Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Beta - Avast => Topic started by: petr.kolacek on June 09, 2022, 02:04:48 PM

Title: New beta version 22.6.6017
Post by: petr.kolacek on June 09, 2022, 02:04:48 PM
Hi everyone,

there is a new beta version ready - 22.6.6017 (build 22.6.7306).

What was fixed

Known issues

Download links
Avast Free: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_FREE/platform_WIN/installertype_ONLINE/build_BETA
Avast Premium: https://bits.avcdn.net/productfamily_ANTIVIRUS/insttype_APR/platform_WIN/installertype_ONLINE/build_BETA
Avast Clear: https://s-beta9x.avcdn.net/beta9x/avastclear.exe

Enjoy this beta!
We are looking forward to your feedback.

AVAST Team
Title: Re: New beta version 22.6.6017
Post by: Asyn on June 09, 2022, 03:16:17 PM
Thanks Petr, already up and running.
Title: Re: New beta version 22.6.6017
Post by: Asyn on June 09, 2022, 03:19:19 PM
For the interested ones, there's a new feature/setting in WebShield.
Title: Re: New beta version 22.6.6017
Post by: NON on June 09, 2022, 04:02:46 PM
Thanks for the new beta :)
Title: Re: New beta version 22.6.6017
Post by: tk6 on June 10, 2022, 01:33:11 AM
No problems with this version other than COM port device enumeration at boot is still broken (and has been for 2 years!).  The ports get opened (DTR asserted), but it appears that proper configuration is blocked so Windows can't use PnP to see what's out there.  Switching Avast to passive mode or removing Avast completely is all that will allow device discovery at boot to work correctly.  Once the system is up, manually running a "check for new devices" works and correctly finds what's attached.

Fortunately, there's a workaround -- schedule a task for 15 seconds after startup to run "devcon.exe rescan", but Avast shouldn't be breaking this stuff at boot time.

It's interesting that this is exactly the same problem I had with a new USB mouse until a couple of versions ago (22.1?).  The mouse was dead until after the rescan.  Now it's alive immediately.
Title: Re: New beta version 22.6.6017
Post by: Asyn on June 10, 2022, 01:59:19 PM
For the interested ones - new settings in GA.
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 10, 2022, 03:46:53 PM
Since version 22.6.6016 Beta for both Avast Free and Avast One, one of my startup programs won't start up with Windows. I think it has something to do with 'Improved driver blocking in ELAM driver (Early Launch AntiMalware)", whatever that is. Avast should not interfere with startup programs. I even put the program folder for that program as a File Shield Exception but to no avail.

Ransomware Shield doesn't work at all. I put Editpad program as Blocked App and it doesn't block to protected folder. In the past it worked. In Strict Mode, it doesn't work at all. Tried repairing the app but nothing changed.

When I delete a firewall rule in Avast Free, the UI doesn't refresh. When I then tried to open Avast, it hangs because it takes a long time for UI to load again. It seems the UI need a long time to reload after a firewall rule deletion or change.
Title: Re: New beta version 22.6.6017
Post by: Asyn on June 11, 2022, 01:50:17 PM
When I delete a firewall rule in Avast Free, the UI doesn't refresh. When I then tried to open Avast, it hangs because it takes a long time for UI to load again. It seems the UI need a long time to reload after a firewall rule deletion or change.
Hi, not sure if it helps, but you could try turning this GA setting (screenshot) on/off.
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 11, 2022, 03:22:23 PM
TQ Asyn. I tried hardware acceleration when it first came out but it doesn't do anything for the UI.

I uninstalled Avast Free because of the bugs I mentioned esp. Ransomware Shield not working. I will reinstall when a beta fixes all three problems.
Title: Re: New beta version 22.6.6017
Post by: Asyn on June 11, 2022, 03:29:26 PM
No problem - the devs will be back on Monday.
If you can provide details/logs, please do so...
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 13, 2022, 09:50:04 AM
Since version 22.6.6016 Beta for both Avast Free and Avast One, one of my startup programs won't start up with Windows. I think it has something to do with 'Improved driver blocking in ELAM driver (Early Launch AntiMalware)", whatever that is. Avast should not interfere with startup programs. I even put the program folder for that program as a File Shield Exception but to no avail.

Ransomware Shield doesn't work at all. I put Editpad program as Blocked App and it doesn't block to protected folder. In the past it worked. In Strict Mode, it doesn't work at all. Tried repairing the app but nothing changed.

