Author Topic: Avast acting like a Trojan  (Read 24430 times)

0 Members and 1 Guest are viewing this topic.

MrSafe

  • Guest
Avast acting like a Trojan
« on: July 31, 2011, 06:19:58 PM »
Hi. I have just started using Avast and find that it is always trying to connect to the internet even though I have switched off automatic updates. I have disabled the Web Shield because it was stopping my connection completely, so there should be no reason for Avast to connect to the internet (I find that the Network Shield still protects me & the File System Shield should catch anything in the Temporary Internet Files folder before it can do any harm). I have blocked all connection attempts by Avast.exe and AvastUI.exe with my firewall and find that I can still update by allowing Avast.setup, which does not try to connect until I tell it to. I would like to know why Avast is persistently trying to connect and what information it would send. Thanks.

bobo1

  • Guest
Re: Avast acting like a Trojan
« Reply #1 on: July 31, 2011, 10:34:36 PM »
This is normal for avast to do this. It tries regardless to connect to the internet connection even when you open the GUI. BUT WHY STOP IT THOUGH AS IT DOES THIS TO TRY AND UPDATE!
Norton did similar thing
You can stop it as follows.
Create a dial up networking short cut to desktop click that if you want to connect to the internet!
open ie8 or ie7
under tools /internet connections/ options /never
and thats it

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Avast acting like a Trojan
« Reply #2 on: July 31, 2011, 11:09:22 PM »
Since you are not saying where it's connecting and on what occasion, it's hard to say.

In any case, the theory that the File System Shield protects your browser via its cache just like WebShield... is wrong. There's no reason the web browser has to save everything to its cache, or save it there before it actually uses the data. Also, the File System Shield doesn't scan all the filetypes (unless you set it to scan all the created files, but that would slow down your system noticeably). The Network Shield also doesn't duplicate the WebShield's functionality, it blocks the connections according to the URL, not according to the page content (i.e. blocks different pages).

ady4um

  • Guest
Re: Avast acting like a Trojan
« Reply #3 on: August 01, 2011, 02:17:30 AM »
Hi. I have just started using Avast and find that it is always trying to connect to the internet even though I have switched off automatic updates.
Besides the answers you already received, I want to add a little detail.

Avast checks for available updates every 240 minutes (that's the default).

Some of those checks are negative (no update available). From those times that Avast actually finds an available update, if you set it to automatic update, it performs the update.

When you set it to manual update, the "checking" part is still done (don't ask me why, because I still think it shouldn't check when in "manual", but that's the way it is). The "manual" setting is only stopping Avast from actually applying the available update.

The third option is "ask". It "checks" for available updates, and when it finds them, Avast asks you whether to apply it in that same moment. (In this case, the actual check is still valid, because without it, you wouldn't be asked).

Although nowadays having a security tool that can't update its database from the Internet would be strange, there are certainly some situations when you want to avoid from Avast trying to connect, even if it is just for "checking" the availability of updates.

I hope that for Avast 7.0, the "manual" (NOT "ask") update will mean avoiding to even check for availability, unless the user "manually" checks for updates. At least, there should be an additional option, so to either:

- make it work as the current versions are in "manual" mode; or,
- to avoid the "checking" for available updates too when in "manual" mode.

That extra option would give the user more control so to adapt Avast to more different situations.

MrSafe

  • Guest
Re: Avast acting like a Trojan
« Reply #4 on: August 01, 2011, 03:42:33 AM »
I'm afraid I do not understand the first reply, but it sounds like that would block my connection completely if those settings were there and I do not use dialup. The sites it is connecting to are all owned by Avast, the majority are in the following IP ranges:

74.55.xx.xx
46.4.xx.xx
174.120.xx.xx
75.125.xx.xx

I tried blocking AvastUI.exe and Avast.exe with my firewall and could still update by allowing avast.setup. I do not understand why Avast.exe or AvastUI.exe need to connect to Avast's servers when it is not updating and even after it has just updated. I thought the only files that do not go into the Temporary Internet Files folder are streaming videos, is that not so?

Thanks for all the detail, ady4um, I absolutely agree Avast should change that. I will block the unnecessary connections and only allow avast.setup to connect when I want it to! I suppose I can add Avast's many IP ranges to a network zone in my firewall, block it and reenable the Web Shield. I am very security conscious (does it show?) and don't want an antivirus ruining things!!!

Offline Gopher John

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2098
Re: Avast acting like a Trojan
« Reply #5 on: August 01, 2011, 04:00:15 AM »
Doesn't WebRep connect to Avast servers for it's ratings?  That may be part of what you're seeing.  Disable WebRep and see if that doesn't quieten things down some.
AMD A6-5350M APU with Radeon HD Graphics, 8.0GB RAM, Win7 Pro SP1 64bit, IE11
i7-3610QM 2.3GHZ, 8.0GB Ram,  Nvidia GeForce GT 630M 2GB, Win7 Pro SP1 64bit, IE 11
Common to both: Avast Premium Security 19.7.2388, WinPatrol Plus, SpywareBlaster 5.5, Opera 12.18, Firefox 68.0.2, MBam Free, CCleaner

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Avast acting like a Trojan
« Reply #6 on: August 01, 2011, 08:33:15 AM »
Seriously, why ppl worry so much why programs like avast! are connecting anywhere? It has many subsystems which rely on connection to their services. It's not like avast! is sending your documents to AVAST Software which is then reading it in an underground volcano secret base, waiting to conquer the world... Program generally connects for the ads inside avast! (free version), for news content inside avast! (all versions), CommunityIQ feature (all versions), WebRep (all versions), updating (all versions) and probably things i forgot and are there.
All these require occasional connection.

