Massive Internet Slowdown since today

[Blaz]

Probably a disabled document exclusion rule or some other exclusion rule with $important somewhere.

 

[Percy]

Widows 10 Pro v.1607 Build: 14393.2189/Firefox 60.0.2 (64-bit)/AV:Webroot
I have all these problems starting yesterday and no Kaspersky connection. No IT background, so don't know why, but I tried disabling the features I have ticked one by one and when I got to Networks/Filter HTTPS protocol things seem back to normal.

 

[Percy]

Spoke too soon. Just realised that the sites I have been logging in to were all HTTPS. As soon as I connected to an unencrypted connection the problems resurfaced.

 

[DanMagicSausage]

On what particular website? I can't reproduce this issue.

No specific websites. I just clicked trough my bookmarks consisting of nasty site, tech sites, youtube, webnovels, manga, ect.

 

[MartinR]

I have the same problems with 2 PCs. Both use windows 10.0.17134 and Sophos Endpoint Security and Control - never used Kaspersky.
The beta version made it even worse: If Adguard beta is active, Chrome doesn't start anymore. If you start Adguard with running Chrome it freezes.

 

[avatar]

Widows 10 Pro v.1607 Build: 14393.2189/Firefox 60.0.2 (64-bit)/AV:Webroot
I have all these problems starting yesterday and no Kaspersky connection. No IT background, so don't know why, but I tried disabling the features I have ticked one by one and when I got to Networks/Filter HTTPS protocol things seem back to normal.

What about beta version, did it help?

I have the same problems with 2 PCs. Both use windows 10.0.17134 and Sophos Endpoint Security and Control - never used Kaspersky.
The beta version made it even worse: If Adguard beta is active, Chrome doesn't start anymore. If you start Adguard with running Chrome it freezes.

Try this:
Go tray menu -> advanced -> settings, then make sure that "Use localhost injections" is unchecked there.

 

[avatar]

Widows 10 Pro v.1607 Build: 14393.2189/Firefox 60.0.2 (64-bit)/AV:Webroot

Meanwhile, I tried this configuration and had no problems with it.

Have you changed anything in Webroot configuration?

 

[avatar]

No specific websites. I just clicked trough my bookmarks consisting of nasty site, tech sites, youtube, webnovels, manga, ect.

So you click on the Assistant button in the corner of a page and uncheck a slider there, right?
After that, you should see a Windows notification, smth like "A rule was added to the user filter".
Do you see it?

 

[steve1209]

Hi,

Been running Windows 10 Home X64 V 1803 OS V17134.112 since about 5-14, since that update, with NO problems, been running Nightly Update Adguard currently 6.3.1154.3583. Since the Win 10 1803 I've gotten 1 more update on 6-12 KB428835. Have never had the problem using Avira FREE A/V.

 

[Percy]

Meanwhile, I tried this configuration and had no problems with it.

Have you changed anything in Webroot configuration?

I have made no changes in Webroot. Now installed the beta version that you linked and the problem is resolved. Thanks.

MS installed KB4134659 on 14th and KB890830, KB4132216 on 13th.

 

[avatar]

Good news guys, I've figured what's the issue. Here's an explanation.

AdGuard uses a fake domain `local.adguard.com` in order to apply cosmetic rules, run userscripts and so on.

Connections to this server's IP address are intercepted locally and re-routed to AdGuard for further processing. So there's no real connection and the only purpose of having a real domain name is the proper HTTPS processing (browsers won't establish an https connection with localhost).

Here's what happened.

1. Two days ago the server with this IP address was shut down.
2. In theory, it does not matter if the server is running or not (and it continued to work just okay on our test machines).
3. It appears, that some AVs (for instance, Kaspersky) interfere with this logic. If the AV's network driver gets to the connection first, it actually tries to connect to the remote IP address, and when it fails, the further processing hangs. Another option when this problem can arise is when the computer is configured to use a proxy server.
4. The new network driver (in v6.3) is able to get to the connection earlier, before Kaspersky, and that's why the issue is gone once you update.

The IP address is back online so the issue is now resolved for v6.2 users.

 

[DanMagicSausage]

On what particular website? I can't reproduce this issue.

If you google anything, google looks... old? If you dissable it, you get the "new" look, which is what i want.

AG on

https://imgur.com/ApmW6bF


AG off (what i want)
https://imgur.com/mKXfR1e

Edit:

To make it clear, i can only select the "dissable for 30 second option", if i move the slider, the slider goes back to "on" automaticly within seconds... I adden an exception with
@@||google.com^$document, but this issue shouldn't be one tbh.

 

[BitMon]

Since I updated to latest beta version for version 6.2 issues, the system already crashed thrice in two day. Even I'm doing nothing but upload multiple files to Google Drive through the browser (Chrome 67.0.3396.87), the system is still getting crash.