When I delete a firewall rule in Avast Free, the UI doesn't refresh. When I then tried to open Avast, it hangs because it takes a long time for UI to load again. It seems the UI need a long time to reload after a firewall rule deletion or change.

Hello ccm582, thank you for all the provided feedback and as Asyn mentioned, if you can send us so called support package, we can look at it. Simply run "c:\Program Files\Avast Software\Avast\SupportTool.exe", follow instructions and let us know the ID of the package. Thank you.
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 13, 2022, 01:19:49 PM
Thank you for your quick response. However, I can't send you the package for two reasons:

1. I have uninstalled Avast Free and am now using another AV. I would have to uninstall that AV and reinstall Avast, then uninstall Avast and reinstall that AV.

2. Your Support Tool, if I remember correctly, asks for too much info. So I can't send you that for privacy reasons.

However, Avast Beta 22.6.6015 was working fine. I can tell you that one of my programs, Hide Folders 5, will not start up when 22.6.6016 and now 6017 were installed. It can start up when Avast was uninstalled.

I added my folders in my external hard disk as protected folders in Ransomware Shield. I then removed them after I found out that RS doesn't support external drives. But Strict Mode doesn't even work for protected folders in my system drive such as the Desktop. I hope you will make RS support external hard disks as most people put data in them instead of the usual folders introduced in Windows 95 which was 27 years ago. External drives use the same drive letter when plugged in, so it should protect a folder path regardless of the disk it's on.

The UI problem had persisted for a long time. It may be also the reason why it takes two 'Restore from saved settings', with a reboot each time, to restore all my settings. The first time to restore all settings except Firewall Rules and the second time to restore the Firewall Rules.

I hope you can find out what changes made in  22.6.6016 that caused all this.

BTW, File Shield's 'Scan all files' option sometimes cause my PC to hang for several seconds. It shouldn't if it scanned just an opened file which is not too big.

I'm sorry I can't be of much help.
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 13, 2022, 01:37:50 PM
Correction to above post:

I found out what is the problem with Ransomware Shield. It works on protected folders. But it works only if I add manually the protected folders after installation. But if the protected folders are 'restored from earlier saved settings', it is as if there are no protected folders because RW doesn't work on 'restored' protected folders. So RS works but not if the protected folders are restored from saved settings.
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 14, 2022, 01:25:38 PM
Hello ccm582, thank you for your continuing support here, really appreciate  ;)

As there are multiple issues reported, let us make some order in it.

1/ Hide Folders 5 won't startup with Windows
We tested it with trial copy of the Hide Folders 5 and also contacted their support to make sure the startup of the Hide Folders is configured well and tested it with our AV BETA version and it works - the FSPro Filter Service 2 as well as the hf5.exe are running after the Windows start just fine.

Could you be more specific and let us know whether the service/program is not running or "just" some e.g. startup window from it is not started in your case?

btw: ELAM driver is Early Launch AntiMalware driver - more info about it can be found for example here: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/early-launch-antimalware.

2a/ Ransomware shield does not work well
In reply from June 10, 2022, 03:46:53 PM you wrote: Ransomware Shield doesn't work at all. I put Editpad program as Blocked App and it doesn't block to protected folder. In the past it worked. In Strict Mode, it doesn't work at all. Tried repairing the app but nothing changed.

We re-tested this scenario with Editpad and currently available BETA version of Windows AV 22.6 and ransomware shield blocks Editpad when it is in blocked apps in AV and ransomware shield has enabled protecting Documents (so therefore extensions like .txt) in its configuration.

Here we would need log files and configuration of the AV so that we can see what is happening there. However we respect that you uninstalled AV so cannot provide the information. If you eventually give it a try, let us know so we can agree on what data we would need so there is no need to send more (as you stated the Support Tool would share too much ;) ).

2b/ Ransomware shield and external drives
Currently, we support external drive in terms of e.g. hard drive - so if you for example have backup of data on some external drive you plug into the system via usb, you can choose any of the folders there to be protected and it should work well - we retested it and can confirm this.

This does not work for flash drives as those are currently not supported to higher probability the volume ID (and letter) may change and we would not be able to recognize it = thus originaly configured folder to be protected will not be.

However, this opened some internal discussion about this topic and if there is any change we are going to do, we will inform you all here on forum.

2c/ Ransomware shield does not protect folders restored from previous settings
Here we would like to be sure we understand the issue correctly - does it mean that restored Windows AV configuration (from some of the previous backup) is not used in Ransomware shield correctly so folders configured to protect data in them are not protected?

