avast.setup and tracker.prq.to

[Foxabilo]

C:\Documents and Settings\ISK>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : isk-server
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : Yes
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 21:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Realtek RTL8139/810X Family PCI Fast
 Ethernet NIC #4
        Physical Address. . . . . . . . . : 00-02-44-2E-FC-2B
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.0.1
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . :

PPP adapter BT Voyager 100 ADSL Modem Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
        Physical Address. . . . . . . . . : 00-53-45-00-00-00
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 86.132.134.199
        Subnet Mask . . . . . . . . . . . : 255.255.255.255
        Default Gateway . . . . . . . . . : 86.132.134.199
        DNS Servers . . . . . . . . . . . : 62.6.40.178
                                            194.72.0.98
        NetBIOS over Tcpip. . . . . . . . : Disabled

C:\Documents and Settings\ISK>

all the DNS servers check out as my offical ISP's ones

[Foxabilo]

C:\Documents and Settings\ISK>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : isk-server
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : Yes
        WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 21:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Realtek RTL8139/810X Family PCI Fast
 Ethernet NIC #4
        Physical Address. . . . . . . . . : 00-02-44-2E-FC-2B
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.0.1
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . :

PPP adapter BT Voyager 100 ADSL Modem Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
        Physical Address. . . . . . . . . : 00-53-45-00-00-00
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 86.132.134.199
        Subnet Mask . . . . . . . . . . . : 255.255.255.255
        Default Gateway . . . . . . . . . : 86.132.134.199
        DNS Servers . . . . . . . . . . . : 62.6.40.178
                                            194.72.0.98
        NetBIOS over Tcpip. . . . . . . . : Disabled

C:\Documents and Settings\ISK>


Both DNS addresses check out as official British telecom DNS's

[alanrf]

Well, I'll admit I'm stumped on this one. 

I just did an IP trace of the update function on my system (using Ethereal) and everything being done by avast is completely "proper".

[Foxabilo]

it gets stranger !
this is a screeny of the ZA program log with the addresses it thinks Avast is connecting too look at the random list thats there googlemail all sorts :S

[alanrf]

Foxabilo,

I just use the free ZA firewall (current version) so I am not familiar with this ZA antispyware screen. 

However, I notice with concern that it has blocked perfectly normal DNS lookups to your stated BT DNS servers, 62.6.40.178 & 194.72.0.98 (port 53).

I cannot account for the other entries, but in the above cases ZA has simply prevented avast from doing what it is supposed to do. 

Were this my system I would have to question the effectiveness and value of the ZA antispyware offering currently installed.   

While I certainly would not wish to advise anyone to take risks with their system I again point to the fact that I have run an IP trace against avast update on my system and only seen it perform perfectly safe activity.  There are a few free such trace tools if you care to check (as I mentioned previously I use Ethereal).

[kubecj]

From what I see from the log, it seems that ZA blocks even the DNS query for avast servers and (IMO) reports wrongly the last successful DNS query instead.

As a author of the setup thingy I'm quite sure that the setup just loads server urls from servers.def and then tries to connect to them on the standard 80 HTTP port. It has no builtin list of other servers. You should decide if you trust me (or us, the company).

I strongly believe that now all setup/update errors are
a) misconfigured firewall
b) problem with user's rights
c) misconfigured proxy settings (adds with b), when using NTLM authenticated proxies)

The updater is quite mature part of Avast and most of its real problems were solved many months ago...

[alanrf]

Well ... I have to say ... there's someone who is willing to take a stand!

I just decided to try out this ZA combined firewall and antispyware (free 15 day trial - I'm not parting with money for this) to see if I can recreate the problem seen by Foxabilo.

So I downloaded it and selected the "clean install" (ie it uninstalled my current version of ZA free firewall). 

It requested a restart of my system which I allowed.

