Avast WEBforum
Consumer Products => Avast Mac Security => Topic started by: mzch on September 03, 2011, 08:02:00 AM
-
Hi,
I installed the latest avast! on Mac OS X 10.7.1 (Lion). Since then avast!.app starts at login and is resident.
Whenever I close or exit the app, it always restart again automatically. Why don't you allow to exit avast!.app?
-
Are you referring to the small icon in the right side of the menu bar?
There just must be a resident process which is able to pop up an infection alert whenever some malware is detected by any background shield. This process is also responsible for managing this icon. The process has absolutely minimal system requirements so it should not cause you any troubles or performance degradation.
If it is the icon what is bothering you, you can disable the icon in System Preferences >> avast!.
Regards
Mity
-
No. I know it's a resident process. What I said is /Applications/avast!.app. This app restarts automatically whenever I terminate it by selecting "Quit" menu or clicking close button.
-
Well that really should not happen. It's really weird. We'll take a look at it.
Mity
-
So far we were unable to reproduce the issue.
When the application starts it execs some scripts which check the avast! is installed properly and (if not) they perform some update/install/repair actions. During the beta stage, these script output their activity into /tmp/script.log-$PID (where $PID is process ID of the exec'ed process)
It would be very helpful if you can send us these outputs. It should be sufficient if you send two most recent of them. (Note that during reboot, /tmp is cleaned out, so you may need to reproduce the problem with quitting the app, to create the files).
Thanks
Mity
-
Hi,
Please see below:
+ echo 65813
++ dirname '/Applications/avast!.app/Contents/MacOS/install.sh'
+ EXEPATH='/Applications/avast!.app/Contents/MacOS'
+ RSRCPATH='/Applications/avast!.app/Contents/MacOS/../Resources'
++ id -u
+ MYUID=501
++ id -ur
+ MYREALUID=501
++ sw_vers -productVersion
++ cut -d. -f2
+ MACOSXVERSION=7
++ uname -p
+ MACOSXCPU=i386
++ cat '/Applications/avast!.app/Contents/MacOS/../Resources/version.tag'
+ PACKAGEVERSION='MacAvast 1.0 beta 2 #30664'
+ PACKAGEVERSIONTAGFILE=version.tag
+ AVASTPATH='/Library/Application Support/Avast'
+ AVASTRUNDIR=/var/run/avast
+ AVASTLOCKDIR=/tmp/com.avast.MacAvast.lockdir
+ AVASTHISTORYSIZE=10000
+ AVASTHISTORYFILE=.avast_history
+ ROOTCOMPONENTS='supportdir proxykext fileshieldkext daemon proxy fileshield plists helperbundle prefpane'
+ TOBEKILLEDCOMPONENTS='"$GUIAVAST" "$FILESHIELDBINARY" "$PROXYBINARY" "$DAEMONBINARY"'
+ PREFPANEBUNDLE=Avast.prefPane
+ PREFPANELOCATION=/Library/PreferencePanes
+ PLISTLAUNCHDAEMON=com.avast.MacAvast.LaunchDaemon.plist
+ PLISTLAUNCHAGENT=com.avast.MacAvast.LaunchAgent.plist
+ DAEMONDIR=daemon
+ DAEMONVPSBUNDLE=v4v5provisory
+ SETUPLOG=/tmp/setup.log
+ SETUPBINARY=v4v5provisory/Setup/avast.setup
+ DAEMONBINARY=v4v5provisory/com.avast.MacAvast.MAD.orig
+ DAEMONLICENSE=v4v5provisory/avu-beta.lic
+ DAEMONLOG=/var/log/daemon.log
+ DAEMONMASTERSOCKET='/Library/Application Support/Avast/master'
+ DAEMONCMDLINE='"$AVASTPATH/$DAEMONBINARY" \
-u "$DAEMONMASTERSOCKET" -os -od -oa -ou0 -om0666 \
-u "$FILESHIELDSOCKET" -oa -ou0 -om0600 \
-u "$PROXYWEBSOCKET" -oa -ou0 -om0600 \