We re-tested this scenario and it worked well, so there must be something we do differently or we do not fully understand the issue. For example, it would be important to know when the backup (with what program version) was created as we are aware of some issues with it from the past. Would it be possible to share the backup with us or again the configuration and log files?

3/ Problems with UI when working with Firewall configuration
We retested this scenario and deleting a single firewall application rule took between 1-3 seconds (even on slower machine) and the UI was refreshed just fine. However, it could depend on hardware configuration of the machine as well as on number of applications and their rules on the specific screen. Here again, it would help us to get basic information about the hardware (CPU, RAM, disk drive type), log files and configuration of the Firewall to see what is happening there. Eventually to have more information so that we can induce the issue in our environment too.

4/ File Shield's 'Scan all files' option sometimes cause my PC to hang for several seconds.
Scanning all files in the File Shield configuration could cause some issues in performance area of the computer as amount of data to be scanned is simply huge. Please note that not only the file you are about to open/run is scanned but also everything the file/program needs to load/process. In a case you belive the performance of the AV is not good, we would need some performance recording from your machine (which can be enabled and sent from the AV Configuration - Troubleshooting section).

Thank you for your time, we appreciate it! Have a nice day.

On behalf of Avast team, Petr
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 15, 2022, 02:22:09 PM
Thank you, petr, for taking the time to test and respond. I have tried both Avast One and Free, stable and beta releases, the past few months, and giving feedback, so I can't try any more as I have a lot of work to do in the next months. However, I can give some feedback based on my memory when I had Avast.

1.  I also have a trial version of Hide Folders 5 and wanted to test it with Avast as I'm considering buying it. However, from 6016 Beta, hf5.exe can't start up with Avast until I uninstalled Avast. I don't know why. I then had to start hf5.exe manually. But I may not be using HF5 after trial expires.

2a. I tested RS with Editpad Lite 8 by typing something and trying to save it to the Desktop (a protected folder) with RS set to Strict and also set to block Editpad. RS blocked Editpad. But when I restored my protected folders from Saved Settings, it doesn't work in Strict and Block.

2b. I'm happy that RS supports external hard disks which is set to have the same drive letter every time it is plugged in. I agree that it shouldn't support flash drives which are meant for temporary storage to move around and which may have different drive letters when plugged in.

Since RS supports external hard disks, please let us easily set protected folders by having check boxes next to the folder list. It is tedious to set a folder one by one esp. we have many folders.

2c.  I think perhaps every time we installed an Avast version and we restore settings saved from an earlier version, it may affect something. If you tested it and find it ok, then I'm glad.

3.  The UI is the biggest problem I have as explained earlier. Does File Shield 'Scan All Files' also scan Avast components as the UI hangs similarly to FS hanging my computer by taking a long time to scan? I remember that you fixed the UI only recently.

Maybe the UI hangs due to many programs running in the background. The Avast One UI doesn't hang at all. Maybe it's due to its PC Speedup feature where background tasks are set to sleep. Maybe you can consider adding PC Speedup to Avast Free?

4. Earlier in this Forum, I was told that File Shield uses Persistent Cache and that it adds the file to the Cache the first time it is scanned. So I tried to populate Persistent Cache by Full Scan hoping FS doesn't use too much resources the same files are opened whether program files or data file. After all, if a program is added to the Persistent Cache, why does FS still scan it if there is no change to it?

I prefer to use FS 'Scan all files' as a friend told me he had malware hiding in his PC simply by using an innocent extension like .jpg or .txt or .mp4 (can't remember which).

I am sorry to tell you that I won't be free to test Avast for next few months due to my workload but I can tell you that I use Windows 10 version 21H2 on my ASUS laptop with the following specs:

Processor   Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz   2.11 GHz
Installed RAM   12.0 GB (11.9 GB usable)
System type   64-bit operating system, x64-based processor

I used Avast more than 10 years ago and recently reverted back mainly because I missed it and also because of your Firewall. Of course, I missed the malware notification voice.

I wish you and your team all the best. Sorry that I can't be of more help.
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 15, 2022, 11:38:33 PM
Hello ccm582, let me also thank you again for taking your time and provide valuable feedback.

1/ Hide Folders 5 - we are going to retest this scenario but now via updating older version (before 6016) to the actual one to see what happens and let you know here.

