Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: DavidR on April 26, 2008, 04:43:58 PM
-
I think the subject says it all, since the 4.8.1185 beta update if you do a manual update you get the avast4.ini File Modification alert on avast.setup.
What would avast.setup need to access avast4.ini for but more important why is the avast.setup not a whitelisted application ?
-
I need to boot to test that... just updated to latest beta few minutes ago...
-
I've made manual program update yesterday and didn't obtain any modification alert. So it is not common problem.
-
Sounds like something for Vlk...
Can you please post the content of HKLM\System\CurrentControlSet\Services\aswSP\Parameters key?
-
See image 1 for contents.
Just tried a manual update and I don't know if it is because there are no updates, but I didn't get the alert again.
-
Hi all!
I have the same problem after updating to 1185. I got this message twice today and as far as I remember I did not hear that voice telling that my virus database was update. Unfortunately when I try manual updates I do not get this message but I I am not sure if this is because there are no new updates.
Thanks!
-
I have the same problem after updating to 1185.
Did you boot after updating?
-
Interestingly, just not I have done a manual iAVS update and there was a VPS update available and it was downloaded and installed with no avast4.ini file modification alert, weird.
-
This alert has occurred twice on two different machines, one with XP Home the other with XP Pro, both running SP3-RC2. I have been allowing the countdown to the default "NO," with apparently zero problems, at least so far.
-
Hmmm... why isn't this process whitelisted? ???
-
I'm sure it is just a simple oversight, soon to be fixed.
-
My system (WinXP SP2) is set for automatic updates.
I just started the system and the avast.setup prompted the avast4.ini update screen trying to update from 080426-0 to 080427-0.
-
Got a similar problem with maybe a few more helpful details in a new thread I accidentally made. The information can be found here though:
Well I'm not sure if this is a glitch or not, but for some reason I received the warning that the avast! INI file was being modified by avast's own setup program! The details of this message can be seen in the picture I attached, and I can also say that this has never happened to me before until now. How I got to this was quite out of the blue since I wasn't running anything else at the time, however I think it may have had some connection with me continually invoking the update procedure just to check for new updates. If there's anything else I can do to help diagnose this problem, I'll see what I can do.
Also, after getting the error message, if you simply click "yes" and then retry updating again it won't produce the error message which is rather odd.
-
I had the same experience (I think) as Solemn.
The pup-up that occurred during the avast automatic update on my system resulted in a red pop-up window from avast saying that an error had occurred in updating. avast showed I was still on 080426-0. A little later I did a manual update which took me from 080426-0 to 080427-1 but this time without any alerts from avast.
-
We will have to see if answering Yes has the effect of whitelisting the application, dangerous, if accidental and there appears to be no way to correct this.
Another possibility, perhaps the 080127-1 corrected the issue with avast.setup, though it wouldn't take effect until after successful update. Or the Yes is good for that session until you reboot, which doesn't appear to be the case as there was a day and a reboot between my previous posts, original post and Reply #4, Reply #7.
Whatever it might be I think we need some clarification from the Alwil team on what actions are taken on answering Yes and is there a way to correct this if the answer was incorrect ?
-
In support of your thoughts above David ...
I just restored my system to the start of day. On restarting the system the avast automatic update was now going from 080426-0 to 089427-1 and the automatic update proceeded without any alert. It may well have been an oddity with the 080427-0 update.
-
In support of your thoughts above David ...
I just restored my system to the start of day. On restarting the system the avast automatic update was now going from 080426-0 to 089427-1 and the automatic update proceeded without any alert. It may well have been an oddity with the 080427-0 update.
Hmm... I don't believe so as the signature file I had during this issue was the 080426-0 one which may indicate that it could've been either an older false positive of some sort or nothing to do with the signatures at all. But other than that I'd also love to hear more about this as I hope I didn't accidentally whitelist anything.
