AvastUI.exe connecting to internet despite setting it off

[ixjhveayinrz]

They're not going to implement this feature just because of you, when an entire community asks for other improvements, more important, sorry but that's the truth, but i suppose you as a programmer must know this.

Yes, I understand this, but I can still hope... And as a comment aside, as a programmer I can tell you that I have a habit of dealing with all the small things I can think of before I start doing a major improvement/enhancement of my programs - doing the small things first puts my mind away from having to do the big things, however I often learn something new from these small things.

[igor]

The way I can see this resolved is to add a secret switch to avast5.ini that would disable this network communication (and you can PM me the switch so that no one else knows about it).

If such a functionality existed, there wouldn't be anything secret about that switch, everyone could know.
But to implement such a switch, somebody would have to go through all the source code, find all the occurrences where some network connection could be done, change the logic to take that switch into account, decide what to do when the connection is kinda important... and then, somehow, make sure that this is also done for all future features not yet implemented. I am sorry, but I really don't think this is going to happen. Moving the DNS check elsewhere, maybe... but this, giving a guarantee that it won't happen... hardly.

I understand you have to follow some policies, but the fact is that the general trend (especially in AV apps, and especially in end-user products) somehow goes the opposite way - moving a lot of functionality on the network (or into the "could", in the fancy term). And even if not using a "cloud", virus database definitions should be downloaded as quickly as possible... how do you do the updates when avast! is not allowed to connect?

Furthermore, if there's a strict rule regarding network connectivity for security reasons, I'd say such a policy should be enforced in a "hard" way (hardware firewall, or simply a disconnected network) - relying on the fact that you manage to persuade all the programs never to connect anywhere... seems a bit weak to me (but it's just my opinion, and I'm going a bit off topic).

[Sparxx]

They're not going to implement this feature just because of you, when an entire community asks for other improvements, more important, sorry but that's the truth, but i suppose you as a programmer must know this.

Yes, I understand this, but I can still hope... And as a comment aside, as a programmer I can tell you that I have a habit of dealing with all the small things I can think of before I start doing a major improvement/enhancement of my programs - doing the small things first puts my mind away from having to do the big things, however I often learn something new from these small things.

Well maybe you'd think otherwise if you'll have to handle with a list of known bugs, improvements to made, listento users feedback..and so on, by the way they are preparing now the 6-th version , and logically their attention is mostly in that direction.

[ixjhveayinrz]

The way I can see this resolved is to add a secret switch to avast5.ini that would disable this network communication (and you can PM me the switch so that no one else knows about it).

If such a functionality existed, there wouldn't be anything secret about that switch, everyone could know.
But to implement such a switch, somebody would have to go through all the source code, find all the occurrences where some network connection could be done, change the logic to take that switch into account, decide what to do when the connection is kinda important... and then, somehow, make sure that this is also done for all future features not yet implemented. I am sorry, but I really don't think this is going to happen. Moving the DNS check elsewhere, maybe... but this, giving a guarantee that it won't happen... hardly.

I understand you have to follow some policies, but the fact is that the general trend (especially in AV apps, and especially in end-user products) somehow goes the opposite way - moving a lot of functionality on the network (or into the "could", in the fancy term). And even if not using a "cloud", virus database definitions should be downloaded as quickly as possible... how do you do the updates when avast! is not allowed to connect?

Furthermore, if there's a strict rule regarding network connectivity for security reasons, I'd say such a policy should be enforced in a "hard" way (hardware firewall, or simply a disconnected network) - relying on the fact that you manage to persuade all the programs never to connect anywhere... seems a bit weak to me (but it's just my opinion, and I'm going a bit off topic).

I know about the trend with moving towards "the cloud", and I am horrified from a security-of-sensitive-data point of view.

We are using a hardware firewall and our own DNS server resolution as to prevent as much outgoing data as possible - which is how we detected avast's behavior.

The main point is to prevent the programs connecting somewhere when not requested by user. Avast is updated by manually invoking the check when sensitive data is unmounted from the computers - the internet connection here is no problem since it was requested by the user. The problem is when the connection happens without being requested by the user - which can also indicate that something suspicious is going on in the background (such as avast becoming infected). Hence it is better to know that the program does not normally produce any internet requests when not wanted - so that you know that something suspicious is happening when you suddenly see a connection without requesting it - I hope you see what I mean.

Correct me if I am wrong, but it looks like the connection is related to avast news service (or something like that), hence it would appear that it needs only a single switch implemented in the program code - and it is something that is unlikely to break other functionality in the program so it is a safe change.

I would just like everyone know that there are still hospitals and hospital labs that are reluctant to put all the patients' data on the internet for "everyone" to see - hence we need to check the internet functionality of all our programs.

[schmidthouse]

I would be very interested in knowing if there is any software program similar to Avast that does what the OP is requesting.