2a/ I just retested this with Strict mode on and it works on my machine. There must be something bad with the export. Did you restart the computer after settings import? Do you remember when did you do the settings export?

2b/ I created a requirement to have checkboxes next to the folders you want to add into the Ransomware protection and I belive it will be coded and available in some of the next versions.

2c/ OK  ;)

3/ Well, the problem with UI can be caused by the fact the UI needs to load some stuff out of the AV itself in order to work so that it could be slower as the system is due to this. Interesting is the information regarding Avast One being better in this than the AV.

4/ File scanned again by our AV (although added to persistent cache last time) could be caused by e.g. updating the virus database. The first time we scanned the file and reported it as clean may change as we could add detection of it to the latest virus database. In other words, we cannot simply skip testing already tested files just because of past results.

I prefer to use FS 'Scan all files' as a friend told me he had malware hiding in his PC simply by using an innocent extension like .jpg or .txt or .mp4 (can't remember which).
Well, if there is an infected file with such extension, it would not cause any damage to your computer until renamed back to the original extension to be interpreted by the system based on its origin or until there is some way in the application that will run it (work with the file) as e.g. jpg file to take advantage of some vulnerability in it.

The "Files with recommended extensions" is I would say safe enough to work with the computer on daily basis and if I would like to be super-sure there nothing on your computer (although just stored there) I would schedule full scan with Scan all files option to eventually remove anything left on the device while having good performance of the system itself and still be protected very well (saying very well based on scoring in e.g. last AV comparatives tests: https://www.av-comparatives.org/tests/real-world-protection-test-february-may-2022/ where default settings is used).

BTW: thank you for sharing your hw configuration with us.

Petr
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 16, 2022, 09:00:52 AM
Thank you, petr, again for responding so quickly.

I forgot to mention earlier that I'm using a SSD in my laptop and a HDD external hard disk for data so that I don't lose data in case my Windows crash which it did in the past due to Windows Updates.

1/  I may not be using Hide Folders 5 after its trial is over. But this may be important for those who bought it and will use it permanently.

2a/  I did restart after Import as Avast prompted me too. If I didn't, my Settings will not be imported. I did last Export of settings during Beta 6015. I remember doing an Export of same settings in Beta 6017 to test whether it would solve the RS problem.

3/  I feel that Avast One feels lighter than Avast Free because I think the latter has more settings and features. Even with FS set to 'scan recommended extensions', Avast Free's UI tends to hang a lot after adding, deletion or changing of Firewall Rules.

4/  As you're the expert, I will take your advice that FS scanning recommended extensions is enough and the next time I reinstall Avast, I will do that. As I used Avast Free to scan all files, I can use Avast One as it won't be necessary to scan all files and there won't be a UI problem. But Avast One doesn't have a Dark Mode/Themes and anti-fingerprinting.

It is a good idea to do Full Scan to make sure the system is clean. In Avast Free Exceptions, we can add a folder/file to prevent File/Behaviour Shield from scanning it but allow other scans such as Full Scan. But in Avast One Exceptions, there is no such choice and so the folder/file will not be scanned by File, Behaviour and other Scans. Can you either have Avast One have the same option as Avast Free, OR have a sliding button next to each item to activate/deactivate the Exception without having to delete the item and then adding it again just to scan it.

BTW, I hope you can answer some concerns raised in this Forum:

5.  There are YouTube test videos, raised in this Forum, that Behaviour Shield and Ransomware Shield are not as good as other AVs in protecting against zero-day ransomware/malware. Avast is only good if there are virus definitions. Your thoughts?

6.  I tried two other AV programs with the simple Eicar test virus. When detected, they take a long time to delete it because they have to 'disinfect' the system first to find out whether the virus caused damage. Avast will block and send to Quarantine the Eicar test virus almost immediately. Without 'disinfection', can any malware cause damage or does Avast block them from acting immediately? What about malware that acts during PC startup?

7. Windows 10's Firewall has option to block all incoming connections. If in Avast Firewall, I set my network to Untrusted which is supposed to block all incoming connections, why did I get a pop-up asking whether I will allow 'System' incoming connection?

Title: Re: New beta version 22.6.6017
Post by: guy.rouillier on June 16, 2022, 12:03:56 PM
Copying from your previous post about beta 6016.

I've been an AVAST user for 10+ years.  Worked flawlessly until  recently.  I have been struggling for the last 1-2 weeks with constant virtual machine errors when running VirtualBox.  Google searches only found many articles saying to turn off Hardware-Assisted Virtualization, but this setting was unchecked on my system. The only way I could run a virtual machine was to temporarily disable all shields, which is obviously not a good solution.

