Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Rundvleeskroket on July 23, 2019, 04:50:21 PM

Title: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 23, 2019, 04:50:21 PM
Hi.

I want to disable the rootkit detection in the Core Shield. To test something. But it won't let me. When I uncheck the box Avast immediately returns me to the main status screen and the setting hasn't been changed.

I can uncheck the nested exploit detection box, but not the main "Enable Rootkit detection" box. It won't work.

The thing I'm trying to test is a weird behavior of my PC where when I start a program it randomly sometimes sits there for about 10 seconds doing nothing. Waiting. No notable CPU activity, no disk activity, no network activity. Seemingly. So I want to test if this is caused by some component of Avast Free.

But as it is I can't seem to even test this.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 24, 2019, 06:33:34 AM
I want to disable the rootkit detection in the Core Shield. To test something. But it won't let me. When I uncheck the box Avast immediately returns me to the main status screen and the setting hasn't been changed.

I can uncheck the nested exploit detection box, but not the main "Enable Rootkit detection" box. It won't work.
Confirmed, same here.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 24, 2019, 08:53:41 AM
Note, the devs are working on a fix...
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 24, 2019, 09:30:37 AM
Update, is has been fixed in UI V1.0.394 (released a few minutes ago).
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 24, 2019, 10:46:29 AM
Update, is has been fixed in UI V1.0.394 (released a few minutes ago).

How was this released, as a manual program update reports the program is up to date, but the UI is still 1.0.382.  Are you talking about the current beta or the regular program version ?
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 24, 2019, 11:07:28 AM
Hi Dave, the UI has its own/separate update channel. It might take a while to propagate to all servers.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 24, 2019, 12:37:31 PM
Hi. I just checked for updates manually. UI is version 1.0.390. Still has the bug. I'll check later today.

Thanks for the fast response.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 24, 2019, 12:54:38 PM
You're welcome.
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 24, 2019, 04:45:01 PM
Hi Dave, the UI has its own/separate update channel. It might take a while to propagate to all servers.

Thanks, still no joy as yet though.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 24, 2019, 07:48:55 PM
Still no new version available.
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 24, 2019, 09:34:10 PM
Still no new version available.

Snap still no change.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 25, 2019, 05:49:51 AM
Still no new version available.
Snap still no change.
Hi guys, same here, I'll report it...
Title: Re: I can't disable Rootkit detection
Post by: rocksteady on July 25, 2019, 10:45:55 AM
I'm still stuck on UI 1.0.387, even after manual update attempts that came to nothing.

Update: Just did a Restart (boot) and now have UI 1.0.390, but not 394 with the fix yet.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 25, 2019, 11:41:56 AM
Same here. 390.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 25, 2019, 08:07:31 PM
Hi guys, I got updated to UI V1.0.394 today.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 25, 2019, 08:46:58 PM
I've manually checked several times during the day, including just now, and nothing. Still 1.0.390.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 25, 2019, 08:51:18 PM
See if it helps to reboot twice...
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 25, 2019, 09:05:43 PM
Well I did an About Avast and nothing out of the ordinary, but on going into Settings > Update, it reported virus definitions out of date.  I just wondered if this might be the delivery, but still on 1.0.382.

Going to reboot to see if that does anything.

EDIT: 1st reboot went to 1.0.390 about to reboot again.

EDIT2:   Nada, still on the slightly newer UI version 1.0.390.
Title: Re: I can't disable Rootkit detection
Post by: schmidthouse on July 25, 2019, 09:31:45 PM
Hi. I just checked for updates manually. UI is version 1.0.390. Still has the bug. I'll check later today.

Thanks for the fast response.

Yup still .390 here as well
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 25, 2019, 10:55:36 PM
Still 390 after reboot.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 25, 2019, 11:05:15 PM
Well, no idea then. According to the devs it has been released and I can confirm it.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 25, 2019, 11:18:53 PM
Mine is ver. 19.6.2383 - build 19.6.4546.511

Just tried to update. Still the same version from a month ago. June 25th 2019.

