Problem with Avast

[guinux]

There is a function called real site in Avast that is causing problems with Nxfilter blocks. Would there be any solution for this situation? I have DOH blocks on the network but it doesn't seem to be enough.

[support200]

Security softwares doing DNS hijacking and they also use DNS protocol for reporting user information to their server. They work like virus. Weird world.

How did you block DoH? You can't block TCP/443 all.

Can't you just use other anti-virus which is less intrusive?

[guinux]

The entire company uses avast. I block multiple DOH addresses and ips, but it's impossible to have them all and I don't have that specific avast address.

[guinux]

I block everything going to DOH addresses, not just 443.

[support200]

What I am saying is that there are so many IP addresses they can use and if they are smart enough in malicious way, they will use random IPs. You install and run a security software but you don't know what they do and you don't have full control.

I did some search on how to block them on network level but there's no clear answer. They only talk about disabling it one by one.

[support200]

Sorry, there was a typo. I was going to say "You can't block TCP/443 all'.

[guinux]

I can't, as I don't use a proxy and that would prevent browsing.

[support200]

Yeah, nobody can't block TCP/443 all and that's why they use HTTPS doing some secret work. I tried to find some answer on Google but I only found people mad about Avast for the same reason.

[support200]

Do you know how they hijack your DNS? See if they made any change on your system? Maybe they change your system DNS settings.

[guinux]

Nothing is modified. I even have policies that stop this.

I'm thinking it might be the end of the DNS filter. Any visitor to my network who has avast will be able to browse freely.

[support200]

Such kind of bypassing tools have been there always. And if you use AD, you still can block installing Avast with GPO I guess. And Avast is not the only antivirus software.

[support200]

I don't use any antivirus software except Windows Defender. Once I was using Avast and that was more than 5 years ago. At the time, it keeps making trouble with our NxLogon and had to report them it was clean endlessly. I don't trust this kind of software. It seems like trying to do too many things. I don't believe they can do all those Protections by one package. And I found they do so many secret communication to somewhere on the Internet. I even read that they can send my files to their server on their license agreement. Actually this license thing is from another company but I think it's not much different with others.

Anyway, I was curious about their way of DNS hijacking and I downloaded Avast and I found it's a paid feature. So, I even paid the money to see how that Real Site working. It doesn't work. I can see all the DNS traffic with my NxFilter and I can block websites. I found this thing is even more complicated than 5 years ago and claiming to be capable of far more things than before. It even has VPN. I didn't test their VPN but I know you lose DNS filtering when they use VPN. You allow this thing to do anything with your system. And you paid for all those things. What do you expect from NxFilter then? You better go with Avast.

This case closed here. I need to remove this thing from my system.