I installed this beta, and initially I was able to start up multiple VMs without error, both running different versions of Linux.  Unfortunately, when I attempted to update the software in one of the VMs, I again got the popup error with title "VirtualBox - Guru Meditation", with text beginning "A critical error has occurred while running the virtual machine and the virtual machine has been stopped."  In the log file, the error recorded is VERR_VMM_SET_JMP_ABORTED_RESUME.

So for me, at least, this beta does not completely fix the issue.  Please let me know if I can provide any further diagnostic assistance.  My system is running Windows 7 Professional 64-bit, and my hardware is dual AMD Opteron 4324.  Avast is reporting its version as 22.6.6017.
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 16, 2022, 01:57:28 PM
Copying from your previous post about beta 6016.

I've been an AVAST user for 10+ years.  Worked flawlessly until  recently.  I have been struggling for the last 1-2 weeks with constant virtual machine errors when running VirtualBox.  Google searches only found many articles saying to turn off Hardware-Assisted Virtualization, but this setting was unchecked on my system. The only way I could run a virtual machine was to temporarily disable all shields, which is obviously not a good solution.

I installed this beta, and initially I was able to start up multiple VMs without error, both running different versions of Linux.  Unfortunately, when I attempted to update the software in one of the VMs, I again got the popup error with title "VirtualBox - Guru Meditation", with text beginning "A critical error has occurred while running the virtual machine and the virtual machine has been stopped."  In the log file, the error recorded is VERR_VMM_SET_JMP_ABORTED_RESUME.

So for me, at least, this beta does not completely fix the issue.  Please let me know if I can provide any further diagnostic assistance.  My system is running Windows 7 Professional 64-bit, and my hardware is dual AMD Opteron 4324.  Avast is reporting its version as 22.6.6017.

Hi guy.rouillier, if you would be so kind, could you please isolate which of the shields in AV are enough to disable in order to solve the problem so we at least know which one is causing it + send us support package (with log files, etc.) by executing "c:\Program Files\Avast Software\Avast\SupportTool.exe". Thank you very much for your cooperation. Petr
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 16, 2022, 02:59:11 PM
Hi ccm582, let me inform you that I successfully induced the issue with the Hide Folders 5 application and created a ticket for devs to check/fix it. Will keep you informed about it ;) I will also respond to your recent post later today. Have a nice day! Petr
Title: Re: New beta version 22.6.6017
Post by: guy.rouillier on June 17, 2022, 06:20:57 AM

Hi guy.rouillier, if you would be so kind, could you please isolate which of the shields in AV are enough to disable in order to solve the problem so we at least know which one is causing it + send us support package (with log files, etc.) by executing "c:\Program Files\Avast Software\Avast\SupportTool.exe". Thank you very much for your cooperation. Petr

Here is what I've been able to isolate to the best of my abilities, not knowing the inner workings of Avast.  First, I have to reboot and before starting any apps, disable all shields via the notification area icon.  If I start any apps that would activate the shields (like my browser - Web Shield - or my email client - Mail Shield), then the problem always occurs.  I'm guessing that starting an app that would cause a particular shield to be activated, like the email client activating the Mail Shield, causes all the shields to be activated.

After disabling all shields, then my VMs run without error.

I then enable Web Shield and Mail Shield; again the VMs run without error.  In addition, Avast adds 5 Notifications for the following shields being disabled:

I next enabled Ransomware, Behavior and File Shields; again the VMs run without error.  Finally, I enabled Anti-Rootkit, and the problem occurs.  In another series of tests, I tried enabling Anti-Exploit, but that also enabled Anti-Rootkit.  The problem occurs, but I believe that is because of Anti-Rootkit, not Anti-Exploit.  So Anti-Rootkit appears to be cause of this issue.

I generated the support file as instructed.  I included a screenshot of the error message that pops up when the problem occurs; I'll also attach that screenshot here.  SupportTool prompted me for a ticket number which I don't have, so I left that blank.  I hope this helps.  Let me know if I can do anything else to help isolate this problem. 