Does the release cycle differ between premium and free?
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 25, 2019, 11:28:23 PM
Does the release cycle differ between premium and free?
Nope, I'm on beta channel.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 25, 2019, 11:32:56 PM
I'm not. Regular channel (I assume). Free version. Maybe it is still in beta then.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 25, 2019, 11:34:51 PM
According to the devs, they also pushed it to stable channel.
Title: Re: I can't disable Rootkit detection
Post by: schmidthouse on July 25, 2019, 11:42:17 PM
Hi. I just checked for updates manually. UI is version 1.0.390. Still has the bug. I'll check later today.

Thanks for the fast response.

Yup still .390 here as well

Yes, I initially checked my Regular channel version installation which is .390
I have subsequently checked my Beta Channel installation and it is .394
So there's the difference :)

Edit: I will be watching for the update on Regular installation

Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 25, 2019, 11:52:02 PM
Yeah I'm not keen on beta-testing with an AV. I'll wait.
Title: Re: I can't disable Rootkit detection
Post by: rocksteady on July 26, 2019, 11:12:48 AM
@Asyn. Ah you must have got priority treatment  :)
Like groundhog day here. Update>Reboot and again 390.

Edit: Sorry guys, I had missed page 2 of the thread, but my comment above is still true status of latest version available here.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 26, 2019, 12:14:25 PM
Still .390 ¯\_(ツ)_/¯
Title: Re: I can't disable Rootkit detection
Post by: bob3160 on July 26, 2019, 02:54:14 PM
Still .390 ¯\_(ツ)_/¯
Same here. I've reported it.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 28, 2019, 01:31:13 PM
Dev-Info: If you didn't get the UI update yet, there's a workaround. Open and edit avast5.ini

Code: [Select]
[AAVM]
ArPotEnabled=0
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 28, 2019, 01:54:05 PM
What does that do?

Still at .390 btw.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 28, 2019, 01:55:56 PM
What does that do?
It disables Rootkit detection.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 28, 2019, 02:14:36 PM
OK.

Well, when I try to modify that file Windows tells me it is in use and I can't save. Even if I disable Self-Defense. Now, I could edit the file from a Live-CD or something but I shouldn't have to go through all that trouble just because an update won't show up on the 'stable' channel. If it was pushed to stable it should appear, right?

Edit: OK I did it the hard way. Rootkit-detection is now disabled. Also Exploit-detection. Now I can test. However I now have a notification about the disabled Rootkit-detection that I can't dismiss. Slightly annoying but OK.

Also: why is Avast still popping up with a warning about editing Avast-files when Self-Defense has been disabled?
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 28, 2019, 02:38:41 PM
Also: why is Avast still popping up with a warning about editing Avast-files when Self-Defense has been disabled?
Post a screenshot.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 28, 2019, 02:42:51 PM
I can't now. It was an alert about editing avast5.ini, by Avast, even though Self-Defense was disabled.

Edit: Avast has now luckily figured out to offer me to ignore the notification about the disabled Rootkit-Detection. It didn't before. So that blue dot is gone. That is something.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 28, 2019, 02:50:03 PM
Edit: Avast has now luckily figured out to offer me to ignore the notification about the disabled Rootkit-Detection. It didn't before. So that blue dot is gone. That is something.
Sounds good.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 28, 2019, 02:56:53 PM
I'm not 100% sure what is going on.

I had disabled Self-Defense. Because i assumed I had to to edit Avast files. I hadn't re-enabled it, but also no notification about it being disabled was visible in the Avast status screen. So that is already weird. I tried to edit the file and it said it was in use and I couldn't save. I tried another method to edit the file and now I could save, but I got the alert popup about if I was sure? Now, still I hadn't re-enabled Self-Defense. But Avast must've re-enabled it itself because when I went to turn it back on I found it on already. So again: weird behavior. Especially because I just disabled Self-Defense again (to test) and now it stays off. So why didn't it earlier? I just don't know.

