Author Topic: Strange exe in Windows\Temp - AVAST related?!  (Read 4682 times)

0 Members and 1 Guest are viewing this topic.

IvanV

  • Guest
Strange exe in Windows\Temp - AVAST related?!
« on: March 05, 2013, 01:30:11 AM »
A couple of days ago, I got an unpleasant surprise: my firewall alerted me of a file in C:\Windows\Temp, cal, but then the led <bunch of hexadecimal digits>.exe that was trying to go online. I went to the folder and saw the file, but then it disappeared. I think that you can understand when I thought "Infection!"

I manually checked all running processes, services and startup items and I did a scan with Avast, but nothing was found, and for a day or two, there were no new anomalies. Well, until tonight. This time, I was faster, though, and I managed to make a copy of the file before it self destructed. Well, the encouraging, but strange thing is that it seems to be Avast related. So can anyone tell me what this is and hopefully put me at ease?


Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 88173
  • No support PMs thanks
Re: Strange exe in Windows\Temp - AVAST related?!
« Reply #1 on: March 05, 2013, 01:52:57 AM »
It could well be the avast Emergency Update Checker (introduced in avast 7), as I believe that creates such a file name in temp whilst carrying out the check to see if there is an emergency update present.

Avast! Emergency Update - see Vlk's brief explanation, http://forum.avast.com/index.php?topic=99540.msg794105#msg794105.
And
The Repair function basically makes sure that everything is installed as it would be after a clean installation (let's say except for keeping the settings etc.)
Wheter it always succeeds or fail sometimes, is completely unrelated to this topic. First, we don't want to tell people "please navigate to Control Panel and invoke the Repair", and second this is meant for the hypothetical case of a bad (e.g. Virus definition) update being released that breaks things - and Repair wouldn't help there anyway, cause the virus definitions would be correctly installed, just would crash the program.
Or, the setup component itself might get broken - which contains both the updating and repair functionality.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.9.6082 (build 23.9.8494.792) UI 1.0.781/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

IvanV

  • Guest
Re: Strange exe in Windows\Temp - AVAST related?!
« Reply #2 on: March 05, 2013, 02:07:09 AM »
Thank you, DavidR! :) I checked the timestamp of the file with the last run time of the Emergency Update task in Task Scheduler and they are a match! That lifted a weight off my chest. :)

EDIT: If it was introduced in version 7, it's strange that I've never seen it before updating to version 8. But I guess that it doesn't really matter.
« Last Edit: March 05, 2013, 02:11:16 AM by IvanV »

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 88173
  • No support PMs thanks
Re: Strange exe in Windows\Temp - AVAST related?!
« Reply #3 on: March 05, 2013, 02:21:34 AM »
You're welcome.

The majority of user will probably not notice it, I know it happens, but I haven't gone checking. My firewall hasn't notified me of it either, but I have allowed the AvastEmUpdate.exe which would create this file.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.9.6082 (build 23.9.8494.792) UI 1.0.781/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline The Sniggler

  • Full Member
  • ***
  • Posts: 120
Re: Strange exe in Windows\Temp - AVAST related?!
« Reply #4 on: March 05, 2013, 02:02:09 PM »
Same thing here...one both Win7 and XP machines, Online Armor questioned about 3 weird .exe files like :

92d1d255-f490-4c4a-90ca-1e19926aea5f.exe, 0.0.0.0, (0.0.0.0)
C:\Windows\TEMP\92d1d255-f490-4c4a-90ca-1e19926aea5f.exe  Hash(MD5): D10A35D060D7164FFFE2CD7195EEA2DF

This happened after I upgraded to V 8.  I opened file location and I saw one of them was in the Avast directory.

Ran MalwareBytes full and Avast full, no infection.


Offline miguelgrado

  • Advanced Poster
  • **
  • Posts: 799
  • Admin ForoAntispyware
    • Foroantispyware
Re: Strange exe in Windows\Temp - AVAST related?!
« Reply #5 on: March 05, 2013, 02:45:06 PM »
From version 8,two fixes have been installed,the latest yesterday.in normal .are fix downloaded of avast emergency update.firewall of avast authorize rules for this fixies
« Last Edit: March 05, 2013, 02:58:31 PM by miguelgrado »

Offline Gopher John

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2098
Re: Strange exe in Windows\Temp - AVAST related?!
« Reply #6 on: March 05, 2013, 04:56:54 PM »
I received 2 alerts on new application rules allowing these two Avast programs.  They also show up under AIS Firewall Application Rules under an avast grouping different than the Avast Software main group.  I wouldn't have gotten the alert except for the fact that I had an option ticked to alert on new firewall rules.  Avast already knows they are ok. ;D
AMD A6-5350M APU with Radeon HD Graphics, 8.0GB RAM, Win7 Pro SP1 64bit, IE11
i7-3610QM 2.3GHZ, 8.0GB Ram,  Nvidia GeForce GT 630M 2GB, Win7 Pro SP1 64bit, IE 11
Common to both: Avast Premium Security 19.7.2388, WinPatrol Plus, SpywareBlaster 5.5, Opera 12.18, Firefox 68.0.2, MBam Free, CCleaner