfTheWorld

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #31 on: November 24, 2013, 11:27:03 PM »
There is absolutely nowhere I mention anything about comodo or other sources, simply that the avast statistics have insufficient information to determine what made the connection if it is being routed through the web shield. It might possibly give more information in the AIS firewall logs (or other such sources) , but the avast statistics are sadly lacking in detailed information.

It doesn't matter what source is more reliable than another, just the fact that it's true!

I'm not arguing if it is true or not, just that those looking in the avast statistics are looking in the wrong place as the information isn't detailed enough.
Well in this case the OP's, that you addressed, indication was correct, so I guess he got lucky, huh?
« Last Edit: November 24, 2013, 11:36:49 PM by CitizenOfTheWorld »

cooby

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #32 on: November 25, 2013, 01:59:08 AM »
Since my last posts here, the other day, when I unchecked analytics in HOSTS file to permit connections, there was a successful connection to google during definitions/emergency update.
See log extracts and a screen shot from the firewall. That qg...1e100.net server is google. The firewall log with all avast apps logged (except service) is for the benefit of DavidR who, seems, so far, hasn't been convinced that google is in the picture - ie100.net is google's connection with markmonitor.

I'm glad Avast logs things, and hope they never stop doing so even if complaints come in.

From Setup.log
Quote
20.11.2013   20:55:55.000   1384998955   system   Executing:AvastEmUpdate.exe /updater
20.11.2013   20:55:55.000   1384998955   system   Executed:AvastEmUpdate.exe /updater
20.11.2013   20:55:55.000   1384998955   general   Return code: 0x20000000 [Something done]
20.11.2013   20:55:55.000   1384998955   general   Stopped: 20.11.2013, 20:55:55
From eventlog.log
Quote
11/20/2013   8:55:59 PM   The virus definitions have been automatically updated to version 131120-0
From HtmlRemoteContent.log
Quote
11/20/2013, 20:56:04    WinHttpReadData returned  200 for: http://s.program.avast.com/api/?action=1&p_aas=0&p_adc=0&p_adi=-1&p_adp=0000&p_age=109&p_cid=1&p_cpu=-1.0&p_cpv=134219225&p_elm=80&p_fib=-1&p_fsh=11.7&p_hid=cf722c1c-b7e2-43d4-a6ab-9efa5dd4bd42&p_idw=0&p_iid=0&p_inf=2&p_lan=1033&p_lci=1033&p_let=24&p_lex=285&p_lic=0&p_lid=en-us&p_lng=en&p_lqa=0&p_lqe=0&p_lst=0&p_lsu=24&p_man=0&p_mdc=0&p_osv=5.1&p_pro=0&p_ram=894&p_reh=800&p_rew=1280&p_vbd=1497&p_vep=8&p_ves=0&p_wdc=0&p_wei=-1.0&p_wnf=0
11/20/2013, 20:56:05    WinHttpReadData returned  200 for: http://static.avast.com/program/api/images/mkt/toaster-mobile/bg.png
11/20/2013, 20:56:05    WinHttpReadData returned  200 for: http://static.avast.com/program/api/images/button_blue_36.png
11/20/2013, 20:56:05    WinHttpReadData returned  200 for: http://static.avast.com/program/api/images/mkt/toaster-mobile/fms.png
11/20/2013, 20:56:05    WinHttpReadData returned  200 for: http://www.google-analytics.com/__utm.gif?utmn=8163700247&utmac=MO-1405551-20&utmwv=4.4sh&utmp=%2Ffa-80%2Fen-us%2F30%2Ftoaster-virus-update_t5_70_mkt-mobile2.html&utmcc=__utma%3D999.999.999.999.999.1%3B&utmvid=0x41c509ad94987168&utmr=-
11/20/2013, 20:56:05    WinHttpReadData returned  200 for: http://www.google-analytics.com/__utm.gif?utmn=0127462121&utmac=MO-1405551-13&utmwv=4.4sh&utmp=%2Ffa-80%2Fen-us%2F0%2Fother%2Ftoaster-virus-update_t5_70_mkt-mobile2_AV.html&utmcc=__utma%3D999.999.999.999.999.1%3B&utmvid=0xc84e17efafea67c9&utmr=-
From my firewall - can't insert here, see screenshot below

That said,
1. Avast is free and wonderful. If this was a paid product I might be annoyed, somewhat. Somewhat because the quoted vlk explanation suffices for me.
2. If you don't trust a security product, even one of the 3 best in the world, ditch it and get another. It's no brainer.