[EDIT 6/20/22] Since posting this, I discovered how to turn on and off the Anti-Rootkit Shield and Anti-Exploit Shield through the Avast UI: Menu -> Settings -> Protection -> Core Shields -> Enable Anti-Rootkit Shield / Enable Anti-Exploit Shield.  Using that, I was able to enable the Anti-Rootkit Shield but leave the Anti-Exploit Shield disabled.   My VMs continued to run without error.  When I enabled Anti-Exploit Shield, the VMs failed as described.  So, I now believe the real source of the problem is the Anti-Exploit Shield.
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 17, 2022, 09:13:38 AM
Hi ccm582, let me inform you that I successfully induced the issue with the Hide Folders 5 application and created a ticket for devs to check/fix it. Will keep you informed about it ;) I will also respond to your recent post later today. Have a nice day! Petr

Hello everybody. Please let us inform you about an issue with starting hf5.exe process from Hide Folders 5 application we discovered based on report from one of our BETA users (https://forum.avast.com/index.php?topic=319869.msg1688960#msg1688960).

After analysis we belive the issue is with checking event of created user session by Hide Folder application service fsproflt2 (SERVICE_CONTROL_SESSIONCHANGE) which may be affected after the Windows Avast Antivirus installation (changing boot timing). In other words, it may happen after installation of any other application (not only Avast Antivirus) too and therefore needs to be addressed in the Hide Folders code.

Also note that on Windows 10 there is Privacy setting "Use my sign-in info to automatically finish setting up my device after an update or restart" which is enabled by default - we belive that turning off this option will solve the issue too (but as it is on by default by MS, it would require each affected client to do so).
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 17, 2022, 10:41:57 AM
Hi guy.rouillier, thank you for your time and information provided - I created ticket for devs to look at it further. Could you please share the ID of the package from the support tool? The package can be found here: c:\Users\<your_username>\AppData\Local\AvastSupport - so its filename would be great to know. Thank you.
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 17, 2022, 10:46:27 AM
Hello ccm582.

1/ Answered in one of my previous posts  ;)

2a/ Ok, this is pretty fresh configuration export. We will test it more thoroughly next week.

3/ Yes, Avast One tends to be lighter than standard Antivirus but there are also other components related to privacy, performance etc. We will look more at the UI and Firewall rules to see whether we can induce something similar.

4a/ Avast One and dark mode - although it is available in the Antivirus, it is not planned in the Avast One at the moment (it seems simple, but it is actually not).
4b/ Avast One and antifingerprinting - it is available in the Avast One while not in the Essential (Free) edition. I shared this with the product manager of the Avast One (I am sure he is aware of this and there is a good reason for it).
4c/ Avast One vs standard AV exceptions configuration - can you tell me why would you like to have exception for e.g. shields while not for scan? I mean once the scan is done in folder not in exception for scan, it could be quarantined etc. I am not saying we cannot do this, but would like to understand the story behind ;-)

6a/ EICAR detection and disinfection
Well, EICAR test file is I would say simple definition detection and as a such does not required any disinfection simply because it is not needed. In more advanced threats, detected especially by the Behaviour Shield, there is system disinfection usually required and performed.

6b/ Basically, once the AV drivers are loaded (during the system boot) there is nothing that would escape them so although the AV application itself could be started "at some point" after the computer start (processes, services, etc.) the computer is protected already.

7/ Avast Firewall untrusted (public) network profile does not mean to block all the incoming connections. It is a much more strict profile of course then applied for trusted networks, but there are some exceptions for incoming traffic.
The flow for the incoming traffic is as follows and it is evaluated in this order: Traffic --> Network rules --> App Rules --> (Ask dialog, if enabled) -> App/System. In the section Firewall - Firewall settings - View Firewall Rules - Network rules you can see the rules that are above the rule “Public Tcp/Udp In Block” (which blocks all the incoming connections on TCP and UDP protocol). These rules are above which means they are evaluated first.
In your case, I would say that the incoming connection was allowed by the rules above the “Public Tcp/Udp In Block” and as long as Firewall did not find the existing rule in Application rules the Ask dialog was triggered. If you want to adjust the setting, it is possible to do it on the page with Basic Rules or you can create your own Firewall rules on the Network/Application Rules page.

Response to the Behavior / Ransomware Shield will be answered later ;)

Have a nice day! Petr
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 17, 2022, 12:07:58 PM
Thank you, petr, for your detailed reply. After reading it, it resolved many  doubts I have about Avast.

I will reinstall Avast before my Hide Folders trial expires and try the Privacy setting. Will let you know when I do so. I'm sure you tested it before recommending it.

My reply to your questions and points raised:

4b.  I deliberately put Eicar and a few harmless malware into a folder. So I would select all the exceptions i.e. File Shield, Behaviour Shield and Scans to prevent quarantine.