-u "$PROXYMAILSOCKET" -oa -ou0 -om0600 \
-d "$AVASTPATH/$DAEMONVPSBUNDLE/Data" -v -b -l "$AVASTPATH/$DAEMONLICENSE" -n \
-m 0xffffffff -s "$DAEMONLOG" -e3600 -ad60 -al"$SETUPLOG" \
-hs"$AVASTHISTORYSIZE" -hf"$AVASTPATH/$AVASTHISTORYFILE"'
+ FILESHIELDDIR=fileshield
+ FILESHIELDKEXTBUNDLE=AvastFileShield.kext
+ FILESHIELDKEXTNAME=com.avast.AvastFileShield
+ FILESHIELDBINARY=com.avast.fileshield
+ FILESHIELDOUT=/var/log/fileshield.log
+ FILESHIELDSOCKET='/Library/Application Support/Avast/socket.file'
+ PROXYDIR=proxy
+ PROXYKEXTBUNDLE=AvastPacketForwarder.kext
+ PROXYKEXTNAME=com.avast.PacketForwarder
+ PROXYBINARY=com.avast.proxy
+ PROXYCONFFILE=com.avast.proxy.conf
+ PROXYWEBSOCKET='/Library/Application Support/Avast/socket.web'
+ PROXYMAILSOCKET='/Library/Application Support/Avast/socket.mail'
+ APPLICATIONSAVASTPATH='/Applications/avast!.app'
+ GUIHELPERBUNDLE=MacAvastHelper.app
+ GUIHELPER=MacAvastHelper.app/Contents/MacOS/MacAvastHelper
+ GUIAVAST='avast!'
+ GUILOGDIR=/tmp
+ ROOTBRANCHHINT=doasroot
+ NONINTERACTIVEINFO=infosilent
+ NONINTERACTIVE=
+ '[' 501 -eq 0 -a xcheckasuser = xdoasroot ']'
+ AVASTLOCKACQUIRED=0
+ '[' 0 -lt 1 ']'
+ mkdir /tmp/com.avast.MacAvast.lockdir
+ AVASTLOCKACQUIRED=1
+ '[' 1 -lt 1 ']'
+ '[' 7 -lt 5 -o '(' xi386 '!=' xi386 -a xi386 '!=' xx86_64 ')' ']'
+ NONINTERACTIVE=
+ '[' xcheckasuser = xnoninteractive ']'
+ CHECKASUSER=
+ '[' xcheckasuser = xcheckasuser ']'
+ CHECKASUSER=yes
+ NONINTERACTIVE=infosilent
+ TOBEROOTFIXED=
+ TOBEREPORTED=
+ '[' xcheckasuser = xkill -o xcheckasuser = xpurge -o xcheckasuser = xuninstall ']'
+ '[' xcheckasuser = xpurge -o xcheckasuser = xuninstall ']'
+ '[' xcheckasuser = xuninstall ']'
+ '[' x '!=' x ']'
+ '[' 501 -ne 0 -a 'x/Applications/avast!.app/Contents/MacOS' '!=' 'x/Applications/avast!.app/Contents/MacOS' ']'
++ cat '/Library/Application Support/Avast/version.tag'
+ '[' '!' -f '/Library/Application Support/Avast/version.tag' -o 'MacAvast 1.0 beta 2 #30664' '!=' 'MacAvast 1.0 beta 2 #30664' ']'
+ for i in '$ROOTCOMPONENTS'
+ doaction checksupportdir
+ case "$1" in
+ '[' 501 -eq 0 ']'
+ test -d '/Library/Application Support/Avast' -a '!' -w '/Library/Application Support/Avast'
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkproxykext
+ case "$1" in
+ kextstat
+ grep com.avast.PacketForwarder
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkfileshieldkext
+ case "$1" in
+ kextstat
+ grep com.avast.AvastFileShield
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkdaemon
+ case "$1" in
+ isapprunning '/Library/Application Support/Avast/v4v5provisory/com.avast.MacAvast.MAD.orig' 0
+ ps -laxww
+ grep -v 'grep /Library/Application Support/Avast/v4v5provisory/com.avast.MacAvast.MAD.orig'
+ grep '/Library/Application Support/Avast/v4v5provisory/com.avast.MacAvast.MAD.orig'
+ read a b
+ '[' 00 -eq 00 ']'
+ return 0
+ test -S '/Library/Application Support/Avast/master'
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkproxy
+ case "$1" in
+ isapprunning '/Library/Application Support/Avast/proxy/com.avast.proxy' 0
+ ps -laxww
+ grep -v 'grep /Library/Application Support/Avast/proxy/com.avast.proxy'
+ grep '/Library/Application Support/Avast/proxy/com.avast.proxy'
+ read a b
+ '[' 00 -eq 00 ']'
+ return 0
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkfileshield
