Avast blocking Web Access (http)

[AlbertaBob]

Hi,

I work as an IT Consultant.  My employeer is an Avast reseller, so believe me when I say I love the product. But I'm having a problem with it on my laptop.

The Web Shield keeps blocking my web access.  I can still ping my target site, like google, but I can't get there with any browser unless I stop the web shield service.  I do not have a firewall on my laptop, and the built-in windows firewall is disabled at the service level.  Before anybody asks, I'm never plugged in anywhere that doesn't have a router or other firewall protecting the whole network, so don't worry about my iSafety   Anyways, has anyone had similar problems?  Anyone have any advice for me on how to troubleshoot this?

Thanks,

[DavidR]

The Web Shield keeps blocking my web access.

Are there any errors displayed in this supposed blocking ?
As far as I'm aware the ping uses a different port so shouldn't be monitored.

avast! isn't geared up to block (unless you have some URLs set up in Web Shield, Customize, URL Blocking ?), just monitor http traffic and alert if infection found. When this occurs it is usually a firewall blocking ashWebSv.exe (I know you have that disabled) or a conflict with another security program. So as you say you are never plugged in anywhere that hasn't got a router or firewall, is there any possibility that they are blocking ashwebsv.exe ?

What other security based software do you have that might block or interact with ashwebsv.exe ?

Can you give an example of a couple of URLs ?

[AlbertaBob]

Thanks for giving me a hand with this.

No, there are no errors.  I have no other "security software" on this laptop.  No virus' or malware of any kind either.

Yes, ping is different, that's why I mentioned it.  It doesn't look like a system-wide problem, an obvious router problem, or a DNS problem.  It's only a problem with HTTP traffic.  And shutting down the web shield completely resolves it instantly, every time.

I don't have any reason to believe it's a problem with the network routers/firewalls.  I've experienced this at a dozen different sites, including at home with 3 different routers that I'm positive weren't blocking anything outbound.

Example URL's: google.*, telus.com, msn.com.

[DavidR]

I have no problem with any of those with web shield enabled and outpost pro firewall.

What OS are you running on your laptop ?
What browser are you using (I use firefox as default) have you tried an alternate ?

I'm at a loss as to what might be interacting to cause this as the web shield shouldn't block.

Try a repair of avast. Add Remove programs, select 'avast! Anti-Virus,' click the Change/Remove button and scroll down to Repair, click next and follow. You need to be on-line to do this, I doubt this will resolve it, but it is an easy option to try first.
If that doesn't work try, uninstall, reboot, install, reboot.
It would probably be best to download the latest version of avast and save it to your HDD, somewhere you can find it again. Use that when you reinstall.

[AlbertaBob]

XP Pro, on a domain.  FF and IE (problem spans across both). 

[DavidR]

If you try the repair or reinstall and see how that goes, in the mean time I hope that one of the Alwil team will pick up on this.

[starfish1]

This sounds very similar to a problem that has been sending me batty for the last few days.
have a look and see if you have  the following event in your event log (eventvwr.msc)/system
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.
tcpip event id 4226

sp2 changed the way that waiting connections were handled previously they were unlimited but were changed to 10 connections per second.
it appears that this is to stop trojans etc flooding the network.
however it seems that the actual effect is to block browsing connections once 10 is reached.

this is a screen dump of netstat -o
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0
 sl505.avast.com:http   CLOSE_WAIT      227
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0
 sl505.avast.com:http   CLOSE_WAIT      227
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0
 65.119.248.39:http     TIME_WAIT       0

the 65.119.248.39  address seems to be related to the ash web service.

there is a patch for this if you google the error message, that appears to have solved my problem, but as you can understand I cannot post it in case it turns out to be not correct .maybe avast can advise?
good luck

[roddy]

Very similar to my situation - I have been having problems getting finance.yahoo.com to show my portfolios in their MarketTracker. I can see real-time quotes in the ordinary pages at finance.yahoo, but no portfolios appear im MarketTracker. I was in the process of complaining to Yahoo (since its a paid service) when I thought to disable the Web Shield  provider in Avast Home Edition.

Eureka! problem dissappears immediately.

Is there some way to specify sites not to block - or even not to check

rgds

[DavidR]

@ starfish1
Since AlbertaBob is reporting no errors displayed I would think it isn't the concurrent TCP connection limit.

@ roddy
You don't mention anything about your system and especially if you have a firewall and if so what ?
I would assume that finance.yahoo is an https (secure) page or logon ?
If so avast doesn't monitor https content, if you first use an http page to logon then it switches to an https page for validation and possibly back to http. This flop flopping between normal and secure pages can cause issues with some firewalls with privacy settings, namely ZA Pro.

[starfish1]

thanks davidr
just thought i would mention it as it does not show an error only appears as a message in event log.
hope it helps some though as I would hate to disable such a useful feature of avast.
good luck starfish.

[DavidR]

Thanks for the input the suggestion is worth checking at this point in time, I as an avast user have never experienced this.

Welcome to the forums.

[AlbertaBob]

Nope, no related errors in any of the event logs.  This is definetly not a problem with max TCP connections.  When I fire up a browser it resolves the name of the site and displays it, and the meta description, but not the content.  It does look like some .net top level domains do work though!  Url blocking is disabled in my avast client and it is not a managed client.

I just did a full re-install with a fresh download off the avast site, but it didn't help.

[lukor]

roddy,
your problem seems to be completely different in nature. Streaming applications usually abuse HTTP port to establish two-way communication that does not fully fulfills the HTTP protocol. Web proxies such as webshield might have problems with them. Usually this is originated in some java applet in your browser that bypasses Proxies, but as WebShield redirects automatically all connections from Internet Explorer (and the Java applet is hosted in iexplore) and there we start to have the problem.

Surely disabling webshield helps, but it would also be enough to ignore the specific streaming servers from WebShield's redirect.

Open the Market Tracker, let it connect and start displaying the real-time quotes, than run netstat or TcpView and see what IP addresses is the Media Tracker window connected to. Then - add those IPs to the "Ignored addresses" box in the Basic tab of WebShield config. That should help.

[lukor]

AlbertaBob,
can we try to temporarily disable the avast scanning plugin from the WebShield proxy. That will help us identify where the problem resides. You can do that by editing the avast4.ini

In the section [WebScanner]
change the line

LoadIsapiFilters=1

to
LoadIsapiFilters=0

and restart the "avast! Web Scanner" service.

Second diagnostic try might be to configure the browser to use the webshield proxy directly - that is to setup the proxy in IE to be: 127.0.0.1, port: 12080.

Can you report if anything has changed?
Thanks,
Lukas.

[AlbertaBob]

The proxy thing worked for 1 site, and then it went back to blocking everything, including that one site that worked 1 time.

Changing the INI appears to have worked.  But how is this any better than just shutting off the web shield service?