But sometimes Avast may think a program is suspicious and want to quarantine it although the program is perfectly fine. So it is a false positive. It may take a long time for Avast to find it to be ok. So I set it to excluded from all Shields except Scan. When I scan it, I will know whether Avast still think it is malware. If by then it is cleared of suspicion, I can remove the exception. Avast Free allows me to do that but Avast One will exclude the folder from all shields and scans. This is one reason I prefer Avast Free.

In Avast One, you may not need to have exactly the same Exception options (Scan, File Shield...) as Avast Free. There are already checkboxes there. In addition to 'Remove' button at bottom, how about 'Enable/Disable' button at bottom too. Then we don't have to delete the Exception to scan, then add it back again.

4c.  I think Avast One excludes anti-fingerprinting to encourage Premium sales. I can live without anti-fingerprinting because Firefox and Brave browsers have it built in. There are also many browser extensions that do this so I don't think anyone would buy Premium just for this. This is similar to Avast One's VPN with Killswitch for Premium only. There are free VPNs that offer more data and Killswitch together which is why I don't use Avast VPN. A VPN without Killswitch is not safe.

6a. I have never seen Avast disinfection in progress as I never got any serious malware or ransomware. Are you saying that if a serious ransomware hits, Avast will block, quarantine it and then do a 'disinfection' to see whether it did any damage? If so, can it reverse the damage?

6b.  If my internet is on during boot-up, does Avast Firewall also stop my 'blocked applications' from accessing the internet if Avast starts AFTER the blocked app?

7.  In Avast Free or One, it is stated that Untrusted networks will block incoming connections. This may cause misunderstanding so perhaps you may want to re-word it.

Your explanation makes many things clear now. I used Comodo Firewall before which has a network rule of blocking all incoming connections after allowing outgoing connections and allowing a couple of ICMP incoming connections.  I suppose I can create a Network Rule to block all incoming connections and put it at the top. BTW, creating a Rule places it at the bottom. Then I have to drag it all the way past many rules to put it at the top. Any chance of a checkbox with go up/down/top/bottom arrows?

I look forward to your Ransomware/Behaviour Shield replies that I'm sure will answer many points raised in this Forum.
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 17, 2022, 02:09:53 PM
Hi ccm582, just for the Hide Folders - well, some of us were not able to induce the issue at all as it is matter of timing. For me personally, the Privacy configuration did not help. We also contacted vendor of the software and they recommended the following:

In Registry Explorer browse to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fsproflt2 and change Group value from UIGroup to Event Log. This helped on my machine but I would not consider it as "final" solution as it requires user interaction to solve the problem (not even talking about working with registry etc.).

However, the only way to solve the issue for all is from the vendor to change the code ;)

I will look at your reply next week and get back to you. Have a nice weekend! Petr
Title: Re: New beta version 22.6.6017
Post by: guy.rouillier on June 18, 2022, 01:16:18 PM
Could you please share the ID of the package from the support tool? The package can be found here: c:\Users\<your_username>\AppData\Local\AvastSupport - so its filename would be great to know.

I believe you are referring to the name of the generated zip file.  If so, that is: 20220617_0407_YNQ3B_930869535.zip

After uploading the file, I received an email from Manigandan Mohan on The Avast Support Team, gently asking "What's this?"  :)  I will reply to him with a link to this post.  If you could provide me the ticket number, I'll send him that as well. I have an Avast account with an email address if you would prefer to send the ticket number privately.

Thanks. 
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 18, 2022, 01:22:47 PM
Hi Petr,

I had some time today and so I tested with both Avast One and Avast Free both version 22.6.6019 Beta.

The Registry solution worked. Hide Folders 5 now start up with both Avast Free and One.

Ransomware Shield sometimes work and sometimes doesn't. In Avast One,  for external drives, Ransomware Shield displayed this behaviour:

On PC reboot with external drive plugged in:

- RS doesn't work
- files deleted from external drive goes to its Recycle Bin.

If I pull out the external drive and plug it back in again,

- RS works
- files deleted are deleted permanently and doesn't go into Recycle Bin. RS makes the external hard disk into a flash drive where there is no Recycle Bin.

