avast! On-Access Scanner blocking downloads?

[ChampionHyena]

For the past week or so, I've been having mystifying problems. If I download larger files or try to stream content (such as streaming video or internet radio), my downloads will freeze suddenly. No error messages, but the ETA will cease to count down, and the transfer rate will not vary as it usually does. It doesn't matter what browser I use, the problem is always the same. I even reformatted my hard drive and reinstalled Windows XP trying to resolve it, but to no avail. Thinking it was a software problem, I started disabling/uninstalling various programs such as firewalls, monitoring programs, et cetera. I finally had a solution when I disabled avast! On-Access Scanner, and I was able to download files and stream content again. I'm running ZoneAlarm, and I recall prior versions of avast! warning me upon installation that there was a conflict between the On-Access Scanner's Web Shield and ZoneAlarm (though my most recent installations and reinstallations never gave this warning), so I disabled the Web Shield on its own, but I still had the same problem. I don't want to go without protection, but some aspect of the avast! On-Access Scanner is keeping me from downloading much of anything! Does anyone know what's wrong?

[Lisandro]

I even reformatted my hard drive and reinstalled Windows XP trying to resolve it, but to no avail.

Wow... deep indeed.

I recall prior versions of avast! warning me upon installation that there was a conflict between the On-Access Scanner's Web Shield and ZoneAlarm (though my most recent installations and reinstallations never gave this warning), so I disabled the Web Shield on its own, but I still had the same problem.

ZoneAlarm free does not conflict with avast. When using the ZA Pro version you need to disable the privacy features.

I don't want to go without protection, but some aspect of the avast! On-Access Scanner is keeping me from downloading much of anything! Does anyone know what's wrong?

Is there any other antivirus installed in this computer? Does it have in the past (after reformating)?
If you remove ZA, will the problem still be there, I mean, using only avast without the firewall?

[DavidR]

What you are experiencing isn't what I would call avast blocking, firstly it doesn't block but scans content and alerts to infected content.

You don't say if you are using the Pro version of ZA as the conflict is in the ZA Privacy settings, that however is usually only seen when logging in to say hotmail or yahoo or pages where you enter your user name, etc. and it then validates that on a secure page (https) and then continues, usually on an http page.

The later versions of avast are more discerning and don't pop-up the alert if you have the ZA free version without the Privacy function.

When you talk of disabling web shield there are two options, Pause and Terminate, no disabled. If you pause the web shield traffic still flows through the proxy but it isn't scanned. Which did you choose ?

[ChampionHyena]

If you remove ZA, will the problem still be there, I mean, using only avast without the firewall?

Yes. ZoneAlarm seemed the most likely culprit considering my symptoms. I disabled it at first, and when that didn't work, I uninstalled it completely. Didn't help.

You don't say if you are using the Pro version of ZA as the conflict is in the ZA Privacy settings, that however is usually only seen when logging in to say hotmail or yahoo or pages where you enter your user name, etc. and it then validates that on a secure page (https) and then continues, usually on an http page.

I'm using the free version of ZoneAlarm, not the Pro version. I only brought up the idea of a conflict since avast! mentioned one in the past.

When you talk of disabling web shield there are two options, Pause and Terminate, no disabled. If you pause the web shield traffic still flows through the proxy but it isn't scanned. Which did you choose ?

At first, I tried pause, but the problem persisted. Then I shut the Web Shield off completely, and it still didn't seem to help. The only thing that does help is completely disabling all On-Access Scanner providers. Could another provider be the issue? In any event, I find myself having to shut off resident protection every time I want to download or stream something, and that leaves me feeling profoundly unsafe.

[DavidR]

That is why I said I didn't think it was a conflict between ZA and web shield as there shouldn't be any start stop effect, it should either work or not.

You could try terminating the network shield, but that shouldn't have any impact as it is only monitoring common routes of malware entry.

I don't see how anything else other than the standard shield could have any interaction and that should only happen when a file is completely downloaded and streaming only downloads part of the file to get it running and the buffer is constantly topped up.

When this happens, check windows task manager and see if one process is using all the CPU % ?
Is the avast icon rotating when this happens ?
What other security software do you have ?

[ChampionHyena]

When this happens, check windows task manager and see if one process is using all the CPU % ?

No. All the CPU usage is filed under System Idle Process.

Is the avast icon rotating when this happens ?

Intermittently. As a matter of fact, the avast! icon rotates every now and again pretty much all the time.

