Author Topic: Program update 7.0.1451  (Read 269142 times)

0 Members and 1 Guest are viewing this topic.

Offline George Yves

  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 4095
  • Help you I can
Re: Program update 7.0.1451
« Reply #120 on: June 29, 2012, 09:18:30 PM »
  May be that user can upload his minidump?
@George Yves: it's not necessary, we found the problem.
Could you explain when and how the bug will be fixed?
May the FOSS be with you!

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Program update 7.0.1451
« Reply #121 on: June 29, 2012, 09:37:16 PM »
AutoSandbox is still useless in my opinion. It's still incomplete and you can still can manage to skip malicious executables.

Noone ever said that we can detect all existing malware. And if anybody ever tells you that... then they're lying for sure.
And if you're looking for such a silver bullet... sorry.

If you download a piece of malware it's more likely to be detected by the antivirus engine and not after the AutoSandbox analysis.

Yes, it is more likely - and that's correct, it should be that way, of course.
The AutoSandbox scan is slow - and works as a proactive detection, for samples that are not yet detected by the usual ways. Known samples should be detected in the usual way, not by AutoSandbox.

What's the point of having two databases?

It's called layered defense.
The databases are different, the scanning mechanisms are different. AutoSandbox performs dynamical analysis, while the usual detections are mainly static - so the detection [capabilities] are different.

Also what is going to happen if the AutoSandbox catches something? 1: it will be deleted, 2: it would be available for others to download it as a virus definition or engine update. The same thing will happen just like with the real-time shields.

Yes, the AutoSandbox detection will probably be turned into an ordinary detection. But before that happens, there will be some users protected by the AutoSandbox, who would be unprotected without it.

sztihamer

  • Guest
Re: Program update 7.0.1451
« Reply #122 on: June 29, 2012, 10:01:30 PM »
Also what is going to happen if the AutoSandbox catches something? 1: it will be deleted, 2: it would be available for others to download it as a virus definition or engine update. The same thing will happen just like with the real-time shields.

Yes, the AutoSandbox detection will probably be turned into an ordinary detection. But before that happens, there will be some users protected by the AutoSandbox, who would be unprotected without it.
As long as the user doesn't click the button that executes the file outside the AutoSandbox. That's why the button is a security risk and we try to explain that to you guys. It will still fail to protect users in the current state, and we all know that. A full Sandbox is the ideal thing, but I guess free users will never get that, unless they pay for that.

Oh well, maybe in the future we will get that feature. So yeah guys grab Ollydbg, IDA, WireShark and a hex editor. I will analyse myself the files that doesn't have enough evidence until AutoSanbox gets tweaked and fixed up a little bit. We all know that AutoSandbox is immature. We made a lot of feedback about AutoSandbox, and I think guys that you should listen your customers.

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48541
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: Program update 7.0.1451
« Reply #123 on: June 29, 2012, 10:25:06 PM »
Quote
We made a lot of feedback about AutoSandbox, and I think guys that you should listen your customers.
Amazing..... :o   :(
Maybe you should consider paying for the product or, use as third party application.

Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Program update 7.0.1451
« Reply #124 on: June 29, 2012, 10:26:49 PM »
Sorry, but you obviously don't get the concept.
Suppose for a while that the autosandbox wasn't there at all - so you'd be saying "running an executable is a security risk, because we don't know (in advance) whether the file system shield will detect it" (and you might be right, but that doesn't really help).
With autosandbox, it's the same - you don't know whether the executable you are running will actually be autosandboxed, it might be started normally.
And when it actually is autosandboxed, it doesn't mean that it's bad in any way. When the autosandbox scan finds the file clean, then it offers the possibility to run the file normally - that's the logical conclusion. The initial decision (whether to autosandbox the file or not) is just a coarse pre-filter for the autosandbox scan - it will, and should, place also clean files there.
So I repeat what I've said previously - autosandbox has been turned into a scanning method (quite different from the other methods avast! uses) for executable files. Perhaps we should have renamed it, because "autosandbox" might be a bit confusing now. Something along the lines of "dynamic scan" would describe the feature better.


