Author Topic: [RESOLVED] AIS FW - 'Unknown' connections  (Read 5809 times)

0 Members and 1 Guest are viewing this topic.

MAG

  • Guest
[RESOLVED] AIS FW - 'Unknown' connections
« on: May 17, 2011, 11:19:36 PM »
Just upgraded to AIS.

My AIS FW shows a number of unknown connections (w7 system) - see snip.

There are no Application Rules for Unknown

FW is set to Public

Anyone else seen this/know what's going on?

Thanks
« Last Edit: July 15, 2011, 07:21:49 PM by mag »

SafeSurf

  • Guest
Re: AIS FW -Unknown connections
« Reply #1 on: May 17, 2011, 11:24:41 PM »
If you upgraded from a previous version of Avast (Free, Pro) and got this (screen shot), I would uninstall and do a clean install.

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #2 on: May 17, 2011, 11:27:39 PM »
If you upgraded from a previous version of Avast (Free, Pro) and got this (screen shot), I would uninstall and do a clean install.

Thanks.

That's the first thing I thought of - but it didn't make any difference to this behaviour unfortunately. :(

SafeSurf

  • Guest
Re: AIS FW -Unknown connections
« Reply #3 on: May 17, 2011, 11:30:34 PM »
I know it's not what you wanted to hear, but something is wrong and it should fix the problem.  Let us know.  Thanks.

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #4 on: May 17, 2011, 11:33:56 PM »
I know it's not what you wanted to hear, but something is wrong and it should fix the problem.  Let us know.  Thanks.

Not sure I follow you - I already did an uninstall/reinstall - and it didn't make any difference.

SafeSurf

  • Guest
Re: AIS FW -Unknown connections
« Reply #5 on: May 17, 2011, 11:36:41 PM »
Now I'm confused...you did a clean install of AIS and the screen shot you gave us is what happened?

Have you tried an Avast Repair?
« Last Edit: May 17, 2011, 11:39:06 PM by SafeSurf »

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #6 on: May 17, 2011, 11:40:22 PM »
Yes - that's it.

I confess I didn't use the ASWClear tool - just control panel/uninstall programs - but it all went smoothly and reported no problems.

Also tried a repair.
« Last Edit: May 17, 2011, 11:45:24 PM by mag »

SafeSurf

  • Guest
Re: AIS FW -Unknown connections
« Reply #7 on: May 17, 2011, 11:42:40 PM »
So now everything is working correctly after using the Uninstaller Tool?

Edit:  I think we have a little miscommunication here.  Try uninstalling using the Avast Uninstaller Tool, then do a clean install and see if this fixes your problem.  Let us know how this goes.  Thanks.
« Last Edit: May 17, 2011, 11:51:45 PM by SafeSurf »

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #8 on: May 17, 2011, 11:56:11 PM »
No - I haven't tried the avast uninstall tool yet.

I was wondering whether this could be anything to do with leftovers from my previous FW (comodo), but there doesn't seem to be an uninstaller for that.

I did a Ccleaner file and registry clean after uninstalling comodo FW through control panel though.

I'll try aswclear in safe mode tomorrow.

SafeSurf

  • Guest
Re: AIS FW -Unknown connections
« Reply #9 on: May 18, 2011, 10:10:17 AM »
If you find you have remnants of Comodo, check this thread from their forum: https://forums.comodo.com/install-setup-configuration-help-cis/uninstaller-tool-for-comodo-products-t71897.0.html.  If anything is found, run CCleaner again, then reboot.

Then do a clean install of Avast.  Let us know how it goes and if this resolves your problem.  Thanks.  :)

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #10 on: May 19, 2011, 02:20:22 PM »
I don't really know if there are any comodo remnants - it seemed to uninstall OK. Thanks for the link to comodo uninstaller though - didn't know there was one (I see it is not provided by comodo themselves).

I don't really have time to look into this too much at present, and not being happy with a FW that shows unknown connections with no rules for them, I have uninstalled AIS FW and gone back to comodo for the present.

It may be worth noting that the unknown connections only show up when detailed view is ticked. Otherwise all the connections shown are known.

Could anyone else with AIS please do me a favour and just check if they get any such connections (bottom of page) when detailed view is ticked.
Thanks


Offline lukor

  • Administrator
  • Super Poster
  • ***
  • Posts: 1883
    • AVAST Software
Re: AIS FW -Unknown connections
« Reply #11 on: May 19, 2011, 04:40:17 PM »
Hi mag,
the number displayed after the word "Unknown" is a process identifier (PID), the same number should be listed in the task manager (if not, add it to the list of displayed columns from the TaskManager menu). Do you see any applications with such PID running on your system ?

Thanks.
Lukas.

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #12 on: May 20, 2011, 02:18:23 PM »
Thanks for looking into this Lukas

It just happened on my XP system - unknown 2676.

There was no such PID showing in XP task manager.

(I am running an administrator account, and I have 'show processes from all users' ticked)
« Last Edit: May 20, 2011, 02:48:24 PM by mag »

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #13 on: May 21, 2011, 06:46:57 PM »
A bit more info is now available.

PID 2676 popped up in task manager (same session - resumption after hibernation) and it was wmiprvse.exe.

avst FW then fairly soon recognised it, and named the connection (which until minutes before was still showing as 'unknown').

wmiprvse then disappeared from task manager - presumably the process stopped, because whatever was using it didn't need it any more.

Within a few minutes avast FW was showing the 2676 connection as still present, but 'unknown' again.

So the 'unknown' connections seem to be ghost connections left in place after the processes that opened them have stopped?

But this isn't what seems to happens with the majority of processes. When they stop the connection just disappears soon after.

Any thoughts anyone?

Postscript - I am no longer confident that this observation was particularly relevant - see post below

« Last Edit: May 23, 2011, 08:53:52 PM by mag »

MAG

  • Guest
Re: AIS FW -Unknown connections
« Reply #14 on: May 23, 2011, 08:51:30 PM »
Continuing my monologue on this topic....

I have now found out how to reproducibly create the AIS FW 'unknown connections'.

Open an application that connects and includes an outbound UDP 'listening' connection (eg PSI).
- AIS FW shows all the connections and the associated application name and PID
- Task Manager shows the PID and application name.

Close the application.
- AIS FW still shows the UDP 'listening' connection and the application name and PID. Other connections disappear.
- Task Manager doesn't show it any more because the application isn't running.

Close avast UI, then reopen it.
- AIS FW still shows the UDP 'listening' connection and the PID - but the name has now become 'unknown'.

You need to have 'Detailed View' ticked to see this.

Now what I need to know is why it happens - and why does it apparently only happen to me, yet happens on both my W7 and my XP systems? ???

I think it maybe has something to do with the fact that detailed view is also showing historic info - ie data on connections that have closed, and I now suspect (hope) that it is actually no concern at all!
« Last Edit: May 23, 2011, 09:26:29 PM by mag »