-
@ Alan
I don't know as it first happened to me on the 26th so before the 080427-0 VPS update and I had no alert when going from 080426-0 to 080427-0 as my reply #7 image shows. I also didn't get an alert going from 080427-0 to 080427-1.
So my alert would appear to have been between 080425-0 and 080426-0
So it is another mystery ??? which needs clarification.
-
Well the mystery deepens, I have just had an auto update check kick off and even though there was no update available it was enough to throw up the avast4.ini file modification alert again.
This is becoming tiresome why oh why is avast.setup not whitelisted if it must have write access to avast4.ini ?
Even more so what is it doing opening the avast4.ini with write access if there isn't even an update to download ?
What changes would it be making to the avast4.ini after an update ?
-
Alan reminds David that we are in a beta program ... so we voluntarily signed up for tiresome and this is clearly a screw-up that must be just as embarrassing to the team (somebody is gonna have to buy beers all round to the rest of them - though sadly not us).
-
(http://www.clicksmilies.com/s1106/ernaehrung/food-smiley-004.gif)
-
Yes, I rebooted right after updating to 1185. Today, autoupdate updated the virus database to 082428-0 and the message did not show up.
I have the same problem after updating to 1185.
Did you boot after updating?
-
yep i remember i got it once too when updating VPS just after 4.8.1185 update ...
i was like 'interesting' and not bothered to ask about it :) ... so it's flaw and not feature?
-
Yes, it certainly isn't a feature, especially considering the "random" nature.
There is a problem somewhere - but unfortunatelly the code is not that simple (as a simple "whitelisting" of avast.setup - if it were, and it had been forgotten, the window would pop up each time, not just sometimes). Vlk is checking the code, but right now the cause is unknown.
Btw, my guess is that this (http://forum.avast.com/index.php?topic=35086.0) and this (http://forum.avast.com/index.php?topic=35077.0) are actually manifestations of the same problem. Let's hope it will be found soon.
-
Yes that is most certainly the issue the random nature of the problem, I set the Update (Basic) VPS back to ask again and when the notification pop-up arrived I let it go ahead and it downloaded and installed 080428-0 without issue and no avast4.ini alert.
Happy hunting.
@ Alan
Yes I'm aware we/I'm on the beta, but we/I get spoilt with beta builds that generally present few issues ;D
-
Hehe, I see the bug now. Really a stupid one - I wonder how many beers I've had prior to writing that line of code.
Sorry for the troubles. We will do another beta refresh to solve this (and, hopefully, solve the dreaded issue of dypsis as well).
Cheers
Vlk
-
OK what was it then ;D
-
Well, we were trying to "normalize" (i.e. truncate the last two bits of) the PIDs by using this code:
PID = PID & (~4);
which is not quite correct :)
[if you have no idea what I'm talking about, don't worry ;)]
Cheers
Vlk
-
I was just wondering why it could have such random effects.
-
I was just wondering why it could have such random effects.
That's simply because PIDs are assigned more or less randomly, and the code above wasn't quite correct. :)
-
OK thanks, I shall worry you no further, happy in the fact it has been found and it will soon be resolved.
-
I second that :) ( I just came here for the same issue ;) )
Greetz, Red.
-
The problem should be solved in build 1187.
http://forum.avast.com/index.php?topic=34612.msg295052#msg295052
-
Yes the problem appears to have been solved, though the random nature of the problem it would take a few updates to be 100% sure.
Straying slightly off-topic but still related to the avast4.ini modification issue. I have however noticed another inadvertent consequence of the other changes made in the update.
The beta has now been updated to v4.8.1187.
