Author Topic: Do I need to set-up Comodo Firewall to recognize Avast?  (Read 9130 times)

0 Members and 1 Guest are viewing this topic.

Will91

  • Guest
Do I need to set-up Comodo Firewall to recognize Avast?
« on: March 28, 2007, 06:47:24 AM »
Hi all

After some advice from this forum, I am going to give Comodo 2.4 firewall a try.  Every evening when I connect to the internet, I would always get a pop up message from Avast telling me the antivirus data base has been updated on my pc.  Tonight after installing Comodo, I didn't get that message.  When I right clicked on the "a" ball and manually tried to update, nothing happened.  I stopped Comodo, turned on Windows XP firewall (for at least some protection), and now right clicking to check for updates behaves properly (connects to Avast, checks, and tells me everything is up to date.).

Do I need to configure Comodo somehow to make it compatible with Avast?

Also, as soon as I started my ISP, I immediately got two messages whether to allow svchost.exe and IPClient.exe applications.  Comodo did not say whether they were "safe" or not but just gave some explanations as to what they might be.  It seemed they were coming from Earthlink so I said "allow".  Are these safe applications?

Thank you.

Offline oldman

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4142
  • Some days..... MOS...this bug's for you
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #1 on: March 28, 2007, 07:48:48 AM »
Yes.

Needs access..avast.setup, ashwebsv.exe and ashmaisv.exe

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #2 on: March 28, 2007, 03:03:52 PM »
svchost.exe is a Windows file that must be running in all Windows.
But, where is it located? (If you have allowed it, maybe into Applications folder of Comodo you can get the full path, I can't remember and, right now, I'm in a computer without Comodo).
If svchost.exe is not on the default path, it could be a virus.

For me, IPClient.exe is unknown (probably not a good application, but I can't be sure).
Did you run a full avast scanning in your computer?
The best things in life are free.

Will91

  • Guest
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #3 on: March 28, 2007, 11:48:18 PM »
Thanks.

Where in Comodo should I add the three Avast files?

timcan

  • Guest
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #4 on: March 29, 2007, 12:17:07 AM »
Thanks.

Where in Comodo should I add the three Avast files?

Hi, you would add them to the application monitor.
It's been awhile since I've used avast and comodo but you should have got popups from comodo.Did you do a system reboot after installing comodo? Seems I remember it took a reboot to get all the avast rules in comodo. Hope this helps.

mauserme

  • Guest
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #5 on: March 29, 2007, 01:26:40 AM »
Do I need to configure Comodo somehow to make it compatible with Avast?
The easiest way, imo, is to invoke a manual avast! update and, when the firewall reacts to it, check Remember this action, then allow.  Do the same with the Web Shield when you open your browser and you won't be bothered again until there is an avast! program update.  Then just repeat the process.

In Windows XP svchost.exe should be located in C:\windows\system32\ and it's normal for it to sometimes want an internet connection.  Its responsible for running any number of services - including things like time synch which explains the internet connection.  Just make sure the path is correct and there are no tricky letter transpositions in the file name (like scvhost.exe instead of svchost.exe or a zero where the alpha "O" should be).  I would not give this unlimited access, however.

IPClient is some sort of Verizon dignostic tool so if you can reasonably account for its presence on your computer its probably OK.  If you don't have Verizon it could need more investigation.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #6 on: March 29, 2007, 04:26:06 AM »
The easiest way, imo, is to invoke a manual avast! update
Yes, anyway the files could be added...

Into the firewall settings, the following programs should be allowed to connect:

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner Service)
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (avast! Update executable). This is a temporary file that just appears when an update (check) is about to launch, and disappears again afterwards.

Don't need rights to connect:
C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service)
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)
The best things in life are free.

Will91

  • Guest
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #7 on: March 29, 2007, 06:04:10 AM »
Thank you everyone for all the great help.  I'm not sure how "user friendly" Comodo is going to be for me but I'm willing to try it a bit more.

I copied down the contents of some pop-up windows that Comodo presents immediately after my dial-up ISP (Earthlink) connects to the internet.  I would appreciate some advice as to whether these look like they should be "accepted" or "denied"....

1) Generic host process for Win32 services is trying to connect to the internet.  What would you like to do?
Application: svchost.exe
Remote IP (address shown here that varies) port upnp mcast
Parent services.exe
Security Considerations: C:\programs files\earthlink Total access\taskpanl.exe has tried to use svchost.exe through OLE automation which can be used to hijack other applications.  Taskpanl.exe might be using svchost.exe to connect to the internet.

2) Generic host process for Win32 services is trying to act as a server.  What would you like to do?
Application: svchost.exe
Remote IP (address shown here that varies) port upnp mcast
Parent services.exe
Security Considerations: C:\programs files\earthlink Total access\taskpanl.exe has tried to use svchost.exe through OLE automation which can be used to hijack other applications.  Taskpanl.exe might be using svchost.exe to connect to the internet.

3) IP session statistics is trying to connect to the internet what would you like to do?
Application IPClient.exe
Remote IP (address shown here that varies) port DNS (number shown here) - UDP
Parent (Earthlink symbol shown here) taskpanl.exe
Security Considerations: IPClient.exe is an invisible application.  Invisible applications connecting to the internet could be a sign of trojan/spyware/virus activity.  Taskpanl.exe might be using IPClient.exe to connect to the internet.

