Avast is blocking Sonos from accesing music file

[Craigt]

Avast will not allow Sonos to access music files on my PC.  I get a message saying that Network Shield is blocking ... and includes the address for the Sonos unit.  This problem goes away when I pause Network Shield.  Is there a way to exclude the Sonos address or otherwise solve this problem? 

[DavidR]

What is the URL ?
Check the Network Shield, Customize, Last attacks, you can copy and paste from that window.

When you post please 'modify' change the URL from http to hXXp or www to wXw, to break the link and avoid accidental exposure to suspect sites, thanks.

The Network Shield blocks known malicious sites, so there is something there, that could be that the site has been hacked and trying to load something from a malicious site.

[Craigt]

Here is the address.  Thanks for your help.

01.01.2010  14:44:20  Win32:CVE-2009-3103 [Expl] attack
    from 192.168.1.105:445

[DavidR]

Port 445 is a common attack port and why avast's network shield monitors it, this it trying to take advantage of vulnerabilities (out of date OS, etc.) so that they may be exploited. Though I don't know why it is monitoring the local IPs, it may simply be because the Sonos unit is using port 445 for its access. I don't know if there is a way to change the port number.

See http://www.grc.com/port_445.htm for more general info.

The strange thing about this is that coming from 'your' own network (the address for the Sonos unit) as 192.168.1.105 is a reserved IP for a local network address. Weird that it is detecting the address for the Sonos unit. I have to admit I haven't got a clue what a Sonos unit is.

I don't know if there is a way to exclude that IP address in the Network Shield, in like the Web Shield where there is a specific function in the GUI to exclude. It may be possible to exclude the IP in the avast4.ini file, I haven't done that so I will try and find out if it is possible. In the meantime I would investigate if you can change the communication port from 455 to another.

[Craigt]

The Sonos system wirelessly communicates with my PC to allow me to play music, residing on my PC, in another room.  I have checked the Sonos web site and they specifically show how to exclude the 445 port in other firewall software, but don't say anything about Avast.  It would seem odd that Avast would not have this capability when most other protection software does.

[DavidR]

The problem is avast's network shield isn't a firewall (so doesn't have complex firewall functions/configuration), but does monitor common attack ports, it is more an IDS than a firewall.

[dchmisc]

Back to the original topic - any resolution?  Is there any way to configure Avast to get around the issue? 

Thanks!

[DavidR]

As far as I'm aware, not in the current avast configurations, since there are no setting in the network shield to cater for that. The problem is that the network shield considers it an attack, e.g. Win32:CVE-2009-3103 [Expl] attack.

Try sending an email to virus (at) avast (dot) com, with False Positive - Network Shield in the subject and explain the situation, avast version, etc. in the body of the email. I would also suggest giving the link to this topic and see if there is a way to resolve the detection or a way round it.

What version of avast are you using now 4.8 or 5.0 ?