+ case "$1" in
+ isapprunning '/Library/Application Support/Avast/fileshield/com.avast.fileshield' 0
+ ps -laxww
+ grep -v 'grep /Library/Application Support/Avast/fileshield/com.avast.fileshield'
+ grep '/Library/Application Support/Avast/fileshield/com.avast.fileshield'
+ read a b
+ '[' 00 -eq 00 ']'
+ return 0
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkplists
+ case "$1" in
+ test -f /Library/LaunchDaemons/com.avast.MacAvast.LaunchDaemon.plist -a -f /Library/LaunchAgents/com.avast.MacAvast.LaunchAgent.plist
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkhelperbundle
+ case "$1" in
+ test -d '/Library/Application Support/Avast/MacAvastHelper.app'
+ :
+ for i in '$ROOTCOMPONENTS'
+ doaction checkprefpane
+ case "$1" in
+ test -d /Library/PreferencePanes/Avast.prefPane
+ :
+ '[' -n yes ']'
+ isapprunning MacAvastHelper.app/Contents/MacOS/MacAvastHelper 501
+ ps -laxww
+ grep -v 'grep MacAvastHelper.app/Contents/MacOS/MacAvastHelper'
+ grep MacAvastHelper.app/Contents/MacOS/MacAvastHelper
+ read a b
+ '[' 0501 -eq 0501 ']'
+ return 0
+ :
+ '[' -n yes ']'
+ echo 'doasroot infosilent '
+ '[' -z infosilent -a -z yes ']'
+ safeexit 0
+ rmdir /tmp/com.avast.MacAvast.lockdir
+ exit 0
-
Strange, there is nothing suspicious or unexpected in the output.
Can you type this command in Terminal.app and post its output here?
ps -wwwlxA
-
Mm...? It's really strange. Please see the attached text file, which includes the output of 'ps -wwwlxA'.
-
Well, that output shows you have a plenty of applications running. Have you really started all those application yourself? I mean, isn't much more applications that starts automatically for you? Perhaps there is some app. launch utility with crippled configuration or something.
You can try to do this command in Terminal.app
$ launchctl list
and review login items if there is something suspicious.
-
I found com.avast.MacAvast in the output of 'launchctl list' and remove it by executing 'launchctl remove com.avast.MacAvast',
so the app, /Applications/avast!/Contents/MacOS/avast!, completely terminated.
I found that app name in ~/Library/LaunchAgents/com.avast.MacAvast.plist, which is currently disabled.
Is it something to do with this issue?
-
Hi,
Once I deleted ~/Library/LauchAgents/com.avast.MacAvast.plist and rebooted my Mac, then avast!.app doesn't start automatically without such a setting and stops restarting over and over.
What is this file for?
-
This is interesting. The beta does not install any *.plist in $HOME/Library/LaunchAgents.
Had you purchased and used the legacy avast! for Mac 3.11 on the machine?
The current beta is complete rewrite and does not have almost anything common with that older product, but there is one thing they do share: Both are named avast! and live in /Applications. So if that file was created during lifetime of the old avast 3.11, it now could accidentally start the new avast GUI application.
Do you still have the *plist in your Trash or somewhere around? It would be nice if we can look at it and confirm the theory.
Regards
Mity
-
I get it! Yes, Before updating OS X to Lion and installing this beta, I had been running old 3.11 avast on my Mac.
Now the avast beta works very well. Thank you! :)
-
Yep, it seems related to the legacy avast! 3.11.
Martin