Emergency Update 2013-11-21?

[Tetsuo]

it seems that it's being given a separate (random) EXEcutable filename on each person's system. 

Avast emergency updates have always worked this way: random filenames (letters and numbers).
When they were first introduced, the download folder for the executable files was C:\WINDOWS\Temp  - which was a very bad idea, by the way.  At least recently they have changed the download folder.

[mwsoft]

The emergency update I got does not seem to be the same one talked about in all these posts? I got: C:\Program Files\AVAST Software\Avast\setup\emupdate\45283732-120d-471e-8cdd-23f54d298924.exe /check

Is it the same as earlier, or a revised "emergency update?" I worry about running it so am deleting it w/o doing so. I figure if its "for real" that avast! will post here and tell us, or, failing that, watever it does that is good will appear in the next update to the program? This seems logical, I hope?

[ky331]

mwsoft,
that's the "random" nature of the executable filename we've just been discussing.   It seems that people who have WinPatrol will see this "emergency update" indicated/titled as 20131121 --- presumably representing the date it was first "created" --- but most people here only received the update today (20131123).   As such, it's likely your update is precisely what we're considering in this thread.

[joe53]

 After using (and recommending)  avast for many years with very few problems, I'm finally forced to register with this forum, and weigh in on this topic.

It concerns me when some randomly labelled alphanumeric executable inserts itself into my auto-startup. I disabled it via WinPatrol as soon as I saw it. After rebooting, no problems.

@avast! As Ricky Ricardo used to say to Lucy, "you got some 'splaining to do!"

[abruptum]

SUPERAntiSpyware is detecting Avast emupdate registry key as Trojan.Agent/Gen.

 Trojan.Agent/Gen
   HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN#20131121

[BearPup]

@Joe53. I totally agree with you, it is for a similar arrogance on avasts' part that got me to register here recently. So far, no explanations, no apologies, no concern. It makes me consider a new program!

Avast, are you listening?

[ram1220]

 I haven't rebooted my computer (Win 7) in days. But I did run an msconfig earlier today for another reason and I found the emupdate checked in my startup items. I unchecked it and am waiting to hear a response from Avast also. With all the release problems with 2014 and Avast's lack of response on that I am worried about this latest "glitch". If it is fact a form of malware I will uninstall Avast and use something else. I also will never put it on another computer I build or repair.

[reisender67]

Hello,

I think, Avast has problems with his own self protection. Entries in the registry group "HKLM:Run" can not be delete if the self protection is active.
The same problem with CCleaner.

Greetings
Christian

[Vlk]

Hi guys,

Yes these are as expected (i.e. no malware). I agree that the random filename is far from ideal (from the mere suspicousness point of view), but this is how it was originally designed.

While the feature was originally called "emergency update", it is now being used to deliver all sorts of updates/patches into avast. It is a mechanism that can update (patch) avast binaries in a lightweight way, usually without requiring a reboot and going through the whole program update process. It is an important mechanism for us (present already since avast v7) that has already "saved" us a couple of times...

Thanks
Vlk

[ky331]

Vlk,

Now that you're here in this thread, can you enlighten us, specifically:

1) What is the precise purpose/function of today's "update" 2013-11-21 ?
2) Is it really intended to run EVERY time the PC is booted up (or users take-turns logging-on to their accounts)?   [Meaning we should leave it in our startup routine] ---
or was it intended to run only once, in which case we can safely remove it from our startup?

If it's supposed to run every boot:   then for those who accidentally or intentionally removed it, will the "Emergency Update" TASK, in Task Scheduler, reinstate this startup?

[miguelgrado]

Hi guys,

Yes these are as expected (i.e. no malware). I agree that the random filename is far from ideal (from the mere suspicousness point of view), but this is how it was originally designed.

While the feature was originally called "emergency update", it is now being used to deliver all sorts of updates/patches into avast. It is a mechanism that can update (patch) avast binaries in a lightweight way, usually without requiring a reboot and going through the whole program update process. It is an important mechanism for us (present already since avast v7) that has already "saved" us a couple of times...

Thanks
Vlk

greetings, that we already know it but the problem is because it remains in start of windows and does not disappear like in other occasions..thanks

[olddog]

..While the feature was originally called "emergency update", it is now being used to deliver all sorts of updates/patches into avast. It is a mechanism that can update (patch) avast binaries in a lightweight way, usually without requiring a reboot and going through the whole program update process. It is an important mechanism for us (present already since avast v7) that has already "saved" us a couple of times...

If the purpose was to patch the program binaries as you say, then I don't understand why:-
(a) it is required to run more than once
(b) there has been no corresponding change in the program download (there should have also been a corrresponding minor version update in the program.
(c) If the patch is so urgent it can't wait for an actual program update, then the present emergency update would not appear to be a reliable method since it relies on the users PC being rebooted, and that can be very infrequent in some cases.

[mustang64]

Hey VLK,
How about letting us know if we can remove this thing from our startup??

Those of us with Winpatrol can do that very easily, and there are other ways as well.

Give us a little info here not just a quick hi guys and take off!!

Thanks.
LDS

[bikemanAMD]

Yes i'd like to know the purpose of todays emergency update as well, Will it auto remove from startup when it's done?  Can we set it to not start?  It is designed to start on every bootup of PC's?   

Would like either a post with info why it was sent out today, what It fixed?  would be very helpful

[olddog]

I think, Avast has problems with his own self protection. Entries in the registry group "HKLM:Run" can not be delete if the self protection is active.
The same problem with CCleaner.

Christian,
Interesting you should mention that. I run with avast's self defense module disabled (primarily because of the issue with CCleaner), and having just checked the "HKLM:Run" entries the one for the "emergency update" is not present, although the "random character.exe" file in question is still in the emupdate file. 

Edit
This particular HKLM:Run entry is NOT present after a clean installation of Avast 2014, nor is the file in emupdate, confirming that the standard installation doesn't run the check on bootup.  Question I have is "was my emergency update HKLM:Run entry placed there as it should have been, done the job it was meant to do and then disappeared into the who knows where, or did something malfunction and not put it there in the first place, and thus the job it was meant to do actually hasn't been done?
If any of the standard binaries get changed/updated/patched after installation, there should be an indication somewhere that the installation is no longer the version it was previously.