AshWebSv.exe

[east yorkie]

Earlier today my system (Windows XP Home SP2) froze after I could not get any response I blocked all internet traffic using my Zone Alarm firewall, after doing this everthing returned to normal so I checked the ZA log before reconnecting to the Internet and noticed that AshWebSv.exe had been blocked several times from making a connection to a destination dns given as ig.insightgrit.com.  This address is listed in my hosts file so I can't understand why AshWebSv.exe would be wanting to contact it.  I have run several malware scans and all is clear so I am assuming that AshWebSv is the legit Avast program.     Any advice/clarification would be most welcome.

[DavidR]

ashWebSv.exe couldn't give a stuff for the location, it doesn't originate the connection.

The ashWebSv.exe is the web shield localhost proxy, all http port 80 traffic is redirected through the proxy so it can be scanned, so something else is initiating the connection, possibly a dns check. When you click on a link to a new web domain location your browser requires the IP address it gets that from the dns server of your ISP. You have to determine what is initiating the request.

Ensure that ashWebSv.exe is allowed internet access in ZA (what version are you using ZA Pro or Free ?).

[east yorkie]

I am grateful for your reply I had never seen an entry such as that and wrongly assumed that AshWebSv.exe was initiating the request.  What ever was can't make contact as it is listed in the hosts file. I have the free version of ZA (the Pro-version was too bloated for me and slowed down my system) AshWebSv.exe has access to both Trusted and Internet but not server rights.

[DavidR]

I don't no if it needs that, perhaps not if it is working other than these blocked entries you mention.

I don't know why you might have this in your HOSTS file ?
Did you put it there and is there anything else in the HOSTS file ?

I fear the latest version of ZA free is bloated as well 35MB download with lots of trial ware which could cause issues if the AV element is active. Allied to that and the free version is crippled as far as protection goes, I would look at a different firewall.

Zone Alarm free works fine with avast and has a reasonably friendly user interface, however, the free version is becoming bloated with trial ware and is also crippled as far as outbound protection goes In the Program Control, configuration area, the slider will only goes as far as Medium protection, if you want more you have to buy the Pro version.

Check out the performance of ZA Free in this leak test review, http://www.matousec.com/projects/windows-personal-firewall-analysis/leak-tests-results.php later set of results.

[east yorkie]

Hi, No I didn't put that entry in the hosts file, I subscribe to a secure mailing list for notification of hosts updates.

I tried the pro version of Zone Alarm but as you say it's bloated and hogs the system resources.  Thanks for the link to the leak test review I will certainly be having a look at that in due course.  Regards.

[DavidR]

Your welcome.

[east yorkie]

Having ran the Shields UP! tests and looked at the leak test results in the link you gave me I decided to remove the ZA firewall and have installed Comodo Pro.  The installation went very well and it has no conflicts with Avast or any other of my software as far as I can tell.  I have just run through all the Shields UP! tests again and all results were excellent.

Thanks for your help David things turned out better then I could have hoped for. 

[DavidR]

No problem, in the early days with comodo you might get a lot of decision pop-ups, this does get less over time but it is also possible to lower the sensitivity and reduce what you get notified about. I can't recall where that is as I don't use comodo firewall.

[east yorkie]

I am finding my way around it and this new version is apparently a lot easier to set up.  As I say it works well with Avast which was my main concern.  Thanks once again.