Author Topic: Emergency Update 2013-11-21?  (Read 129083 times)

0 Members and 1 Guest are viewing this topic.

Offline ky331

  • Sr. Member
  • ****
  • Posts: 303
Emergency Update 2013-11-21?
« on: November 23, 2013, 02:21:37 PM »
This morning (23 Nov.), WinPatrol alerted me that avast had placed an emergency update in my startup, to be run upon reboot.

Emergency Update 20131121 (presumably the date, 2013-11-21) ,
filename:  4749EAC5-AD58-436B-8F6C-CB01BA377D62.EXE
[EDIT:  It seems the executable filename is random/different for every person.]

At first, I thought/expected this was a RUN-ONCE, to fix something... but after rebooting (and presumably having run), I see it remains in my startup list to be run EVERY time I reboot.

1) Can someone enlighten us as to the nature (reason) for this emergency update?   What did it address/fix?
2) Why is this fix running every time I reboot, rather than just doing the job once?

System info:  Avast 8 on Win7x64 Pro SP1
« Last Edit: November 23, 2013, 10:04:53 PM by ky331 »
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! 17 Free, MBAM3 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, uBlock Origin, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner). 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

iroc9555

  • Guest
Re: Emergency Update 2013-11-21?
« Reply #1 on: November 23, 2013, 02:59:17 PM »
At first, I thought/expected this was a RUN-ONCE, to fix something... but after rebooting (and presumably having run), I see it remains in my startup list to be run EVERY time I reboot.

1) Can someone enlighten us as to the nature (reason) for this emergency update?   What did it address/fix?
2) Why is this fix running every time I reboot, rather than just doing the job once?

I am also curious to know.

BearPup

  • Guest
Re: Emergency Update 2013-11-21?
« Reply #2 on: November 23, 2013, 03:11:12 PM »
Please add me to this growing list of people with questions regarding this "Emergency Update". I rarely reboot my computer - generally only when software requires me to do so.

1. So, for how many reboots does this need to be run?
2. Do I back this up as part of my weekly backup, or exclude it as its only temporary?

Assistance is appreciated.
Regards,
BearPup

Tetsuo

  • Guest
Re: Emergency Update 2013-11-21?
« Reply #3 on: November 23, 2013, 03:19:39 PM »
but after rebooting (and presumably having run), I see it remains in my startup list to be run EVERY time I reboot.

Same here.

System Info:
Win XP Pro SP3
Avast! Free AV 9.0.2008
Online Armor Free 7.0.0.1866 (Web Shield - off)
*Avast!/OA mutually excluded

Offline miguelgrado

  • Advanced Poster
  • **
  • Posts: 801
  • Admin ForoAntispyware
    • Foroantispyware
Re: Emergency Update 2013-11-21?
« Reply #4 on: November 23, 2013, 03:48:09 PM »
idem...now I have just reboot again my PC and the same case :o

Offline miguelgrado

  • Advanced Poster
  • **
  • Posts: 801
  • Admin ForoAntispyware
    • Foroantispyware
Re: Emergency Update 2013-11-21?
« Reply #5 on: November 23, 2013, 04:03:22 PM »
I think it is a bug of avast... I'm back to restart the pc is run again (like this in normal home..) update in the Task Manager, but the patch already applied this and exclusions work... disable self-defense of avast, remove the executable from the folder empupdate and then with ccleaner it delete the entry into home...reboot and everything is ok..

seeker15

  • Guest
Re: Emergency Update 2013-11-21?
« Reply #6 on: November 23, 2013, 07:09:25 PM »
I just deleted the startup entry assuming that it dates back to November 21 and being modified on 23rd, it did its work by now. If it didn't, then it would create again maybe (the actual .exe wasn't deleted). There is no reason an emupdate should stay on startup entry for that long even after several reboots. No problems so far.

Tetsuo

  • Guest
Re: Emergency Update 2013-11-21?
« Reply #7 on: November 23, 2013, 07:26:42 PM »
I just deleted the startup entry assuming that it dates back to November 21 and being modified on 23rd, it did its work by now. If it didn't, then it would create again maybe (the actual .exe wasn't deleted). There is no reason an emupdate should stay on startup entry for that long even after several reboots. No problems so far.