If you want every file you start to be run in a sandbox, then I suggest to get yourself a full/manual sandbox - avast's or other, doesn't matter. But that isn't an option for ordinary users, sandboxing every possible file isn't acceptable - you lose your work (that you might have done inside the sandboxed application), installers get broken, complex things simply don't work, etc.
« Last Edit: June 29, 2012, 10:31:56 PM by igor »

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Program update 7.0.1451
« Reply #125 on: June 29, 2012, 10:46:53 PM »
We know all that. Well, at least i do. What i still question about this feature is the fact that i've never in the entire time of its existance seen it actually positively identify anything during these analysis inside sandbox. Never ever. Thats what we are questioning the entire time.
You say its effective, but we don't see it ever identify anything.

If something is effective, users will quickly see that. But if you never did, how can you know it really does anything? I've seen behavior analyzers, heuristics and all sorts of other tech from competitors. And they always worked as advertised. But your sandboxed analysis don't seem to work at all.
Just my observation.
Visit my webpage Angry Sheep Blog

some_user

  • Guest
Re: Program update 7.0.1451
« Reply #126 on: June 30, 2012, 01:01:13 AM »
XP, Avast free.
Since updating yesterday, i can't use my standard mail anymore.
Mail program reports SSL_connect error 38.
Temporary disabling Avast solves the problem, so Avast is the cause.
Nothing else but the Avast update changed, and ofcourse i rebooted after the update.

I've been using Avast free for ages now.
But i'm disappointed by Avast's need to take over any and all control over my pc by default (instead of leaving that to me) these days.
Autosandbox, webrep, stuff like that which is installed and activated without explaining and without the possibility to make a choice about it up front.

Autosandbox keeps annoying me so i diabled it.
Nevertheless it was active again after updating.

Please keep supporting and testing XP at least as long as M$ does.
And respect the settings of the user instead of overwriting them with standard values (or someone elses preference) upon updating.

Grumpfuttock

  • Guest
Re: Program update 7.0.1451
« Reply #127 on: June 30, 2012, 01:15:45 AM »
I think there maybe a bug in the latest program update for AIS.
 I have just updated on notification of program update, I allowed a reboot and was greeted with the following message :Avast  will not be able to protect mail/news (error 10045)  check avast Sec..exe is not blocked by firewall.

Right after the update and reboot the Avast real time monitor stopped functioning as well as the web shield and they cannot be restarted from within the gui. Nothing happens when I try "Fix Now".  Also, since the update and reboot my PC can no longer access the internet, and Internet Explorer crashes, there were no problems before the update. I have had to send this report via a Samsung  tablet via my internet connection, so no problem with that ! I am running Win 7 32 bit on my PC.  I hope someone can help me sort this out. I have just noticed that my Network Monitor widget is reporting my  external I P address as "Status 10045". I have tried disabling Avast, still no internet connection, nor when I stop the Avast firewall.






Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Program update 7.0.1451
« Reply #128 on: June 30, 2012, 01:28:44 AM »
The problem with the autosandbox it's that it attempts to sandbox about 50% or more of the programs I run, which are all 100% completely safe, but still it closes them, it's incredibly annoying. I ended up disabling the autosandbox completely, it's just too disruptive.

That being said, I updated a couple more machines.
XP x64: updated from 1426, everything went just fine. No sandbox, but I believe that is by design. The problem with SUMo is still there, impossible to run it with the shields active, a process called "sf.bin" keeps opening and closing and the app doesn't work. Disabling the shields makes SUMo work perfectly again. AFAIK this ONLY happens on XP64. Probably related to the non-existing sandbox.

win7 x86: updated via the GUI from v1426, rebooted and again, no "additional protection" tab, it disappeared. Once again, had to uninstall, reboot and re-install to get everything working fine again.

bye!


Dch48

  • Guest
Re: Program update 7.0.1451
« Reply #129 on: June 30, 2012, 01:29:40 AM »
I think there maybe a bug in the latest program update for AIS.
 I have just updated on notification of program update, I allowed a reboot and was greeted with the following message :Avast  will not be able to protect mail/news (error 10045)  check avast Sec..exe is not blocked by firewall.