Traffic factor is also negligable as the data is usually so small you won't notice it even if you have a 56k modem or a very limited internet plan. But it does make connection so you will see it if you chase every packet your computer sends or receives. Which is a bit over paranoid if you ask me as far as avast! is concerned.
avast! is a verified, well known and trusted program. I'd bother with such thing on a new unknown product that may be questionable, but with avast! (or any other well known security program) a completelly pointless thing to do really. Days of static strictly offline antivirus programs are long over, they pretty much all use "cloud" like features to some extent and they use live connection to enhance protection or provide certain features that require connection (like WebRep).
Visit my webpage Angry Sheep Blog

Offline Gopher John

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2098
Re: Avast acting like a Trojan
« Reply #7 on: August 01, 2011, 01:26:52 PM »
RejZoR,  I agree.  If one doesn't trust their security program, then why are they running it at all? ::)
AMD A6-5350M APU with Radeon HD Graphics, 8.0GB RAM, Win7 Pro SP1 64bit, IE11
i7-3610QM 2.3GHZ, 8.0GB Ram,  Nvidia GeForce GT 630M 2GB, Win7 Pro SP1 64bit, IE 11
Common to both: Avast Premium Security 19.7.2388, WinPatrol Plus, SpywareBlaster 5.5, Opera 12.18, Firefox 68.0.2, MBam Free, CCleaner

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast acting like a Trojan
« Reply #8 on: August 01, 2011, 01:32:31 PM »
...It's not like avast! is sending your documents to AVAST Software which is then reading it in an underground volcano secret base, waiting to conquer the world...

;D 8)
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline SpeedyPC

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3398
  • Avast shall conquer the whole world
Re: Avast acting like a Trojan
« Reply #9 on: August 01, 2011, 02:35:45 PM »
;D 8)

What are you smiling about Asyn ;D
Gigabyte 670 LGA1200 Full ATX MB | Intel Core i9-13900 CPU/LGA 1700 | GeForce Nvidia RTX-4070/12GB | 32GB DDR4 | 2 x 1TB Samsung SSD | W11 Home 64bit | Avast Premium v23.11.6090 | Avast SecureLine VPN | Avast Secure Browser | Avast Driver Updater | Avast BreachGuard | Firefox 64bit | MalwareBytes Premium | Adguard Premium | CCleaner Portable | Macrium Reflect | 7-Zip

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast acting like a Trojan
« Reply #10 on: August 01, 2011, 02:42:18 PM »
What are you smiling about Asyn ;D

I'm not allowed to tell. :-X ;D
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline SpeedyPC

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3398
  • Avast shall conquer the whole world
Re: Avast acting like a Trojan
« Reply #11 on: August 01, 2011, 02:50:07 PM »
I'm not allowed to tell. :-X ;D


Than give me $500 and I'll leave you alone ;D
Gigabyte 670 LGA1200 Full ATX MB | Intel Core i9-13900 CPU/LGA 1700 | GeForce Nvidia RTX-4070/12GB | 32GB DDR4 | 2 x 1TB Samsung SSD | W11 Home 64bit | Avast Premium v23.11.6090 | Avast SecureLine VPN | Avast Secure Browser | Avast Driver Updater | Avast BreachGuard | Firefox 64bit | MalwareBytes Premium | Adguard Premium | CCleaner Portable | Macrium Reflect | 7-Zip

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast acting like a Trojan
« Reply #12 on: August 01, 2011, 02:52:42 PM »
Than give me $500 and I'll leave you alone ;D

That's quite cheap. :P
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

MrSafe

  • Guest
Re: Avast acting like a Trojan
« Reply #13 on: August 01, 2011, 06:47:15 PM »
I didn't expect so many replies, thanks, sort of!

Gopher John: I didn't install WebRep, so that's not creating any connections.

RejZoR: I haven't seen any ads in Avast and don't have the features you mentioned. Security should always be as high as possible, otherwise why install an AV? People trust lots of things they shouldn't, often the bigger the company the less trustworthy! I even block Google Analytics (and not by the Google Analytics Opt-out, which is another privacy/security risk). Control of my pc and information is responsible, not irrelevant. I agree that chasing every packet would be over-paranoid, so I don't. The size of the info it sends is irrelevant, especially if compressed or concatenated. Why does Avast send anything? An AV should prevent this, not cause it. Do you know what information it is sending? I do not think they would conquer the world with my info, I just wonder what they ARE doing. Nor do I care whether they have their base in a volcano or an office, they cannot have access to my pc. By the way, Avast sometimes blocks access to your website because it contains "malicious" content:
http://forum.avast.com/index.php?action=profile;u=1713/

Gopher John: I am using it for security, which I protect without exception. If in doubt, find out. I continue to use it because I have taken control of it.

Asyn:
Quote
I'm not allowed to tell.  :-X  ;D
Privacy, I like it
« Last Edit: August 01, 2011, 07:04:54 PM by MrSafe »

MrSafe

  • Guest
Re: Avast acting like a Trojan
« Reply #14 on: August 01, 2011, 07:07:50 PM »
Quote
Avast sometimes blocks access to your website because it contains "malicious" content:
http://forum.avast.com/index.php?action=profile;u=1713/
I thought it might stop, so I took a screenshot:

http://imageshack.us/photo/my-images/155/avastn.jpg/
« Last Edit: August 01, 2011, 07:46:23 PM by MrSafe »