First crash (shut down immediately & auto restart):
Windows 10 version 1803 x64 (Updatedto KB4284835)
AdGuard for Windows 6.3.1118.3511 (WFP Network Driver Enabled)
Antivirus: Kaspersky Internet Security 18.0.0.405(h)
Browser: Chrome 67.0.3396.87 and Firefox beta 61.0b13

Second crash (shut down immediately):
Windows 10 version 1803 x64
AdGuard for Windows 6.3.1118.3511 (WFP Network Driver Enabled)
Antivirus: Kaspersky Internet Security 18.0.0.405(h)
Browser: Chrome 67.0.3396.87 and Firefox beta 61.0b13

Third crash (shut down immediately and auto restart):
Windows 10 version 1803 x64
AdGuard for Windows 6.3.1118.3511 (WFP Network Driver Enabled)
Antivirus: Kaspersky Internet Security 18.0.0.405(h)
Browser: Chrome 67.0.3396.87

 

[Blaz]

Is SSL scanning active in Kaspersky? Can you please upload minidump files (c:\windows\minidump), thank you.

 

[BitMon]

Is SSL scanning active in Kaspersky? Can you please upload minidump files (c:\windows\minidump), thank you.

1. Is SSL scanning active in Kaspersky?

Yes.

2. Can you please upload minidump files (c:\windows\minidump).

Minidump files (c:\windows\minidump) have been cleaned by CCleaner.
I went back to install AdGuard 6.2.437.2171 since I herad the issue is now resolved.
Everything seems to be OK now.

Thanks.

 

[DanMagicSausage]

So, to Update the ones that care:

The Beta Version is Shit. I've run in so many god damn Problems now that i'd rather go click and chat with the nice single ladies in my neighborhood than use AdGuard. Most of the times i visit a website, the login buttons don't work or don't show up at all, "send" buttons for contact formulars don't do a damn thing with adguard on (dissable for 30seconds doesn't do anything), when returnin a page on youtube the entire thing won't load and keeps me on the current site, despite seeing the URL change.

Just give me a 2 month old version, where i had no issues at all and stop updating it.

 

[avatar]

@DanMagicSausage is it possible to have a remote access session so that I could troubleshoot it? The problems you describe aren't yet reported by beta testers and I'd like them to be resolved asap.

 

[Alex12]

Good news guys, I've figured what's the issue. Here's an explanation.

AdGuard uses a fake domain `local.adguard.com` in order to apply cosmetic rules, run userscripts and so on.

Connections to this server's IP address are intercepted locally and re-routed to AdGuard for further processing. So there's no real connection and the only purpose of having a real domain name is the proper HTTPS processing (browsers won't establish an https connection with localhost).

Here's what happened.

1. Two days ago the server with this IP address was shut down.
2. In theory, it does not matter if the server is running or not (and it continued to work just okay on our test machines).
3. It appears, that some AVs (for instance, Kaspersky) interfere with this logic. If the AV's network driver gets to the connection first, it actually tries to connect to the remote IP address, and when it fails, the further processing hangs. Another option when this problem can arise is when the computer is configured to use a proxy server.
4. The new network driver (in v6.3) is able to get to the connection earlier, before Kaspersky, and that's why the issue is gone once you update.

The IP address is back online so the issue is now resolved for v6.2 users.

At some point for fun I turned on logging of DNS queries in my router and saw a lot of queries to `local.adguard.com`. It puzzled me for quite some time because the explanation was that this address pointed to localhost and the traffic should have never reached the internet. Then I found out that this address had an IP associated with it. That made me thinking... Soon after, this "massive internet slowdown" happened, I started googling for a solution and found this discussion and the explanation. I do have Kaspersky Internet Security on my Windows 10 PC.

So, I installed the latest beta of AdGuard which is working fine by the way. I rebooted the PC just in case. The WFP driver is enabled and Kaspersky is scanning HTTPS as before. I thought I'd stop seeing queries to `local.adguard.com` but I still see them, although not as many. Is there an explanation to this?

 

[DanMagicSausage]

@DanMagicSausage is it possible to have a remote access session so that I could troubleshoot it? The problems you describe aren't yet reported by beta testers and I'd like them to be resolved asap.

A remote session is not doable, sorry. Do you guys have an archive with older versions in it? I want an older version that worked for me.

 

[avatar]

So, I installed the latest beta of AdGuard which is working fine by the way. I rebooted the PC just in case. The WFP driver is enabled and Kaspersky is scanning HTTPS as before. I thought I'd stop seeing queries to `local.adguard.com` but I still see them, although not as many. Is there an explanation to this?

Browser thinks that it makes a request to "local.adguard.com". In order to do it, it needs to find its IP address so it makes a DNS request.
AdGuard, in turn, needs to know what IP address should be intercepted so it also makes a DNS request periodically.

A remote session is not doable, sorry. Do you guys have an archive with older versions in it? I want an older version that worked for me.

Just download it from the website, 6.3 is not released yet.