Edit: corrected where the quotes are
« Last Edit: November 25, 2013, 05:53:01 AM by cooby »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 86545
  • No support PMs thanks
Re: Google Analytics code in Avast GUI?
« Reply #33 on: November 25, 2013, 03:03:29 AM »
Wrong, I know that if you are using google-analytics (as many sites do) be that for collation of website traffic stats or other traffic the data has to be stored on the google-analytics.com to be able to access the data.

In this case the collation of how users navigate through the avastUI so that it can be analysed by avast to improve the avastUI.

My only issue is that people were trying to use the avastUI statistics to find access to google-analytics, the problem being that traffic could come from multiple sources, not just the avastUI.exe if it even records connections/traffic from avastUI.exe as these may not go through the web shield proxy. So it is the statistics as a source of information for this which I'm saying is not good.

Other sources firewall logs if the firewall is capable of recording the parent process (some can't) and not just recording the web shield proxy as the parent process (if the avastUI traffic is redirected through the proxy). There are a number of sniffer packages that are equally as good at detecting this.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.2.6003 (build 22.2.7013.717) UI 1.0.697/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

cooby

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #34 on: November 25, 2013, 05:56:30 AM »
...So it is the statistics as a source of information for this which I'm saying is not good.

Other sources firewall logs if the firewall is capable of recording the parent process (some can't) and not just recording the web shield proxy as the parent process (if the avastUI traffic is redirected through the proxy). There are a number of sniffer packages that are equally as good at detecting this.

Thanks for the clarification. Now I got it :)

Tetsuo

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #35 on: November 25, 2013, 03:40:17 PM »
Well in this case the OP's, that you addressed, indication was correct, so I guess he got lucky, huh?

hahahaha

Well, I checked it with Online Armor and HostsServer - among the others.  I'm not a programmer and I only wanted to receive an official reply from the Avast Team - not arguing with Avast fanboys. Also, I could recall some other user asked the same question  months ago.

These are the main reasons why initially I preferred to mention only the Statistics and HostsServer: I was expecting an official reply from Avast team, they should know how their program works, I guess.
My first though was: "no reasons to give Avast evidences, if I should be right they already know. Just be polite and humble.


So I wrote:

I suspect there's some Google Analytics code in the GUI (or something like that, I'm not a programmer).
Should I be right, could you please tell me how to disable it?


When DavidR at some point said there is no confirmation that Avast 9 like Avast 8 has also a tracking module, I simply suggested to check the statistics or use something like HostsServer - just because I was not interested in giving evidences to other users or arguing with them: that was not the point of my thread - wrong move, I know. Avast fanboys always lie in wait, hijacking the main questions, justifying everything.


P.S., sorry for my poor English

EDIT: typo

« Last Edit: November 25, 2013, 03:47:23 PM by Tetsuo »

ram1220

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #36 on: November 26, 2013, 01:05:18 AM »
 So once again in plain English. Is there a way to disable Google Analytics? I DO NOT want my AV to spy on me. I don't care what the info is used for.

Offline -midnight

  • Massive Poster
  • ****
  • Posts: 2416
Re: Google Analytics code in Avast GUI?
« Reply #37 on: November 26, 2013, 01:29:20 AM »
You can block it with Ghostery.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 86545
  • No support PMs thanks
Re: Google Analytics code in Avast GUI?
« Reply #38 on: November 26, 2013, 01:36:29 AM »
You can block it with Ghostery.

That won't work for what is being requested. Ghostery is a browser add-on and only works with browser traffic. The use of google-analytics to monitor the avastUI (for usability, etc.) is totally different.

google-analytics.com can be blocked in a users firewall or the HOSTS file. This should work in all instances browser or otherwise, including its use by avast to monitor the avastUI usability.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.2.6003 (build 22.2.7013.717) UI 1.0.697/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

CitizenOfTheWorld

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #39 on: November 26, 2013, 09:43:38 PM »
avast 9.0.2008 free x86.
I have also noticed some spy activity here-

I have noticed that once you open avast interface it begins to connect google (1e100.net) servers. :o