I did the same, but before deleting the executable (Avast\setup\emupdate), I manually launched it - just to be sure...

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88854
  • No support PMs thanks
Re: Emergency Update 2013-11-21?
« Reply #8 on: November 23, 2013, 07:35:32 PM »
Well this doesn't look like it is a run once affair but a regular startup entry now. Given that it has the /check parameter after the path in the startup command.

So I don't think this is something that you should remove, I don't know if subsequent running of the hidden scheduled task for AvastEmUpdate.exe would replace it.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline ky331

  • Sr. Member
  • ****
  • Posts: 303
Re: Emergency Update 2013-11-21?
« Reply #9 on: November 23, 2013, 07:45:01 PM »
I'm assuming that, since instituted as a RUN (as opposed to a RUN ONCE), this is what avast intended --- for whatever reasons yet unbeknownst to us.   As such, I have kept the startup entry intact.   I have rebooted two or three times since, with no obvious/overt problems, so it seems repeatedly running this process is not causing me any harm.

Hopefully, someone high "in-the-know" will eventually reply, telling us WHAT this update is doing, and whether its continual running on each reboot is required or not.   Ideally, avast can issue another RUN-ONCE update to remove this, if that's deemed the appropriate course of action.
« Last Edit: November 23, 2013, 07:46:34 PM by ky331 »
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! 17 Free, MBAM3 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, uBlock Origin, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner). 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

Offline ky331

  • Sr. Member
  • ****
  • Posts: 303
Re: Emergency Update 2013-11-21?
« Reply #10 on: November 23, 2013, 07:47:25 PM »
DavidR,

Can you explain the meaning and purpose of the /CHECK parameter?
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! 17 Free, MBAM3 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, uBlock Origin, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner). 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88854
  • No support PMs thanks
Re: Emergency Update 2013-11-21?
« Reply #11 on: November 23, 2013, 07:49:41 PM »
My assumption is/was that when run, it checks for the presence of an emergency update.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline ky331

  • Sr. Member
  • ****
  • Posts: 303
Re: Emergency Update 2013-11-21?
« Reply #12 on: November 23, 2013, 08:09:04 PM »
DavidR replied:  "My assumption is/was that when run, it checks for the presence of an emergency update".

Since Avast already has an "Avast! Emergency Update" task that runs at every log-on as part of Task Scheduler --- presumably checking (online) for the existence of an emergency update, and if found, either running it immediately, or setting-it-up to run [once] on the next reboot --- why would it (suddenly now) need a separate startup entry to check for the presence of an emergency update?
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! 17 Free, MBAM3 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, uBlock Origin, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner). 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]

Offline miguelgrado

  • Advanced Poster
  • **
  • Posts: 801
  • Admin ForoAntispyware
    • Foroantispyware
Re: Emergency Update 2013-11-21?
« Reply #13 on: November 23, 2013, 08:26:48 PM »
I eliminated it of start (turn off self-defense in avast) after verifying that it was executed in every reboot again and that the patch fulfilled his fucion in exclusions of the web shield..deleted also .exe of folder empupdate..all ok...
« Last Edit: November 24, 2013, 09:34:53 AM by miguelgrado »

Offline ky331

  • Sr. Member
  • ****
  • Posts: 303
Re: Emergency Update 2013-11-21?
« Reply #14 on: November 23, 2013, 09:31:14 PM »
Another thing that's in need of explanation:   While I believe we're all talking about the same "emergency update", 20131121, it seems that it's being given a separate (random) EXEcutable filename on each person's system.   That is typically a sign of malware.

On the other hand, the file IS digitally signed by avast, so it should be legitimate.
« Last Edit: November 23, 2013, 09:33:31 PM by ky331 »
Lenovo T530 laptop, Intel Core i5-3320M @ 2.60 GHz, 8GB RAM, Windows 7 Pro SP1 (64-bit), avast! 17 Free, MBAM3 Pro, Windows Firewall, MVPS HOSTS file, OpenDNS Family Shield, Zemana AntiLogger Free, SpywareBlaster, IE11 & Firefox [both using WOT (IE set to WARN, FF set to BLOCK)], WinPatrol PLUS, uBlock Origin, MBAE, MCShield, CryptoPrevent, SAS (on-demand scanner). 
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]