I hope the update will show up soon so I can use the UI for these changes.
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 28, 2019, 03:02:50 PM
I hope the update will show up soon so I can use the UI for these changes.
If you're in a hurry, you could install the latest beta: https://forum.avast.com/index.php?board=15
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 28, 2019, 05:11:07 PM
I can't now. It was an alert about editing avast5.ini, by Avast, even though Self-Defense was disabled.
<snip>

Not only do you have to disable the avast self-defence module, but you have to use notepad.exe the windows text editor (that is the only one allowed) to be able to edit the avast5.ini file.

I don't know if you were using notepad for the edit.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 28, 2019, 07:13:31 PM
I was using a different editor the first time. What kind of weird restriction is that????



I hope the update will show up soon so I can use the UI for these changes.
If you're in a hurry, you could install the latest beta: https://forum.avast.com/index.php?board=15

Like I said before; i don't feel like beta-testing an AV. Now that I have disabled Rootkit-detection and Exploit-detection via the .ini I'll have to see if the sudden pauses are gone. They might well have nothing to do with Avast, but at least I can test it now to exclude them as possible problems :)
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 28, 2019, 07:37:13 PM
I was using a different editor the first time. What kind of weird restriction is that????

It has been like that for as long as I can remember and I have been using Avast (and editing the avast5.ini file) for over 15 years.  Back then there were many settings that could be set in the avast5.ini file.

My guess would be:
A)   it is the default (many will either be using it or it will be on their OS) text editor.
B)   it is a bog standard text editor that doesn't have any formatting, etc. (like some text editors) that could potentially stop the avast5.ini file from working after modification.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 28, 2019, 07:56:12 PM
Of course you shouldn't have to edit the ini-file if the UI actually works.
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 28, 2019, 09:04:46 PM
Of course you shouldn't have to edit the ini-file if the UI actually works.

Well there are functions available in the avast5.ini file that aren't available in the UI even when it is working.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 28, 2019, 09:10:09 PM
Such as?
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 28, 2019, 10:22:39 PM
Such as?

You can change the delay of update checks beyond what is available in the UI..

This however is neither here or there in relation to why we got here:
Of course you shouldn't have to edit the ini-file if the UI actually works.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 29, 2019, 02:45:43 AM
As far as that goes: still no .394 available.

Sadly it doesn't seem that turning off the Rootkit/Exploit-detection fixes the weird pauses.
Title: Re: I can't disable Rootkit detection
Post by: Rundvleeskroket on July 29, 2019, 01:43:55 PM
.394 finally showed up! :)
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 29, 2019, 06:58:34 PM
.394 finally showed up! :)
Patience is a virtue. ;)
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 29, 2019, 08:10:44 PM
.394 finally showed up! :)
Patience is a virtue. ;)

I'm very virtuous, but it doesn't seem to be helping very much :)
Title: Re: I can't disable Rootkit detection
Post by: schmidthouse on July 29, 2019, 08:28:26 PM
.394 finally showed up! :)
Patience is a virtue. ;)

Yup, finally ;)
Title: Re: I can't disable Rootkit detection
Post by: Asyn on July 29, 2019, 08:29:32 PM
I'm very virtuous, but it doesn't seem to be helping very much :)
Well, as I doubt that you're planning to disable Rootkit detection, it's probably not that urgent. ;)
Title: Re: I can't disable Rootkit detection
Post by: DavidR on July 29, 2019, 08:42:10 PM
I'm very virtuous, but it doesn't seem to be helping very much :)
Well, as I doubt that you're planning to disable Rootkit detection, it's probably not that urgent. ;)

For me it certainly isn't urgent, which help with the patience, but when it is meant to be released, there is very little middle ground (it is or it isn't).
Title: Re: I can't disable Rootkit detection
Post by: rocksteady on July 31, 2019, 06:36:07 PM
I received 394 yesterday, but only after update and reboot.