Firewall Bug? Please Help.

[Charyb-0]

I purchased AIS approximately 2 weeks ago. Since then I have performed a clean uninstall and install 4 times. I have completed thorough scans with MBAM and Avast and neither show any malware. In fact I have never had any malware on this computer. I finally noticed that it was something that I have been doing and I hope it can be duplicated by others. At first I was running the firewall in auto mode. But then I switched it to "ask". When a pop-up would ask I would allow access to the programs that I know are safe. It has run perfect for the last week until I went in and deleted all the programs that were allowed by the firewall and then started Internet Explorer. This is where the problems start. Seems just as bad as malware. Allowed access to internet explorer. Then no internet access. Restarted system and Avast would not restart. Tried to open task manager and services they both froze up. Clicked on Avast shortcut and more freezing. Any help would be appreciated because I'm getting frustrated with having to uninstall/reinstall whenever I delete allowed programs in the firewall. Maybe someone can try to duplicate this on their system to see if it is a program bug? Sorry this is lengthy but I'm not sure how to shorten it and get the point across.
Thanks in advance for the help.

[Hermite15]

I think you might have deleted group of rules prior to deleting the rules themselves; been told there was a security against this now bit I didn't check. If it's not that, as you're saying that you deleted many application rules, you may have deleted several system rules that are mandatory for the OS to run properly. I did that mistake once, hoping they would be re-created again after the next reboot but guess what they were not... and the system hanged completely. Had to uninstall AIS in safe mode and then re-install it completely.

[Charyb-0]

Sounds very familiar!
I deleted individual rules and then groups. It won't let me delete a group until the individual rules were gone. I wasn't sure if it was caused by deleting the Avast rules only or the system rules or both. I'm not going to test this because I am done with the uninstall/reinstall process. Very frustrating. 6 times total and 2 just recently now because I was trying to figure out which deleted rule was causing the problems. I was thinking that maybe the Avast rules were not recreated the same using "ask" mode as they are in "autodecide" mode. I don't know because I am no expert. I don't know if you consider this a bug or not but I do. I have spent a lot of time trying to figure out what has been happening. I think Avast should look into this and repair the problem. I will no longer be deleting any application rules until someone posts which rule or set of rules it is and why it is happening. And I have not tested to see if switching back to autodecide would fix things after the problem has already occured.

[Hermite15]

if you're not prompted (on "ask" mode) to allow system rules or any other rule after deleting them manually, then yes that's a bug, and a huge one. As said, AFAIC, I've only seen this happen with Windows system rules (and may be Avast rules too...), not with anything else, MS or non-MS apps.

[Charyb-0]

If there is no prompt (in ask mode) and should be one then it would be impossible for me to even know. And like you said that would be huge. And, a standard user like myself should never be able to delete any rule that is required for Avast and Windows to operate properly (they should probably warn before deleting or hide these from the average user). If I wasn't so persisent this program would have been long gone after what has been happening. I'm not going to submit a ticket on this because 1)I have spent too much time on it and am thoroughly frustrated, 2)I don't know enough about it, 3)Hopefully someone from Avast will read this or be directed to it.

Thanks for your help. I appreciate it.
Logos, I have no idea how to direct the Avast team to this. If you know how to would you please notify them? Thanks.

[Hermite15]

If there is no prompt (in ask mode) and should be one then it would be impossible for me to even know. And like you said that would be huge. And, a standard user like myself should never be able to delete any rule that is required for Avast and Windows to operate properly (they should probably just hide these from the average user). If I wasn't so persisent this program would have been long gone after what has been happening. I'm not going to submit a ticket on this because 1)I have spent too much time on it and am thoroughly frustrated, 2)I don't know enough about it, 3)Hopefully someone from Avast will read this or be directed to it.

Thanks for your help. I appreciate it.
Logos, I have no idea how to direct the Avast team to this. If you know how to would you please notify them? Thanks.

you can pm the Avast team guy responsible for the firewall, his name is "Lukor" (don't forget to give him the link to your post here). I think the problem is also that some rules, mainly Windows system rules that need to be allowed, up and running at boot time, cannot obviously rely on ask mode, meaning that you should never reboot on "ask mode" if by accident you deleted some of these rules.

[Charyb-0]

"You are not allowed to send personal messages."
Being new on the forum I must not be worthy. lol
I will find another way.

If the Windows system rules are required at start-up, then why is Avast allowing them to be deleted? I have no idea on how things are intended to operate so I can't really argue anything. If Avast "breaks" because of this then to me, it is a programming error that needs fixed. Another detail that I left out is after deleting all of the Avast rules, then trying to delete the Avast group it would not let me. It displayed a message that the group was not empty. It only happened one time that I can recall and that is why I was wondering if it was an Avast rule causing problems.
Thank you for your help.