I then uninstalled Avast Free because of its UI problems, and Avast One because I want my deleted files to go into Recycle Bin instead of being deleted permanently.
Title: Re: New beta version 22.6.6017
Post by: Asyn on June 18, 2022, 01:36:51 PM
Could you please share the ID of the package from the support tool? The package can be found here: c:\Users\<your_username>\AppData\Local\AvastSupport - so its filename would be great to know.
I believe you are referring to the name of the generated zip file.  If so, that is: 20220617_0407_YNQ3B_930869535.zip
Yes, as the name includes the File-ID, so the devs can find it on the server. ;)
Title: Re: New beta version 22.6.6017
Post by: guy.rouillier on June 25, 2022, 01:35:08 PM
I wanted to close the loop and report that my issue seems to have been fixed with the latest beta 6020.  With all Avast Shields enabled, I am able to run VirtualBox VMs without crashing.  I'll report on the 6020 thread on this forum if I encounter any more problems.

Thanks for the help.
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 26, 2022, 12:14:08 PM

Response to the Behavior / Ransomware Shield will be answered later ;)

Have a nice day! Petr

Petr,

Please reply.
Title: Re: New beta version 22.6.6017
Post by: ApoC on June 27, 2022, 09:24:58 AM
Hi Petr,

I had some time today and so I tested with both Avast One and Avast Free both version 22.6.6019 Beta.

The Registry solution worked. Hide Folders 5 now start up with both Avast Free and One.

Ransomware Shield sometimes work and sometimes doesn't. In Avast One,  for external drives, Ransomware Shield displayed this behaviour:

On PC reboot with external drive plugged in:

- RS doesn't work
- files deleted from external drive goes to its Recycle Bin.

If I pull out the external drive and plug it back in again,

- RS works
- files deleted are deleted permanently and doesn't go into Recycle Bin. RS makes the external hard disk into a flash drive where there is no Recycle Bin.

I then uninstalled Avast Free because of its UI problems, and Avast One because I want my deleted files to go into Recycle Bin instead of being deleted permanently.

Hi, I would say this is not Anti Ransomware feature, it seems more like a Avast Shredder (https://support.avast.com/en-us/article/use-antivirus-data-shredder/)
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 27, 2022, 10:11:12 AM
The above refers to problem with only Avast One and only after importing Settings. This problem doesn't exist in Avast Free. Avast Shredder is a Premium feature while I used free version, so it is disabled. So I don't think it is problem with Shredder.

I found the cause of this problem. Restoring settings from an earlier version of Avast One, and then restarting the PC, cause external hard disks to be treated as flash drives without Recycle Bin after they are unplugged and inserted later.
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 27, 2022, 11:10:38 AM
Earlier I tried Avast Free and its Ransomware Shield sometimes work and sometimes doesn't. But in latest beta 22.6.6021 (build 22.6.7351.528) of Avast Free, Ransomware Shield works fine even in protected folders on external drives. Thank you for fixing it.
Title: Re: New beta version 22.6.6017
Post by: petr.kolacek on June 28, 2022, 02:05:31 PM

Response to the Behavior / Ransomware Shield will be answered later ;)

Have a nice day! Petr

Petr,

Please reply.

Hello ccm582, I reminded it to my colleague from the team responsible for this features so the answer is more precise. Stay tuned  ;)
Title: Re: New beta version 22.6.6017
Post by: ccm582 on June 28, 2022, 03:35:30 PM
Petr,

Please read some of my posts here since you were away esp. the Registry solution worked. Hide Folders 5 now start up with both Avast Free and One. TQ for the solution.

I installed Avast Free 22.6.6022 (build 22.6.7355.528) and it seems to work better than before. It can send malware to Quarantine faster than before. But every time I add, change or delete a Firewall Rule, the UI hangs for a few minutes. Hope your team can fix this soon.
Title: Re: New beta version 22.6.6017
Post by: ccm582 on July 06, 2022, 09:01:57 AM
Disappointing that no one replied as promised.

Anyway, I think I know the answer from the Youtube tests. Ransomware Shield and Behaviour Shield alone isn't very effective. But AV-Comparatives said they tested Avast with all the Shields turned on and it performed well at malware detection. So I suppose that Avast is to work with all the Core Shields turned on which means that it depends on the definitions either online or offline. But I do have concerns about zero day malware/ransomware.
Title: Re: New beta version 22.6.6017
Post by: fspro on July 10, 2022, 02:30:20 PM
Hi ccm582,

I'm working at FSPro Labs (a developer of Hide Folders 5) and we probably have fixed an incompatibility problem between Avast and HF5.
Download the latest version of our program and check if autostart works for you. If not, please contact our support team.