[MAG]

Correct me if I am wrong, but it looks like the connection is related to avast news service (or something like that)

My recollection from when I had AIS is that disabling 'show remote content in UI' under basic settings used to prevent the news service (and connections by the UI I seem to recall).

[ixjhveayinrz]

Correct me if I am wrong, but it looks like the connection is related to avast news service (or something like that)

My recollection from when I had AIS is that disabling 'show remote content in UI' under basic settings used to prevent the news service (and connections by the UI I seem to recall).

The "show remote content in UI" is disabled, and the connections still happen...

[jeff232]

i have the same issue - AVAST UI is connecting to the internet and sending up lots of data - my upload meter shows 40-50 KB/s(yes that's bytes) peak and i dont like this at all... i complained on another forum and the Avast rep over there said i prob have some malware but MBAM and SAS have never found anything....AVAST all of sudden opens up like 4-5 connection and they all say AVAST UI or AVAST GUI or AVAST SVC, something like that and i want know what's going on...this is the PAID version of AVAST IS and community "sharing" is OFF....there is no reason to send any volume of data up from my computer...

[ixjhveayinrz]

I would like to ask the people who are experiencing this issue (or who view this as an issue) to comment in this thread to show the developers that not everyone is careless regarding what their computer is sending to the internet.

[MAG]

i have the same issue - AVAST UI is connecting to the internet and sending up lots of data - my upload meter shows 40-50 KB/s(yes that's bytes) peak and i dont like this at all... i complained on another forum and the Avast rep over there said i prob have some malware but MBAM and SAS have never found anything....AVAST all of sudden opens up like 4-5 connection and they all say AVAST UI or AVAST GUI or AVAST SVC, something like that and i want know what's going on...this is the PAID version of AVAST IS and community "sharing" is OFF....there is no reason to send any volume of data up from my computer...

As far as I understand it avast webshield acts as your internet proxy, and avast mailshield acts as your mail client, so you are bound to get some outbound avastsvc connectivity (and probably same principle for P2P and IM, which I don't use).

If "show remote content in UI" is disabled and you still get avast news service that would sound to me like a bug (or at least a change in practice since I had AIS).

[igor]

AvasUI is not sending anything to Internet - period. If it's making any connections, then it's downloading something.

[MAG]

AvasUI is not sending anything to Internet - period. If it's making any connections, then it's downloading something.

I agree. Opening avastUI on my machine gives only 66B outbound (to initiate the connection presumably).

[Lisandro]

secret switch

There isn't secretes here. If you don't believe/trust in your security company, better is to move on.

I know about the trend with moving towards "the cloud", and I am horrified from a security-of-sensitive-data point of view.

Encrypt your data, use encrypted connections (https).
To horror there is a solution: unplug the computer

We are using a hardware firewall and our own DNS server resolution as to prevent as much outgoing data as possible - which is how we detected avast's behavior.

If your outbound connections are safe, there is no reason to fear avastUI.exe connections.

The problem is when the connection happens without being requested by the user - which can also indicate that something suspicious is going on in the background (such as avast becoming infected).

No, no, no... There isn't anything suspicious on applications to make automatic connections if they are set so (for instance, update).

i have the same issue - AVAST UI is connecting to the internet and sending up lots of data

Lots of data? avastUI.exe or avastSvc.exe (used to updates)? avast! WebShield scanning?

[ixjhveayinrz]

secret switch

There isn't secretes here. If you don't believe/trust in your security company, better is to move on.

Not trusting a company is not a permanent state of mind - it can be changed if the company listens to its users suggestions - that is how you gain trust as a company. I will not blindly trust anyone without them earning my trust.

I know about the trend with moving towards "the cloud", and I am horrified from a security-of-sensitive-data point of view.

Encrypt your data, use encrypted connections (https).
To horror there is a solution: unplug the computer

My data may be encrypted locally - but how do I guarantee that the cloud company keeps the data encrypted? How do I guarantee they do not keep passwords in a plaintext database instead of just storing hashes? How do I guarantee that the company does not have any backdoors? How do I guarantee that some employee of that company will not go on a rampage and sell all data? There are many more other problems with it...

The problem is when the connection happens without being requested by the user - which can also indicate that something suspicious is going on in the background (such as avast becoming infected).

No, no, no... There isn't anything suspicious on applications to make automatic connections if they are set so (for instance, update).

Exactly, nothing suspicious if the automatic connections are set so - BUT it is suspicious if the automatic connections are set off, you have to agree with this if you are a smart computer user.

[ixjhveayinrz]

AvasUI is not sending anything to Internet - period. If it's making any connections, then it's downloading something.

I understand, but try to explain this to a computer illiterate head of hospital... Or any user who is not very computer knowledgeable - what they will see is avast initiating a connection that the user did not expect to happen. Hence something wrong.