Avast Firewall gets turned off automatically!

[DraKuL]

I'm using the latest version of AIS, and for some reason the firewall gets turned off automatically after some time.. I cant tell exactly when, but this has been happening for the past 5 days.. I'm pretty sure that my PC is not infected as I have 3 resident shields running - AIS, MBAM, SAS..

I know 3 might be a bit too much, but wanted to run 3 of them because AIS and MBAM didnt warn me when opening this infected file, it detected it AFTER opening and executing it only.. So I decided to add SAS as well.. Since the specs on my PC are good it shouldnt make much of a difference in the performance.. Also there are no known compatibility issues between these 3 for the moment right ?

But anyway is there a log or something that records firewall activity - like what caused it to turn off, whether it was manually done or not ? the FW activity log doesnt mention anything..

Can someone help me sort out the issue?   

[MayuraDeSilva]

Hi,

Can you please state your specifications of PC?

As so far there were no incompatibilities among SAS and MBAM. Last few days I have used both products (paid versions) but leaving one as On-demand. MBAM also track malware before execution too. But with SAS Pro, it processes heavily when definitions get automatically updated at start up and it runs automatic startup test too. As my guess it may interfere with avast. And if you research more you may see that MBAM has more detection rate than SAS.

1st you may try disabling Windows Firewall & SAS automatic protection n see if it works.

Cheers...

[DraKuL]

I know that MBAM tracks malware before they execute... So does Avast... but thats not the case, they failed to stop it at the execution but removed it AFTERWARDS.. Stopping it before it got spread would have saved me the trouble of performing scans and removing them.. Which is why I have SAS running real time..

I know that SAS is a bit heavy on the startup so I have disabled it on startup.. So I manually run it everytime I login but have real time protection..

You have misunderstood my post.. Avast FW and Win FW are said to have no conflicts.. Same goes with MBAM + SAS + AIS, there are so many people who use all of these together without any problems.. I wanted to know how the Avast FW could have gotten disabled automatically and whether I can track what did it by referring to a log or something..

[MayuraDeSilva]

You have misunderstood my post.. Avast FW and Win FW are said to have no conflicts.. Same goes with MBAM + SAS + AIS, there are so many people who use all of these together without any problems.. I wanted to know how the Avast FW could have gotten disabled automatically and whether I can track what did it by referring to a log or something..

I have no answer exactly why you should WF turn off. But once I had same problem and another member offered me to turn off WF n try out. As he suggested, it solved.

There are many who use MBAM + SAS + AIS. But most have one On-Demand, either MBAM or SAS.

Giving a try won't be worthless.

Cheers...

[DraKuL]

Yeah I know but as I have said in my first post I dont know when/how it gets turned off.. I had it running with windows FW for so many months so I know for a fact that its not the issue.. the ONLY difference was I turned on real-time protection of SAS.. But then again I have seen users in this forum who run ALL 3 of them REAL TIME.. So again I'm not sure why it happens.. If only theres a log that gives out the time/reason the FW stopped..

Giving a try wont be worthless but since I dont know exactly when it goes off, it wont help much...

[MayuraDeSilva]

Alright, as if you prefer you may try Firewall Logs under Firewall menu, and make sure to set - Show log for > 'Activity' to show activities that has been carried out.

Cheers...

[DraKuL]

Thanks Mayura for the assisst , but it doesnt mention anything about being turned off.. I mentioned it  in the first post. Hope theres another log.. MBAM has a log that mentions when the protection is turned off and when it gets back on.. I think Avast also has a log like that..

[MayuraDeSilva]

You are welcome Did you check out 'Application Rules' for avast! FW service?

Cheers...

[MayuraDeSilva]

AND try this if it helps, you can locate another log here.

C:\ProgramData\AVAST Software\Avast\log\

Cheers...

[DraKuL]

ooo Thanks!  There you go!    These are the errors(There are more but these are the most recent ones)! Now hope someone with an in-depth knowledge about the Avast FW will tell me what they mean 

29/04/2011   4:40:54 PM   GetBestInterface error 1231
29/04/2011   4:40:54 PM   SendARP error 87
29/04/2011   4:40:56 PM   SendARP error 87
30/04/2011   2:43:46 PM   GetAdaptersInfo error 0
30/04/2011   2:43:57 PM   SendARP error 87
30/04/2011   2:43:57 PM   SendARP error 87
30/04/2011   2:43:59 PM   SendARP error 87
30/04/2011   2:43:59 PM   SendARP error 87
2/05/2011   9:38:17 PM   SendARP error 87
3/05/2011   9:33:54 PM   SendARP error 87
4/05/2011   12:55:31 PM   SendARP error 87
4/05/2011   12:56:35 PM   GetAdaptersInfo error 0

[DraKuL]

But then again I'm not sure if this is a reason why the FW was turned off..  

btw These were found in the error log, they might be about the FW.. Hope someone can help me decode it   


Sat Apr 02 12:06:43 2011
 -> topLevelExceptionFilter addr=0 code=c0000005
Sat Apr 02 12:06:43 2011
 -> Calling generateExceptionReport
Sat Apr 02 12:06:43 2011
 -> Returning EXCEPTION_CONTINUE_SEARCH.

Fri Apr 29 11:31:29 2011
 -> topLevelExceptionFilter addr=76fee39e code=c0000005
Fri Apr 29 11:31:29 2011
 -> Calling generateExceptionReport
Fri Apr 29 11:31:31 2011
 -> Returning EXCEPTION_CONTINUE_SEARCH.

Fri Apr 29 11:31:37 2011
 -> topLevelExceptionFilter addr=76fee39e code=c0000005
Fri Apr 29 11:31:37 2011
 -> Returning EXCEPTION_CONTINUE_SEARCH.

Wed May 04 19:02:25 2011
 -> topLevelExceptionFilter addr=6c24dc90 code=c0000005
Wed May 04 19:02:25 2011
 -> Calling generateExceptionReport
Wed May 04 19:02:25 2011
 -> Returning EXCEPTION_CONTINUE_SEARCH.

[MayuraDeSilva]

SendARP error common for me too. but other two not in mine. You better Google until someone go through your issue.

Cheers...

[MayuraDeSilva]

can you upload unp******.mdmp file in the 'log' directory?

Cheers...

[DraKuL]

Done - click the link below to download them.. Can you find the cause by looking at them ? Thanks again!

http://www.sendspace.com/file/36b8sz

[MayuraDeSilva]

Hi,

I've checked those minidump files. Crashes of programs can be found as below,

unp33134183.tmp : Crash of AvastUI.exe, AshBase.dll
unp86191549.tmp : Crash of Google Chrome Real Player Plugin
unp251887968.tmp : Crash of afwServ.exe (avast! Firewall) and stop service

As my knowledge it may happen due to new driver or program update like Microsoft Visual C++ Package installed via another software installation or windows update. avast! use Microsoft Visual C++ Package too. So overwritten of files might be the reason of sudden crash. May be it cause due to Bad Sectors too, but I hope you haven't got any of em.

It took some time to check and analyze:)

If you are still suffering from this error, the recommendation is trying repair or fresh install of avast!

Cheers...