4) IP session statistics is trying to connect to the internet what would you like to do?
Application IPClient.exe
Remote IP (address shown here that varies) port DNS (number shown here) - TCP
Parent (Earthlink symbol shown here) taskpanl.exe
Security Considerations: IPClient.exe is an invisible application.  Invisible applications connecting to the internet could be a sign of trojan/spyware/virus activity.  Taskpanl.exe might be using IPClient.exe to connect to the internet.
 

5) Taskpanl.exe is trying to connect to the internet what would you like to do
Application (Earthlink symbol) taskpanl.exe
Remote IP (address shown here that can vary) port: dns(number shown here) - UDP
Security Considerations: No advice available for this alert.

6) Dell Support is trying to connect to the internet what would you like to do?
Application (Dell "E" symbol) DSAgnt.exe 
Remote IP (address shown here) port (number shown here) TCP
Security Considerations: No advice available for this alert

7) Elink.Acc.exe is trying to act as a server what would you like to do?
(alternatively displayed as "Elink.Acc.exe is trying to connect to the internet".
Application (big "A" symbol) Elink.Acc.exe
Remote IP (address shown here) port (number shown here) TCP
Parent (Earthlink symbol) taskpanl.exe
Security Considerations: Elink.Acc.exe is an invisible application connecting to the internet could be a sign of trojan/spyware/virus activity.  Taskpanl.exe might be using Elink.Acc.exe to connect to the internet.

--------------------


Finally, two other questions:
A) I located the IPClient.exe file under my Earthlink folder and ALSO in a folder called C:/windows/prefetch (listed as a PF file under "type").  Does this sound legit??  I right clicked on the file and tried to use the "scan with Avast" feature but an Avast message popped up and disappeared so fast I couldn't read it.  I had to click on the "a" ball, start Avast, and then only selected the folder.  No virus was detected.
B) Under the Comodo Traffic, Applications, it shows 99-100% ashWvSv.exe running.  This is just Avast running all its protection components, right?

I really appreciate the continued help!

PS Recent SuperAntiSpyware and Avast thorough scans show my system as clean.
« Last Edit: March 29, 2007, 06:46:15 AM by Will91 »

mauserme

  • Guest
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #8 on: March 29, 2007, 06:59:14 AM »
I would take the analysis a little different direction and see if you even need those services.

For example, taskpanl.exe (Earthlink Total Access) looks like it adds some internet tools but it isn't necessary in order to get on line

http://www.earthlink.net/about/press/pr_ta2003_debuts/

If you want those tools allow #1 and #2, but if you don't need those things I would probably disable it if that's possible.

IPClient.exe is a monitor used by Verizon DSL (and maybe Earthink) and is not necessary.  I would find a way to disable it if possible and block it if it can't be disabled.  Its not malicious - just not useful.

DSAgnt.exe  is a Dell update/service tool so if you're on a Dell computer this isn't suspicious but its probably not necessary to have it running every startup either.  You could probably disable with WinPatrol.

I'm not finding anything at all about Elink.Acc.exe so if you're suspicious of it you could upload to Virus Total just to double check it.  But since its called by taskpanl.exe its probably OK.

If you do decide to disable some of those things try disabling them one by one. Sometimes when you stop things from loading you get unexpected results (like no internet connection at all).  If this happens and you've made only one change its easy to go back and reverse it.

The prefetch files are there to help Windows load programs faster.  Its OK to find IPClient.exe in there.

Quote
B) Under the Comodo Traffic, Applications, it shows 99-100% ashWvSv.exe running
If it reads ashWebSv.exe its OK as long as you actively browsing.

Quote
I'm not sure how "user friendly" Comodo is going to be for me but I'm willing to try it a bit more.
Hang in there.  The pop ups will stop in a day or so after Comodo learns about your applications.  Then you'll hardly know its there.
« Last Edit: March 29, 2007, 07:08:46 AM by mauserme »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #9 on: March 29, 2007, 01:57:21 PM »
If you uninstall Earthlink Total Access, will all the other messages disappear? I think so...
The best things in life are free.

Will91

  • Guest
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #10 on: March 29, 2007, 06:28:18 PM »
Thanks for taking the time to actually research answers to my recent questions.  I also appreciate the encouragement!

When someone has a chance, could they address my question regarding my experience when right clicking an individual file and then selecting "scan with Avast"?  I have pasted this question from my post above. Why didn't the Avast results remain on the screen long enough to read?..........

  I right clicked on the file and tried to use the "scan with Avast" feature but an Avast message popped up and disappeared so fast I couldn't read it.  I had to click on the "a" ball, start Avast, and then only selected the folder. 

mauserme

  • Guest
Re: Do I need to set-up Comodo Firewall to recognize Avast?
« Reply #11 on: March 29, 2007, 07:16:31 PM »
Right click the a-icon, then click Program Settings.  In the window that opens put a check mark next to Show Results of Explorer Extension (I prefer it this way too  :) )