What other security software do you have ?

I have Ad-Aware, WinPatrol, ZoneAlarm (obviously), and HijackThis.

[DavidR]

1. I was hoping there might be a culprit effectively taking all the system resources, unfortunately no help there as the System Idle Process just indicates the amount available to use.

2. It isn't unusual for it to rotate on a regular basis as this indicates it is scanning files. If it were rotating for very long periods continuously it may be suspicious of activity you aren't aware of. If it were the CUP% used by ashServ.exe would also be high.

3. AdAware should have no impact, HijackThis, zero impact as it is only active when you run the scan. Winpatrol possibly, but again that should show up in the CPU usage if it was an issue.

Zone alarm quite possibly as it could be blocking and that wouldn't show up in CPU usage. It is years (over 4) since I used ZA so check if there are any logs when this happens to indicate blocking.

You could try another firewall, a lot of the forum members are using comodo firewall, download and save to your HDD first, uninstall ZA, boot, install comodo firewall. The comodo firewall does better in firewall leak test than ZA free.

[rhuds13]

Also which version of ZA are you using?  The most stable was 65.737 before they started using KAV. Now even the free ZA has KAV even though not active will interfere with some other AV's. That was main reason I switched over to COMODO and all is running great. Just a thought.

[ChampionHyena]

Sorry for the long absence. My sound card suffered a mysterious fault, rendering the system unusable for weeks before I identified the problem. So I replaced it, restored my installation, reinstalled drivers, and everything started working again.

Well, except my mysterious spontaneous crashes. And my avast! weirdness.

DavidR, rhuds13... I'd try another firewall, but disabling and uninstalling ZoneAlarm did nothing to alleviate the problem. I don't see why installing a different one in its place is going to help.

No, the problem is avast!... or some other program that it's conflicting with that I haven't considered yet. The thing is, it's only been doing this for, say, a month. And my laptop, which shares my desktop's security setup (ZA, avast!, WinPatrol, HijackThis, Ad-Aware, etc. etc.) does not have any of these issues.

Is there a log file that I should be reading or posting? Anything that would help?

[philop901]

I am facing the exact same problem too. I was doing some random disabling of services in the on-access scanner thingy and found out that if you disable internet mail and web shield at the same time but leave all the other options on, the streaming and downloading problems seems to go away. puzzling...

sorry if I posted in an old thread 

[DavidR]

The internet mail provider should have zero impact on web browsing/streaming as it only monitors email protocols, pop3, smtp, imap or nntp on ports 10, 25, 143, 119. The web shield with its proxy filters http port 80 traffic, so terminating this should be enough, if it isn't and you have to disable the Internet mail provider you have something very strange going on in your system.

[philop901]

I think so too. I tried disabling just webshield only and still no luck. Just a little info on my machine. It has just been reformatted many times to solve the problem but to no avail, so the only security software I am running are Avast and zonealarm (free). There aren't any software other than those I mention in it because it was just reformatted. I tried disabling or even uninstalling zonealarm too but the problem presist. The internet runs fine in "safe mode with networking".

[DavidR]

When you say disabling, that is neither Pause or Terminate, Pause still uses the web shield proxy, it doesn't scan. Terminate stops the provider and the proxy isn't used, so if you meant Terminate rather than Pause then that should have been fine.

If you really mean safe mode then it is little wonder that things work as for a start avast doesn't run in safe mode, leaving you vulnerable.

What browser are you using and have you tried using a different browser ?

Have you tried manually setting your browser to use the web shield proxy ?
For IE - broadband users: - Tutorial - Web Shield Proxy Set-up for IE
For IE - dialup users - Tutorial - Web Shield Proxy Set-up for IE (Dial-up)
For Firefox users - Tutorial - Web Shield Proxy Set-up for Firefox

[philop901]

Yep, I meant I terminated it. I terminated the web shield module but it still does not work. It only works when I terminate all the modules or I just terminate internet mail and web shield together only.

I did tried doing the proxy thing through the internet settings and it too does not work.

I have tried other browsers like Opera but to no avail. I have not tried Firefox though.

I think it has to do with my motherboard since I got it to replace my old one. it has been like that even after many reformats. It's a via chipset make...

[DavidR]

I don't know about via chipset being an issue, but if you have an Gigabyte MB ?
I think is comes with a built-in firewall ActiveArmour thiugh that I would think would be a Nvidia nForce4 chipset.