I just run netstat -b command and got this-->

Code: [Select]
  Proto  Local Address          Foreign Address        State           PID
  TCP    win-pc:1618            a118-214.142-13.deploy.akamaitechnologies.com:https  ESTABLISHED     2860
  [AvastUI.exe]

  TCP    win-pc:1619            bom03s01-in-f30.1e100.net:https  ESTABLISHED     2860
  [AvastUI.exe]

  TCP    win-pc:1620            bom03s01-in-f30.1e100.net:https  ESTABLISHED     2860
  [AvastUI.exe]

  TCP    win-pc:1621            a118-214.142-13.deploy.akamaitechnologies.com:https  ESTABLISHED     2860
  [AvastUI.exe]

  TCP    win-pc:1622            a118-214.142-13.deploy.akamaitechnologies.com:https  ESTABLISHED     2860
  [AvastUI.exe]

  TCP    win-pc:1623            bom03s02-in-f0.1e100.net:http  ESTABLISHED     2860
  [AvastUI.exe]



But when i add these lines in my host file (c:\windows\system32\drivers\etc\host), avastui.exe stopped its activity. 8)

Code: [Select]
# block Google Analytics via host file#
127.0.0.1 pagead.googlesyndication.com
127.0.0.1 pagead2.googlesyndication.com
127.0.0.1 adservices.google.com
127.0.0.1 ssl.google-analytics.com
127.0.0.1 www.google-analytics.com
127.0.0.1 imageads.googleadservices.com
127.0.0.1 imageads1.googleadservices.com
127.0.0.1 imageads2.googleadservices.com
127.0.0.1 imageads3.googleadservices.com
127.0.0.1 imageads4.googleadservices.com
127.0.0.1 imageads5.googleadservices.com
127.0.0.1 imageads6.googleadservices.com
127.0.0.1 imageads7.googleadservices.com
127.0.0.1 imageads8.googleadservices.com
127.0.0.1 imageads9.googleadservices.com
127.0.0.1 partner.googleadservices.com
127.0.0.1 www.googleadservices.com
127.0.0.1 apps5.oingo.com
127.0.0.1 www.appliedsemantics.com
127.0.0.1 service.urchin.com


strange! :o
I think avast downloads ads from somewhere and then shows them in its UI. ::)

I'm sure you're aware, but in firefox, when the two check boxes shown Here are checked, it phones that domain of Googles, that's circled, and checks their list of bad sites.  If one turns them off, or blocks them, then they don't afford the protection they supposedly offer, the question is, does one truly require such protection, some maybe, I can only speak for myself.  And I advice that no one allows me to speak for them, always know for yourself!  The only way one can be sure!

Tetsuo

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #40 on: December 02, 2013, 03:27:21 PM »
At this point I'm going to ask for some advice, but also opinions, somewhere else on the Internet.
Many thanks to all the users that kindly provided useful information about the issue.
 

Tetsuo

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #41 on: December 10, 2013, 02:45:08 PM »
Just a quick update. Here is the reply I received today - after almost one month - for my support ticket:

[My question was: I found out that Avast has a tracking module which uses  Google Analytics code (at least) in the GUI.
Could you please tell me how to disable it?]

<< Hello,

Thank you for contacting our support center with your concerns.
I cannot as I do not know anything about it or such avast! behaviour.

Best Regards,


Petr Bucek
Technical Support

AVAST Software a. s.
Budějovická 1518/13A
140 00 Prague, Czech Republic >>





Thanks, Mr Bucek! Now my faith in Avast Software is absolutely restored!!


« Last Edit: December 10, 2013, 02:47:57 PM by Tetsuo »

seeker15

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #42 on: December 10, 2013, 08:38:15 PM »

<< Hello,

Thank you for contacting our support center with your concerns.
I cannot as I do not know anything about it or such avast! behaviour.

Best Regards,


Petr Bucek
Technical Support

AVAST Software a. s.
Budějovická 1518/13A
140 00 Prague, Czech Republic >>




Haha this made my day! Thank you :D

Tetsuo

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #43 on: December 10, 2013, 09:23:40 PM »
Haha this made my day! Thank you :D

You're quite welcome! :D

Arnold72

  • Guest
Re: Google Analytics code in Avast GUI?
« Reply #44 on: December 11, 2013, 12:25:01 AM »
Even avast doesnt know about the google tracking activity LOL..!!!