webshield blocking web access

[frozensnack]

Duplicate post here http://forum.avast.com/index.php?topic=54300.0.

Same issue with my Avast 5.0462 install on a clean and fully updated Windows 7 Ultimate 64-bit install.

Start -> Run -> msconfig -> General tab -> Diagnostic startup -> reboot - turns close to everything (services, startups, etc.) off. Made sure Windows Firewall is off. Avast 5.x will run in diagnostic startup.

With Avast Web Shield on - Firefox, Chrome, and IE cannot display web pages. Symptoms may include 1) Firefox "Live HTTP Headers" trace remains blank indicating incoming traffic is blocked from the browser; 2) traffic gets through and results in a "Content Encoding Error" indicating the HTTP stream is corrupt; 3) browser times out; 4) you switch back to version 4.8 and 'call it a day'.

Tweaking Web Shield settings to reduce what is going on makes no difference. Turn off Web Shield and all is well except for the new lack of adequate protection for safe se ..urfing.

Here is the HijackThis log - not much running.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:47 PM, on 03/23/10 Tue
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Programs\Security\Avast\AvastUI.exe
C:\Programs\Network\Mozilla Firefox\firefox.exe
C:\PROGRA~2\Java\jre6\bin\jp2launcher.exe
C:\Program Files (x86)\Java\jre6\bin\java.exe
C:\Programs\Security\Trend Micro HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: LastPass Browser Helper Object - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Programs\Security\LastPass\LPBar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Programs\Security\LastPass\LPBar.dll
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User '?')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User '?')
O4 - S-1-5-21-4089073572-3114201259-81056830-1001 Startup: AutorunsDisabled (User '?')
O4 - Startup: AutorunsDisabled
O8 - Extra context menu item: LastPass - file://C:\Programs\Security\LastPass\context.html?cmd=lastpass
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Programs\Security\LastPass\context.html?cmd=fillforms
O8 - Extra context menu item: Open Client to monitor &1 - C:\Windows\web\AOpenClient.htm
O8 - Extra context menu item: Open Client to monitor &2 - C:\Windows\web\AOpenClient.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Programs\Security\LastPass\LPBar.dll
O13 - Gopher Prefix:
O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B2539E19-32D9-4017-BC69-88F12FC361D6}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programs\Security\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programs\Security\Avast\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programs\Security\Avast\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programs\Security\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

--
End of file - 4331 bytes

I may switch back to the ever reliable Avast 4.8 until the 5.0 Web Shield is fixed. Of the two, 5.x has the really cool GUI, so that is where I need to be. I vaguely remember a rule that in software, version x.1 is the one to get, not x.0 (whether or not it's software you create) - unless you are Google, in which case beta will do.

[Sp00k]

Hi all. Don't know if anyone is still having this issue, but we had exactly the same problem on 2 workstations and fixed it this way:

1. In IE / Firefox etc, enable automatic proxy
2. - In Avast User Interface, click "Settings" (Top right with the spanner icon),
    - Go to "Troubleshooting (on the left column)
    - Expand "Redirect Settings".
       Under "Web" / HTTP port(s):, I had 80.
    - Change this to a different port (for example, I used the default Avast port of 12080
    - Re-open IE or Firefox and (hopefully) you will have Internet access.

I'm not sure why this works. I've checked on computers that have Avast 5 working, and they are set to "80" - and everything still works fine. Either way, it worked for me. Hope it works for someone else as well!

[spg SCOTT]

Sp00k,

This is effectively the same as disabling the web scanning of avast! I wouldn't recommend that.

-Scott-