McAfee Firewall blocks update 4.8.1201

[havildar]

Having installed this latest update yesterday, I`ve been having problems with my McAfee Personal Firewall. The slider appears repeatedly saying the Web Scanner has changed since it was last granted access and though granting access is always a one click procedure, this update causes the slider to appear again and again, before finally accepting it.

Again today, I`ve had to fight with the firewall to get it to accept the data base update, even though I listed all of the Avast! applications under "allow full access" yesterday.

Can anybody tell me what`s going on? This issue has not occurred before.

Windows XP Sp 2. McAfee is the firewall only, free with AOL UK.

[DavidR]

Check that the firewall allows avast.setup internet/full access.
- If it does delete the entry for it and do a manual update, this will force the firewall to ask permission again.

Check the C:\Program Files\Alwil Software\Avast4\Setup folder if the avast.setup file exists it is in that folder.

[havildar]

Thanks David,

The folder does exist and all five Avast! permissions are set to "Allow full access" through the firewall. This was the position before, though, when the slider appeared repeatedly three or four times asking if I wanted to block this new Avast! application ... almost as if it didn`t believe that I wanted Avast Web Scanner to have full access. Weird! I`ve never seen it behave like this before.

The misbehaviour has not occurred again to-day, after the data base update I mean, but I`ll see what happens with the next one and post back.

[DavidR]

No problem, you're welcome.

It is not so much that the folder avast4\setup exists, but the file, avast.setup it is only recently that it has become a permanent file, previously it was created for the update and on completion of the update it was removed.

There are times that even when applications are allowed in the permissions, yet the firewall seems to suffer from amnesia about its settings, that is why I suggest deletion if there is no apparent blocking according to the firewall settings.

[Lisandro]

havildar, into the firewall settings, the following programs should be allowed to connect:

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner)
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (avast! e-Mail Scanner Service)
C:\Program Files\Alwil Software\Avast4\Setup\avast.setup (avast! Update executable). This is a temporary file that just appears when an update (check) is about to launch, and disappears again afterwards.

Don't need rights to connect:
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (avast! Update Service)
C:\Program Files\Alwil Software\Avast4\ashServ.exe (avast! antivirus service). Although, ashServ.exe sends ping packets to find out if the Internet connection is alive. You can turn this off by checking the "My computer is permanently connected to the Internet" box in the avast Program Settings > Update (Connections) page.

[havildar]

Thank you Tech,

I been having a careful read of the programs that you listed for me and comparing the permissions listed in my McAfee firewall, in which they apeear like this:

avast! antivirus service            ashServ.exe     Allow full access
avast! antivirus Update            avast.setup     Allow full access
avast! Antivirus updater           ashUpd.exe      Allow full access
avast! e-mail Scanner Service   ashMaiSv.exe   Allow full access
avast! Web Scanner                ashWebSv.exe  Allow full access

I have tried to preserve the  spaces, capital letters and spelling exactly as they appear in my permissions list. There are two differences that I can see. Where you have aswUpdSv.exe I have ashUpd.exe but I don`t know if this is relevant to the problem since you say this one is not needed.

In any event, it`s ashWebSv. exe that the McAfee doesn`t like and persists in asking for permission to allow access, even though it is already allowed and these settings in the firewall have never caused a problem for Avast! before update 4.8.1201.

In addition, I`ve noticed that when I switch to IE 7 (ethernet connection avoiding the AOL software), this failure of the firewall to recognise ashWebSv.exe seems to be particularly bad, by which I mean that I have to grant permission three or four times as the slider persists in returning with the same question, rather like a yo-yo going up and down. I should add that this firewall is not one of those that "forgets" its settings as some firewalls do, I have been told.

Essentially, I`m wondering if there was some modification of ashWebSv. exe in update 4.8.1201 that is upsetting the firewall and whether I should uninstall it, though I`m not sure if I can do that. 

[Lisandro]

ashUpd.exe is the command line updater, but it invokes avast.setup which is what connects the Internet.

Essentially, I`m wondering if there was some modification of ashWebSv. exe in update 4.8.1201 that is upsetting the firewall and whether I should uninstall it, though I`m not sure if I can do that. 

I don't think there was a modification... but for sure you don't have to uninstall it.
If you remove the entry form McAfee and use the Internet, allow access and save the changes, will McAfee work?

[havildar]

Thanks Tech,

I think I may have done something right (for a change), but I`m not quite sure what it was. I ran Ccleaner, then Eusing Registry Cleaner followed by a defrag of C drive using the built-in XP program and then an Avast! Standard Scan of non-removable discs.

This afternoon I have three times switched on IE 7 expecting a fuss from McAfee, but all is quiet and Avast! Web Scanner seems to be running normally.

I note that although McAfee says ashUpd.exe the entry in Task Manager is aswUpdSv.exe and I can`t help but wonder if they are the same thing and if this might have been causing the firewall some confusion. The fact that they are there (listed permissions, I mean, in the firewall) must have been due to Avast! asking for them at some time in the past and in view of recent bizarre behaviour I am reluctant to cancel any of them.

There has been no Avast! update to-day so I don`t really know if my problem has been solved but when it occurs I will post back and let you know one way or the other.

The AOL browser also seems to be working normally with Avast!

[havildar]

Not exactly a new problem but perhaps a variation on a theme. I`ve just had an Avast! update which went smoothly with no protest at all from McAfee; so far so good, but then a new complaint about Avast! Mail Scanner: "McAfee does not recognise this application."

Again, it`s already listed in the firewall permissions and again it required three attempts to convince the firewall that it wasn`t a problem. This is getting to be a little tedious but at least the update and Web Scanner services seem to be accepted now.

[DavidR]

If you continue to get these the best/quickest thing to do is as I said before, delete the entry for the avast provider being blocked and force the firewall to ask again.

Or perhaps it is time to consider a more well behaved firewall.

[havildar]

David,

All seems to be well to-day: a database update, Mail Scanner and Web Scanner all running normally and not a word of protest from McAfee. As far as asking permission again is concerned, I think the re-appearances of the firewall slider have taken care of that several times over.

I was considering another firewall to replace the McAfee (I hear Comodo is pretty good), but in the two years or so I`ve been using McAfee it has saved my bacon on a number of occasions, stopping some real nasties in their tracks. The latest was something called "Fight me bitch, please". I don`t have a clue what that was all about but it doesn`t sound like my sort of thing at all! (No sex please, we`re British.)

In addition, the program gives me direct access to Hackerwatch. org which is McAfee`s database of worldwide nasties and it provides trace maps so you can see where they originated; all of which I find quite interesting, in a perverse sort of way.

Also, despite the bizarre behaviour of the firewall with regard to the 4.8.1201 program update, it has occurred to me that it was doing exactly, if rather irritatingly, what it was designed to do; namely to alert me to small but potentially harmful changes to known applications.

For these reasons, I think I`ll stay with it for a while and post back if things start going arse over elbow again.

[DavidR]

No problem, what you are comfortable with up to a point where it becomes more irritably than comfortable and only you can be the judge of that.