<snip>
Main changes in this release:
- solved the intermittent self-defense process identification issue (resulting e.g. in random INI modification consent dialogs)
- attempt to solve a synchronization problem in the AV engine initialization
- changed the way INI modification consent dialog is shown. Now, it is shown only if notepad.exe is trying to access the file
Namely the - "changed the way INI modification consent dialog is shown. Now, it is shown only if notepad.exe is trying to access the file"
Now I tend not to use notepad as I had mentioned previously but Editpad Lite, now if I do that, yes there is no consent dialogue shown, but the file is opened as read only (see Editpad Lite warning image) and this isn't at all helpful, in fact I would say it is a worse consequence (as this replaces one pop-up with another and effectively blocks editing the avast4.ini with anything other than notepad).
-
I'm afraid it's not inadvertent, but deliberate - that's what the changelog item means.
There probably will be another switch in avast4.ini where you can add another editors (to show the consent dialog for) - but yes, this will be the default behavior (i.e. you'll have to use Notepad at least to add the alternative editor filename into the new option).
-
I would say that switch is a necessary change to allow consent in other editors, as to force all those who have chosen a better editor to use notepad
spit, sucks is a little draconian. OK just for avast4.ini is a minor exception, but the sooner the switch is implemented in avast4.ini the better.
Any time scale on this, what section of avast4.ini and what the switch might be ?
-
Before the final release, i.e. in a few days.
-
Thanks.
-
The INI option is already there.
[SelfDefense]
IniChangeConsentProcesses=notepad.exe,youreditor1.exe,youreditor2.exe
Etc...
Leave notepad.exe in the list unless you don't want it to be on that list. :)
Cheers
Vlk
-
Great, will add EditPadLite.exe now.
Edit: I had to enter the new switch line and notepad.exe (followed by ,editpadlite.exe) as the line wasn't there. I assume that it wasn't there as notepad is a default action so not required in the avast4.ini file ?
Edit2: I tested the switch after the edit (in notepad) and accepted the change. However, it didn't have any impact, it still caused the alert when using editpadlite.exe. So I assume a reboot is required to have the changes take effect ?
My switch line:
IniChangeConsentProcesses=notepad.exe,EditPadLite.exe
-
Either the option isn't there (as I have done a reboot) or the switch name is incorrect or my idea of what this switch does differs from Alwils.
I tried to open avast4.ini with editpadlite.exe and the avast4.ini file modification alert fires off. At least you can answer Yes and get in to edit rather than it being set to read only.
So is that the intended action to allow listed applications access to avast4.ini via the pop-up rather than having read only permission ?
Or should it allow direct access to avast4.ini without the pop-up ?
Having notepad.exe in the IniChangeConsentProcesses doesn't pop-up the same avast4.ini file modification alert. So that must be contained elsewhere and in effect the notepad.exe doesn't need to be on that line ?
-
So is that the intended action to allow listed applications access to avast4.ini via the pop-up rather than having read only permission ?
Yes, exactly.
Having notepad.exe in the IniChangeConsentProcesses doesn't pop-up the same avast4.ini file modification alert. So that must be contained elsewhere and in effect the notepad.exe doesn't need to be on that line ?
Are you sure?
Note that notepad.exe does not open the file for writing until you really select "Save" or close it (after having done some changes).
I.e. pure opening a file in notepad doesn't trigger any warning, because it only reads the file into memory.
-
I wasn't aware that notepad didn't initially open it for write permission. So if the file isn't opened for writing (regardless of the program opening it) that switch is ignored, as would seem to be the case as I can also open it with wordpad without the modification alert. Presumably that wordpad acts in the same way loads into memory not for writing.
I would have thought that my adding it to that line/switch would alter how avast deals with it, obviously not, as the opening to read doesn't trigger the alert. So I tried opening it with firefox and that too is read so doesn't trigger the interrogation.
If that is the case then notepad.exe isn't required on that switch and probably why there was no IniChangeConsentProcesses line in avast4.ini in the first place.
-
The line wasn't there because it's new, and it has a default value used when the line is missing - so, if it's not there, it's the same as if "IniChangeConsentProcesses=notepad.exe" was there.
Without it, you wouldn't be able to save the modified .ini file from Notepad.
-
OK thanks for the update.