Avast Blocking Access To Local File Server When Internet Goes Out

[REDACTED]

I have a strange issue I was hoping someone could shed some light on.

Whenever the internet goes out, Avast will block the local network connection to a file server that I frequently use. I use two different servers and for some reason it will only block one of them. One is running Windows Server 2003 and the other one is running Windows Server 2012 R2. Whenever the network goes down, it blocks communications to the server that is running Windows Server 2003. If I go into the system tray and turn off the shields I can connect to it. I have tried to add exceptions but none of them kept avast! from blocking the connection to the file server.

Has anyone else had this issue and could shed some light on a fix for this? I haven't been able to solve this problem and it's been an issue plaguing me for months at this point.

[REDACTED]

Which shields on which host; server or client ? 
Which product do you own?

Initially, to me anyway, sounds like could be a DNS problem.  Your DNS server should probably be on your 2012R2 server if it isn't already (sorry, just guessing since it's an unknown factor).

Are you talking about pings or network browsing getting blocked or just accessing shares?  Shares could point to a SMB problem.  You'd need to make sure you haven't disabled SMB1 traffic via engaging a firewall for example.

I hope you are trying to migrate off 2003 server anyway

[REDACTED]

I have to disable the shield on the client side.

I am using avast! Endpoint Protection Plus.

I hadn't thought about attempting to ping to the server when this happens. That is definitely worth a try to see if it can even establish a connection to it at all. The issue I am referring to in the original post deals with trying to access it through the run command ( \\servername ) and attempting to access it through the Network section on Windows Explorer. The run command could not find the server and the server does not pop up in Windows Explorer.

I'm not sure how to go about checking to see if SMB1 traffic is blocked when the network is down. However, in my research of SMB1 connections, I did find that software such as WannaCry use this type of connection to spread Ransomware. Yikes. You may be right about migrating off of the Windows 2003 server. This makes me curious, though. It could be that Avast sees the SMB1 connection and is blocking it as a precautionary measure to prevent anything malicious coming down the pipe.

This is definitely something I had not thought of before, nor would I have thought of til you mentioned it.

As for the DNS server, we do use a local DNS server. I'm not entirely sure as of right now, but I think it is hosted on the Windows 2003 Server, which, as you suggested, should probably be moved over at some point.

[REDACTED]

I'm not sure exactly what you mean by "network is down" or "internet is down".  If you mean that occasionally you are unable to browse the internet and your internet service/modem/etc appear to be working, then yeah you might have a problem with your DNS service and might want to analyse your 2003 server event logs.  Problems with both internal and external lookup suggest a DNS problem to me.

It doesn't really explain why disabling shields makes a difference though or why the other server is still reachable.  I think you need to figure out specifically which shield works around the problem (eg firewall) and use that as a point of reference.  Since 2003 server ONLY uses SMB1, it might go towards explaining why the 2012R2 server can still be reached if for some reason the firewall is interfering. 

I'm afraid I am not sure I can help much more, your site configuration might need some attention before trying to fix avast 

[REDACTED]

When I say that the "network is down" and the "internet is down", what I mean is that our ISP will remove our internet connection from their end. So everything on our end is okay but the connection from beyond the ISP is down.

[Eddy]

I have to disable the shield on the client side.

What exact shield do you need to disable ?

[REDACTED]

The only thing I have tried is just disabling "all shields" from the system tray. I have not tried to disable individual shields yet. I will definitely try this during the next outage. It will definitely help pinpoint where the problem lies.

[REDACTED]

I was desperate not finding anybody having the same issue!

Each time the internet goes down (pretty often since our ISP replaced the ADSL modem) some of the users (not always the same) are not able to access the local Windows 2012 R2 server. This after about 5 to 10 min. It takes up to 30 min to solve, or a reboot.

I tried to disable the Avast agents, but without much of success (maybe always after problem appears...)

Avast version: latest of Endpoint Protection Plus

Next test: uninstall Avast and replace it with Windows Defender....