WebShield bugs(?)

[Alexo]

I have a similar problem that we haven't been able to resolve yet. When I try to open Google's main page with Web Shield enabled, the page does not load. Instead, I get a popup stating that I'm about to download an application/octet-stream and it asks if I want to save it or open it with another application. This happens only when both Web Shield and Comodo Personal Firewall are enabled. It does not happen if either is disabled.

This is apparently stumping the Avast people and the Comodo people. Since I don't feel like changing firewalls again I've just disabled Web Shield for the time being.

Yes, exactly the symptoms I'm getting.
Comodo supports blames Avast.
Avast support did not respond to my email yet.

[neiby]

To be fair, this is a really strange problem. It is complicated by the fact that, in my case, the Avast software and the Comodo software received updates on the same day. So, it's kind of hard to tell which update created the problem. It's also possible that only a certain combination of software and settings creates the issue.

I can recreate it at will, but so far that hasn't helped much with the troubleshooting process.

[Vlk]

It would be useful to give us some hints on how to simulate the problem. AFAIK this is no repro in our test lab... 

[neiby]

It's very easy for me to do it.

1. Enable Web shield
2. Make sure Comodo Personal Firewall is running
3. Launch browser

Since my home page is www.google.com, and that is one of the sites that nearly always has a problem, the problem occurs by simply opening my browser. It doesn't happen 100% of the time, which is odd, but it happens most of the time.

I've also noticed that once in a while things will work as they should for a while before the problem occurs. I have no idea why. Sometimes I can open Google or gmail with no problem, and both of them usually have the problem. In those times, I usually will get the problem immediately if I close my browser and try again.

I don't have anything else running that would be interacting with the network. My resident programs are Picasa, a Kodak program for my digital camera, Gmail notifier, Avast, Comodo firewall....and that's about it.

I'm fairly certain that I don't have any other resident nasties running because I do regular scans for spyware and that sort of thing using multiple programs.

I agree that this is a very strange problem, and I wish I could provide better information!

[Alexo]

It would be useful to give us some hints on how to simulate the problem. AFAIK this is no repro in our test lab... 

WinXp/SP2 + latest fixes from MS.
IE6 + latest SP and fixes from MS.
Avast 4.7 HE, auto updated as needed.
Comodo Personal Firewall, latest version (I believe, not at home right now).
Windows Live messenger (does it matter?)

Homepage set to google.ca
Avast has WebShield turned on (turning it off fixes the problem)
CPF has Application Behavior Analysis turned on (turning it off fixes the problem)

1) Reboot.
2) Start IE6.

Instead of going to the homepage, IE displays a popup as below:

... When I try to open Google's main page with Web Shield enabled, the page does not load. Instead, I get a popup stating that I'm about to download an application/octet-stream and it asks if I want to save it or open it with another application. This happens only when both Web Shield and Comodo Personal Firewall are enabled. It does not happen if either is disabled.

More details can be found here:
http://forums.comodo.com/index.php/topic,3113

Currently, I have disabled WebShield.
An interesting side effect: web browsing feels noticeably quicker!

What other information would you like me to supply?
Since I have exactly the same symptoms as neiby, perhaps it is possible to cross-reference?

[neiby]

I should mention that I also have Win XP/SP2 with all the latest updates.

[alanrf]

CPF has Application Behavior Analysis turned on (turning it off fixes the problem)

I think that this is the first I have seen of this piece of information.

neiby,

does this apply to you too?

[neiby]

I'm not at my home PC right now but I believe I have that behavior turned off and it did not resolve the problem. I will check again later just to make sure. I tried to turn off any "intelligent" scanning of the Avast processes. I also tried to configure Web Shield for minimal scanning. Nothing seems to have helped so far.

[neiby]

It turns out that I had Application Behavior Analysis turned on. However, turning it off did not fix the problem.

I also tried something within Avast. On the Web Shield configuration page, I unchecked "Enable web scanning". That still did not resolve the problem. I have to completely turn off Web Shield or Comodo firewall to fix it.  :-(

[DavidR]

Try deleting the entry for the web shield in Comodo, which will force it to ask again. Sometimes settings get corrupted even though the list shows an application is granted access. I have had this happen with Outpost Pro once and Zone Alarm also seemed to suffer this problem, perhaps Comodo is forgetful also.

[Reslayer]

May I say a word?
I use Mozilla Firefox and Avast!, and I haven't got any problem during surfing the web.
Maybe an IEXPLORE is a buggy thing, at last?

[neiby]

I use Firefox, as well, but this problem happens with IE, Firefox 1.5 and Firefox 2.0. It doesn't seem to matter which browser I use.

[Lisandro]

To know what is happening, maybe activate logging in WebShield:

1. Edit <avast>\data\avast4.ini file
2. Find the section [WebScanner]
3. Add the line:
    EnableLogging=1
4. Restart Web Shield in XP (terminate and start again) or whole PC in case of Win98
5. Browse (trying to access some webpages)

The log file are <avast>\data\log\ashwebsv.log and ashwebsv.ws.
They would be accessible when WebShield is terminated again.
Post them here or send by mail to rypacek (at) asw.cz
After that, disable the logging to avoid a big log file.

[neiby]

We already tried Web Shield logging. It ended up not showing anything helpful.  :-(

[lukor]

I was able to reproduce the problem with Comodo PF. To me it seems like Comodo delays the first chunk of data being delivered to display a "Allow/Deny dialog", or to perform some analysis of it's own. It then re-enters the chunk into the stream but not always in the right order.

This is just a guess until confirmed by Comodo's developers, but I can say that I have traced the WebShield's operation in the debugger and I know for sure that WebShield called the Send operations in the right order.

You can track the issue on the Comodo forum here:
http://forums.comodo.com/index.php/topic,3113.msg25656.html#msg25656

Hopefully more info will come soon.
Lukas.