During restart it asked for permission for avast update to have outbound access, which I allowed.  avast automatic update check at restart completed normally.  I performed a manual update check of avast ... it performed normally.  I removed avast update from ZA programs table.  I tried the update again, it worked (no request by ZA ... avast update appeared in the program table again).  I removed it again ... tried avast update again, it appeared in the table again, I deleted it again ...  you get the picture.  Eventually it stayed deleted (but my typing fingers are an inch shorter) and avast said it could not update, but I never was able to produce the screen that Foxabilo posted. 

However, with this ZA combined firewall/antispyware product installed there was just no way I could get my browser to connect to the internet (I have no proxy configuration). 

I may be an avast evangelist but the best product I ever paid money for is Goback (even though it is now owned by the dreaded Symantec - reaching for crucifixes and garlic). So trusty Goback has restored me within moments back to the point before my adventure with ZA antispyware began.  Big sigh of relief ... that product shall not have disk space on my system anytime soon.

I return my thoughts to the comments by kubecj. 

While none of us involved in the beta testing reported problems with the update function (and I am one of quite a few users I know of who have upgraded without problems) I am, to say the least, a little surprised that you feel able to dismiss the reports of those who have:

1) simply applied the update to 731
2) find that they cannot successfully update
3) revert to 691 and find their ability to update completely restored

The only way it seems to me that your logic works is if there is some fault or oversight in the process used by avast for installing the update to 731 that has not preserved the user's previous configuration.  I hope I am proved wrong.

Just one more thought.  Given my experience with trying out the ZA firewall/antispyware combination - you just might want to give that product a little more space in your avast regression testing.   

[Foxabilo]

Well thankyou very much for all your assistance gentlmen, I have decided to allow avast.setup unrestricted access to the internet. I have used Avast since it came out and only recently (last 8 months) used ZoneAlarm Anti Spyware So I am plumping for it being Zone Alarm going wrong some zero based index of blocked ip's being accessed by a +1 array as often happens I find with c++ arrays   int myarray[10]; for {i=1;i<10;i++} blah blah you get the picture.

Anyway It all updates fine if I just choose to ignore the odd ip addresses reported by Zone Alarm

[Foxabilo]

Just a final note to add, if I use autoupdate release 691 no strange IP address's get logged :| if thats any help, anyways back to coding cheers and thanks for all the fish

[Lisandro]

Thanks Foxabilo for your confidence in avast team.
About the autoupdate of version 4.6.691, maybe the interaction with ZA driver has changed... just guessing.

[Foxabilo]

Just a heads up chaps,

Not compleatly sure if its relivent, but...

I put a problem submition into Zone Alarm anti spyware people and tho they have not contacted me back, a day or so ago I recived a Zone Alarm Auto Update after which no more wierd avast ip's are listed and infact all of the program item in my program log are now gone... Hmm me thinks ZA dropped a ball someplace, never mind tho as its all running fine

[Lisandro]

I put a problem submition into Zone Alarm anti spyware people and tho they have not contacted me back

It used to be. A good program with a very poor support from the company. ZA is good, ZoneLabs... 

Hmm me thinks ZA dropped a ball someplace, never mind tho as its all running fine

Thanks for posting and making clear what happened 

[timop]

I have found this forum after a search about 88.80.5.21 site

I had traced it back to
role prq Inet NOC
person Per Warg
person Andreas Carsbring

I believe it to be a Trojan that has infiltrated my system. I think it is in many files and has done a back up of the original file so everything runs as normal, except that 88.80.5.21 comes up in my history.

I had no firewall set up (behind a router and thought that was good enough)
I ran McAfee virus scan - did not find it (it was in my history every day) (I pay McAfee for their service)
I also ran spybot S&D and Lavasoft Adaware - and nothing
Symantec (free Internet check) found the list of many files infected - called it Trojan: Zonebac

I will be reformatting my drive(s) unless I luck out  and hear from someone on a fix.
After repeated attempts to contact McAfee  they have ignored me.

Tim

[timop]

I may purchase Zone Alarm - do you think that would also solve my problem?

[Lisandro]

I may purchase Zone Alarm - do you think that would also solve my problem?

No, I don't think so.
You can buy ZA but I don't think that because of the free version you should have any problems using avast.
A lot of users have ZA (free) and avast (free).