Web Shield randomly freezing/stalling/hanging HTTP/browsing

[schar07]

I saw some old posting about this with no solutions, so i start a new topic.

XP SP2 latest WU, no other issues at all, latest Kerio/Sunbelt Free FW, latest Avast Home.

A few months ago i started having random issues browsing: IE6, IE7 or FF, all of them can browse OK for some time on any kind of web sites, but all of a sudden the "Waiting for.... reply" appears in status bar and pages freeze/stall. Sometimes F5/refreshing works, sometimes Shift+F5 works, sometimes refreshing can work after a lot of times or after a complete cache emptying and browser close, sometimes it's dead until next reboot.

I also have a Vista inst. (dual boot) with Avast and Windows Vista firewall and it has no problems. But it's not Kerio, read down.

Downloads do work as expected, FTP works as expected: it seems to affect HTTP/Browsing only. Terminating Kerio doesn't help.

I had no ideas left after months of this crazy/random behaviour, but today i terminated (not paused!) Web Shield: the web page immediately starts to download, without having to do anything. Even previewing this post was frozen until i killed Web Shield!

Could u pls help?

Thanks,
Ale

[Lisandro]

But it's not Kerio, read down.
Terminating Kerio doesn't help.

Can you make some tests?
1. Disable the privacy options of Kerio (if you're on the trial period of it). Test.
2. Sorry the silly question, but is ashWebSv.exe allowed to connect (inbound) into Kerio settings? If so, can you delete this entry and wait for Kerio to ask again when you're browsing to allow the WebShield program to connect, allowing it. Will it help?
3. Is there any other security program that could interfere?

[schar07]

Hi TechTM,

1. already disabled (out of trial period already)
2. i have no rule for ashWebSv.exe in Kerio, and i have "Any other application: Internet: In=deny, Out=permit" in Kerio's Network Security - Applications screen: are you suggesting me to create a rule for ashWebSv.exe, incoming, permit all local ports/remote ports/protocols?
3. no.

Thx,
Ale

[Lisandro]

"Any other application: Internet: In=deny, Out=permit" in Kerio's Network Security - Applications screen: are you suggesting me to create a rule for ashWebSv.exe, incoming, permit all local ports/remote ports/protocols?

Yes. ashWebSv.exe works like a local proxy that needs inbound connection: Internet > Kerio > WebShield > Browser.
If you don't allow it, you won't connect, i.e., it won't be allowed to scan the http traffic.

[schar07]

Ok, thx, let me set it that way and use it for a while, then i'll report back.
Ale

[schar07]

Hi,

even after creating the Kerio rule for ashWebSv.exe IN/ALL/ALL (or disabling Kerio) i have the same jerky browsing experience (or non-experience i should say..). And once more, no matter what settings i use for Kerio, disabling the Web Shield makes things go rolling again.

I would need some further help to troubleshoot.. What i did is to enable logging but to my eyes it doesn't show clear issues.

Thx,
Ale

[Dwarden]

i think its some issue with Sunbelt / Kerio PF ... i noticed it too

usual fix is refresh of page (or close/reopen the tab stalling)

[Lisandro]

Are you all using Kerio free?
The privacy features of Kerio could intefere with Webshield, indeed...

[schar07]

Yes Kerio in free mode, with all AD Blocking and Privacy tick boxes unticked (it should not matter since it is already in free mode, but you'll never know..).

However:
- Kerio + Web Shield running: browsing ok
- All of a sudden (random): page locked/stalled
- Exiting Kerio: no change
- Stopping Web Shield: immediate page download without a refresh.

Or:
- Kerio + Web Shield running: browsing ok
- All of a sudden (random): page locked/stalled
- Stopping Web Shield: immediate page download without a refresh.

This looks to me an Avast issue, but if you think it's necessary i'll export Kerio configs and remove from the system.

The frustrating thing is the randomness browsing stops and the randomness of F5/Shift+F5 workaround: it can work once and 30secs later stop working completely.

How can we debug?

Regs

[Lisandro]

How can we debug?

Good question...
Maybe:

1. Here, Lukas shows how to get the ashWebSv.exe dump:
http://forum.avast.com/index.php?topic=27375.msg223114#msg223114

You might want to try running this tool: http://public.avast.com/~rypacek/userdump.exe
When the problem appears please start it with the following command:

userdump ashwebsv.exe

It will create a memory dump of running webshield process (in the file ashwebsv.dmp). Please upload the file to our ftp server (ftp://ftp.avast.com/incoming) and send Lukas a mail about it (rypacek (at) asw.cz).

2. Maybe activate logging in WebShield:
1. Edit <avast>\data\avast4.ini file
2. Find the section [WebScanner]
3. Add the line:
    EnableLogging=1
4. Restart Web Shield in XP (terminate and start again) or whole PC in case of Win98
5. Browse (trying to access some webpages)

The log file are <avast>\data\log\ashwebsv.log and ashwebsv.ws.
They would be accessible when WebShield is terminated again.
Post them here or send by mail to rypacek (at) asw.cz
After that, disable the logging to avoid a big log file.

[schar07]

OK,

AshWebSv doesn't crash, so no post mortem reports like in that thread.

I've uploaded a zip with two stall/freeze episodes to your ftp server (schar07 AshWebSv Dumps-Logs 070923.zip) and sent an email to Lukor. 1st episode happened with 1st web site request, Google :-), the 2nd after a good while. Using IE7 latest WU with Kerio Sunbelt Free latest running.

Not much i can see from logs: .ws is always empty, while 1st .log is:
9/23/2007 10:31:53 AM,"http://www.google.com/","","GET",HTTP Status: -1,0,0,0,483,483,0,\Device\HarddiskVolume1\Program Files\Internet Explorer\iexplore.exe,PID: 3620,CON: 127.0.0.1:12080->127.0.0.1:1075 <--> 192.168.1.2:1076->209.85.129.99:80,SEQ: 1

Thanks

[epu]

I'm also experiencing this with similar configuration. Current workaround is disabling web shield. Interested in outcome.

[silver122003]

Hi, I've also the same problem.
I have had a similar configuration on a pc based on an athlon Xp+ 1700 / 512meg
(kerio free + avast free) for several years without any problem, also installed the same combination on
other computers and never a problem.

Recently i've upgraded to an amd64 x2 (and the same is happening to a friend who also have a similar pc with a amd64x2) and I am experiencing this problem.
The browsing works fine then suddenly new pages are not opened or do not finish to load with the round icon in firefox that doesn't stop
to roll. Also sometime the page is loaded but is rendered as text and i see the GET message and than the source of the page.
I've already tried to:
-disable kerio
-delete and recreate webshield rule for kerio
-disabled the redirect on port 80 and configured the browser to use webshield as a proxy
-enabled / disabled power management

As soon the web shield is stopped (not paused) the browsing works fine.

[Lisandro]

As soon the web shield is stopped (not paused) the browsing works fine.

I'm also experiencing this with similar configuration. Current workaround is disabling web shield. Interested in outcome.

And what about if you uninstall Kerio? Maybe disable is not enough. And try.
Seems that something could be weird in latests avast and Kerio installations...

[silver122003]

And what about if you uninstall Kerio? Maybe disable is not enough. And try.
Seems that something could be weird in latests avast and Kerio installations...

not tried to uninstall but disabled the service with ( net.exe stop SPF4 ) and not simply disabled the firewall
with its own disable feature, winxp issued a warning saying "you are without firewall!!" and same thing happens.
I'll try to uninstall and let you know.

It is more likely to trigger the problem opening a lot of pages (10 - 15 ) simultaneously

As stated before i have other computers with same installation /combination of softwares and everything is fine