[Hermite15]

okay, sorry about that you need 20 posts I'll pm Lukor.

[Charyb-0]

I have done another test. It is the Avast rules. There are 3 rules automatically created when installing Avast. I deleted all three. I ran Internet Explorer and had no internet access. In firewall expert setting I allowed all and had Internet access. Then went back to autodecide and no internet access. I then stopped the webshield and restarted it and I allowed avasts NEW rule after being prompted. This prompt was there only after turning off and then restarting the webshield. Magically had internet access. It seems to have something to do with one of Avasts rules not being created for the webshield.

edit: That fixed the internet connection problem but after restarting the computer still had the same problem as in the first post. Reinstalled Avast.

[lukor]

I have done another test. It is the Avast rules. There are 3 rules automatically created when installing Avast. I deleted all three. I ran Internet Explorer and had no internet access. In firewall expert setting I allowed all and had Internet access. Then went back to autodecide and no internet access. I then stopped the webshield and restarted it and I allowed avasts NEW rule after being prompted. This prompt was there only after turning off and then restarting the webshield. Magically had internet access. It seems to have something to do with one of Avasts rules not being created for the webshield.

Hi, this last one is no magic. WebShield works as a local proxy and as such it needs to have an Internet access in the firewall - be it either the Avast Suite or any other 3rd party firewall used together. I believe this is described in the help files (eventhough I must admit I haven't read them for a while). The rules can be deleted, if you do want to block avast processes from internet we are not hiding you this functionality - but I must agree that a warning message should be probably displayed, or some "repair button" that will repopulate the rules for avast processes for users that accidentally corrupt their rules database is a good idea. The same applies to critical system processes that are essential for correct functionality of Windows. On the other hand, if you are not sure what rules you need and what are required for your system you can switch to auto-decide mode and let the system populate the rules on the first boot - and I also believe it is how the firewall was installed just for this to happen.

We'll try to test it here with various systems (the essential set of rules will probably vary depending on the configuration) - with empty (no) rules the intended behavior should be similar to the situation when your network cable is plugged out - by which I mean, of course Internet should not work, but otherwise the system should be responsible, everything else can be considered as a bug.

Thanks for reporting!

Lukas.

[Charyb-0]

I was testing the firewall and had no idea that the rules would not be recreated. I figured that in "ask" mode that anything that needed access would prompt me. I know better now. When these rules are deleted Windows does freeze up badly after restarting the computer. Just a warning message won't prevent this if someone does decide to delete these rules. I know there is probably some other way to protect these rules other than with a warning message. I am not the only person that will delete these rules. There will be more and Avast will be blamed not only for failure to connect to the internet but also for Windows freezing up (instability). And, the only fix for now is a clean uninstall/install of Avast. I know this after reinstalling 7 times. Most of the reinstalls were because of my testing.

Anyway, thanks to Logos for help (help in contacting you too) and thank you lukor. Didn't expect such a quick reply. I like the fact that a person can post on the forum and get help instead of submitting a ticket. I hope you will post results of your testing here.

[lukor]

I still believe that switching back to auto-decide mode and restarting should return all back to running state - no reinstall necessary.

I really understand that this is not the optimal behavior. Some of the Windows services start before Avast GUI does, and before the user is logged into, and during that time no dialogs can be displayed. Some operations can be postponed, but others block the system, or must be blocked. Once blocked, you'll have to restart to give the system second chance (after changing the rules or creating new rules) - for many cases - which may give you the impression that the ASK mode is not asking you (but there is nothing to be asked for, the system has already given up connecting).

We'll try to find some better way to handle this.
Lukas.

[Charyb-0]

With no internet access for help and both Windows and Avast hung there is no way to open the Avast GUI to change it back. How many users are going to know any other way?  Not everyone has heard of safemode. They will either think they are infected (that was my first thought) or try to uninstall Avast and I don't think that they will be able to due to the hang. Either way, you know where the fingers will point. Last thing you want is a user with these problems to uninstall. They may not come back to it.

Don't know if this is helpful but I have Windows 7 Home Premium, 64bit, 4 gig ram. Avast Internet Security and MBAM on demand.
I won't be deleting anything in the Microsoft or Avast group again. Please let me know if you have any questions. I think I have given you everything that I know.

I do have some ideas but will keep them to myself. Don't want to over-step my bounds or give anyone the false impression that I know anything about firewalls or internet security. I just know enough to be dangerous!

Still would be curious on your test results though.

Thanks lukor and Logos.

Off topic: Avast has really come a long way. I'm impressed with the new look. Really look forward to 5.1 and even more 6.0. Can't wait to see the AV tests after 6.0 is launched. I think you will destroy the competition and that is why I'm sticking with Avast.

[lukor]

If windows are hung and Avast GUI does not open - thats definitely a bug - or maybe more a design flaw. I'll report my findings.