Author Topic: What's causing so many emergency updates?  (Read 14786 times)

0 Members and 1 Guest are viewing this topic.

Offline Tetsuo

  • Poster
  • *
  • Posts: 594
Re: What's causing so many emergency updates?
« Reply #30 on: November 16, 2012, 11:12:42 AM »
@ cooby - You're welcome.

Perhaps the '.exe' file is an installer specifically invoked to address some issue on target OS's. When not needed, it is immediately removed and the 'AvastEmUpdate.ini' file is not even created - e.g., I don't have that file on my Win XP system...
Anyway, I'm just speculating! :D

As for the frequency, someone mentioned that the Emergency Updater checks for updates twice a day (not sure if also at each system boot). So I guess everything is in the normal way.

Offline cooby

  • Poster
  • *
  • Posts: 441
Re: What's causing so many emergency updates?
« Reply #31 on: November 17, 2012, 09:53:32 PM »
I'll join you in speculating :)  since this thread looks abandoned, which is ok:
1. After learning of the existence of the AvastEmUpdate.ini file in this thread, I caught it, but just once.
2. On my box, it ran. One of the firewall logs showed that the process was created. Twice, once for each of those files in \temp. And another log, not posted, showed travels to several avast servers.
3. My understanding has been all along that two emergency updates might occur in a day. Hence this thread, when I saw more. By now I think I know it was streaming updates, relly.
1. Toshiba Satellite A75, Windows XP-Pro-SP3, Avast! free v9, Sunbelt Firewall 4.7.4.0, SSM, Opera 12.17, SeaMonkey+NoScript, mvps hosts, (MalwareBytes updated and run on demand only, rarely used), Acronis v11, SUMo
2. Toshiba Thrive tablet (rooted) ICS, AdAway (hosts), Opera, Avast Mobile Security 3.0.7801, Titanium Backup, App Backup&Restore

Offline Tetsuo

  • Poster
  • *
  • Posts: 594
Re: What's causing so many emergency updates?
« Reply #32 on: November 30, 2012, 08:06:49 PM »
Just FYI, good guy Online Armor caught the .exe this afternoon and let it go:

6fcffb37-5949-40e7-a8d6-b6b9f28816ea.exe
C:\WINDOWS\Temp\6fcffb37-5949-40e7-a8d6-b6b9f28816ea.exe
Hash(MD5): A16F36F49A7B9BBF1A1FD715362E39EA

; )
« Last Edit: November 30, 2012, 08:12:38 PM by Tetsuo »

Offline cooby

  • Poster
  • *
  • Posts: 441
Re: What's causing so many emergency updates?
« Reply #33 on: November 30, 2012, 09:38:39 PM »
Ditto here, just different file. First time since Nov.16, so things look back to normal, i.e. infrequent
[30/Nov/2012 11:53:18] DriverEventHandlersImpl.cpp: "System" action = 'permitted', operation = 'creating_proc', proc = 'c:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe', subj = 'c:\WINDOWS\Temp\b6fb27ca-c86c-430b-96ea-d9de9722ae99.exe'
[30/Nov/2012 11:53:18] DriverEventHandlersImpl.cpp: EVENT_EXECUTE for c:\WINDOWS\Temp\b6fb27ca-c86c-430b-96ea-d9de9722ae99.exe
Streaming updates followed. 24 .bin files followed by now.
1. Toshiba Satellite A75, Windows XP-Pro-SP3, Avast! free v9, Sunbelt Firewall 4.7.4.0, SSM, Opera 12.17, SeaMonkey+NoScript, mvps hosts, (MalwareBytes updated and run on demand only, rarely used), Acronis v11, SUMo
2. Toshiba Thrive tablet (rooted) ICS, AdAway (hosts), Opera, Avast Mobile Security 3.0.7801, Titanium Backup, App Backup&Restore