Right after the update and reboot the Avast real time monitor stopped functioning as well as the web shield and they cannot be restarted from within the gui. Nothing happens when I try "Fix Now".  Also, since the update and reboot my PC can no longer access the internet, and Internet Explorer crashes, there were no problems before the update. I have had to send this report via a Samsung  tablet via my internet connection, so no problem with that ! I am running Win 7 32 bit on my PC.  I hope someone can help me sort this out. I have just noticed that my Network Monitor widget is reporting my  external I P address as "Status 10045". I have tried disabling Avast, still no internet connection, nor when I stop the Avast firewall.
Try putting a check mark in "Use fast checksums" in the Firewall's expert settings. Others have reported that this fixes connectivity issues.

Offline jvidal

  • Sr. Member
  • ****
  • Posts: 325
Re: Program update 7.0.1451
« Reply #130 on: June 30, 2012, 01:31:02 AM »
Just uninstall it and install it again!

I think there maybe a bug in the latest program update for AIS.
 I have just updated on notification of program update, I allowed a reboot and was greeted with the following message :Avast  will not be able to protect mail/news (error 10045)  check avast Sec..exe is not blocked by firewall.

Right after the update and reboot the Avast real time monitor stopped functioning as well as the web shield and they cannot be restarted from within the gui. Nothing happens when I try "Fix Now".  Also, since the update and reboot my PC can no longer access the internet, and Internet Explorer crashes, there were no problems before the update. I have had to send this report via a Samsung  tablet via my internet connection, so no problem with that ! I am running Win 7 32 bit on my PC.  I hope someone can help me sort this out. I have just noticed that my Network Monitor widget is reporting my  external I P address as "Status 10045". I have tried disabling Avast, still no internet connection, nor when I stop the Avast firewall.

Dch48

  • Guest
Re: Program update 7.0.1451
« Reply #131 on: June 30, 2012, 01:33:45 AM »
The problem with the autosandbox it's that it attempts to sandbox about 50% or more of the programs I run, which are all 100% completely safe, but still it closes them, it's incredibly annoying. I ended up disabling the autosandbox completely, it's just too disruptive.
Just set the auto-sandbox to Ask instead of Auto. Then you will have the option to run a file normally which will add it to the sandbox exclusions and that file will never be questioned again.

Grumpfuttock

  • Guest
Re: Program update 7.0.1451
« Reply #132 on: June 30, 2012, 02:24:53 AM »
Thanks jvidal, that got things working again, just a shame that it was necessary to have to go through all that after an update. This is the second time in 6 months I have had to do a re-install after an update ! I''ve been using  Avast  since version 4 and never had problems with updates until recently  :(

Just uninstall it and install it again!

I think there maybe a bug in the latest program update for AIS.
 I have just updated on notification of program update, I allowed a reboot and was greeted with the following message :Avast  will not be able to protect mail/news (error 10045)  check avast Sec..exe is not blocked by firewall.

Right after the update and reboot the Avast real time monitor stopped functioning as well as the web shield and they cannot be restarted from within the gui. Nothing happens when I try "Fix Now".  Also, since the update and reboot my PC can no longer access the internet, and Internet Explorer crashes, there were no problems before the update. I have had to send this report via a Samsung  tablet via my internet connection, so no problem with that ! I am running Win 7 32 bit on my PC.  I hope someone can help me sort this out. I have just noticed that my Network Monitor widget is reporting my  external I P address as "Status 10045". I have tried disabling Avast, still no internet connection, nor when I stop the Avast firewall.

Offline NON

  • Japanese User
  • Avast Überevangelist
  • Ultra Poster
  • *****
  • Posts: 5486
  • Whatever will be, will be.
Re: Program update 7.0.1451
« Reply #133 on: June 30, 2012, 02:33:08 AM »
Thanks for the update. So far no problems.
Desktop: Win10 Pro 22H2 64bit / Core i5-7400 3.0GHz / 32GB RAM / Avast 23 Premium Beta(Icarus) / Comodo Firewall
Notebook: Win10 Pro 22H2 64bit / Core i5-3340M 2.7GHz / 12GB RAM / Avast 23 Free / Windows Firewall Control
Server: Win11 Pro 23H2 64bit / Core i3-4010U 1.7GHz / 12GB RAM / Avast One 23 Essential

Avast の設定について解説しています。よろしければご覧ください。

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Program update 7.0.1451
« Reply #134 on: June 30, 2012, 03:05:20 AM »
Is there a way to test the AutoSandbox? The autosandboxme file released some time ago is not triggered anymore...
The best things in life are free.