Webshield connects to amazonaws.com

[Taucher]

 

Hello

I have a problem since everytime my relatively fresh Win7 64bit boots into the desktop I can see that Avast Webshield (I reckon) connects to Amazonaws.com. How can that happen?
I read on the net that someone else noticed this with Avira ?!? So I suppose if you can not tell my that it is  normal I have a data collector on  my system that connects through proxy settings / transparent web shield.

I made a full scan of my hdd with Avast Heuristics on etc., with Malewarebytes and I have installed RegRun and Comodo in order to tighten my OS. Can you help me? How can I check what program is sending TCP/IP through Avast Webshield?

thanks alot

PS:
And please, could it eventually be possible to implement a better way to easiliy check & uncheck certain folders and files from the life scanner?

[Vladimyr]

 
I don't understand what part of avast! Web Shield would be making an IP connection to AWS cloud. Web Shield scans incoming HTTP. Are you sure it's not your "data collector" using AWS?

[DavidR]

The web shield doesn't initiate any connection, it intercepts your browser calls to connect to a site, so that it can scan the downloads before it is saved to your browser cache and displayed on your browser (or run).

[Taucher]

Ok

I think I can follow you. So, all in all the only 'data collector' allowed to make use of Webshield is my browser(s). Mh, however, after booting to desktop there is no browser started. Moreover, there is also no tool running that is allowed to autoupdate as far as I know. The only exception is my backuptool Syncplicity. But I suppose that that one is not going to connect to Amazon Cloud. Especially for I have prohibited any connection to other services from within Syncplicity.

Can you recommend me a tool for hunting down this culprit?

thanks alot

[DavidR]

Some updaters, etc. still use HTTP protocol on port 80 to do their updates, they just don't use your browser.

So it monitors HTTP traffic on port 80, this is normally restricted to known approved browsers to avoid this sort of thing. So I don't know what is going on with your system (I don't use and cloud applications), but what I do know is that the web shield 'doesn't initiate' the connection.

I don't know what your firewall is, as I presume that is where you are getting the data about the amazonaws.com/web shield. The reason I say this is that some firewalls only recognise the proxy and not what is using it.

[Taucher]

Oh,

I use Comodo Firewall and Peerblock. Both give me the information but I can not reckon what program initiated the connections on port 80

[DavidR]

Well comodo isn't one of the firewalls that aren't able to detect what is using the proxy rather than the proxy itself (localhost loopback).

[Taucher]

I see. I switched local loopback messages back on. There were off. Will see what happens. Thanks alot. I am still trying to understand which process is trying outbound and why and where ('d be great to have  a tool that could show me all this.. )

[nmb]

Hello Taucher,

Give this a try : http://www.nirsoft.net/utils/cports.html

I have been using this tool a while, and is good.

Thanks
nmb

[Taucher]

Hi nmb

that helped alot. Actually I had already the Nirtools and could start that tool imediately thanks 'launchy'

The horror scenario was there. Connections to 007guard.com ... And that after I had scanned my hdd with Dr. Web, MaAffee and Avira LiveCD... and of course with my Avast from within Windows 7 since I am not able to initiate a boot scan (it is always greyed out) and with MBAM.

But for this great forum I found http://forum.avast.com/index.php?topic=40574.msg340233 .
And actually I had altered my host file with S&D months ago and 007guard.com was the first 127.0.0.1 entry.

Why the heck my pc wants to connect to this mentioned amazonaws.com I still not know but may be I will hunt this down with the nirtool.

Thanks alot
Taucher