Author Topic: Emergency update .exe files  (Read 5337 times)

0 Members and 1 Guest are viewing this topic.

hake

  • Guest
Emergency update .exe files
« on: December 11, 2013, 03:06:31 PM »
The random naming of emergency update .exe files is a nuisance for users of HIPS.  I imagine that names such as 897b17a5-c4d9-41ee-bf23-2ac8b2c0d432.exe are used to prevent clashes with existing files.  Isn't there another way to do this?  Are these digitally signed?  They could be anything so when I give the HIPS permission to allow the things to run, it's a guess that they are safe.

 :o


Offline Vapor

  • Sr. Member
  • ****
  • Posts: 245
Re: Emergency update .exe files
« Reply #1 on: December 11, 2013, 04:05:20 PM »
Quote
The random naming of emergency update .exe files is a nuisance for users of HIPS
I totally agree, outpost  keep on asking  for your input, and if you have  trained your firewall, it doesn't matter, days later new entry shows up anyways >:(
« Last Edit: December 11, 2013, 04:06:53 PM by Vapor »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 86808
  • No support PMs thanks
Re: Emergency update .exe files
« Reply #2 on: December 11, 2013, 05:19:23 PM »
The random naming of emergency update .exe files is a nuisance for users of HIPS.  I imagine that names such as 897b17a5-c4d9-41ee-bf23-2ac8b2c0d432.exe are used to prevent clashes with existing files.  Isn't there another way to do this?  Are these digitally signed?  They could be anything so when I give the HIPS permission to allow the things to run, it's a guess that they are safe.

They are digitally signed by avast if you check the file properties.

Quote
The random naming of emergency update .exe files is a nuisance for users of HIPS
I totally agree, outpost  keep on asking  for your input, and if you have  trained your firewall, it doesn't matter, days later new entry shows up anyways >:(

I use Outpost Firewall Pro and I have not experienced the issue are stating. I don't know if that is related to your settings in Outpost Firewall Pro. I have my firewall settings set to Rules Wizard and Proactive Protection > Anti-Leak set to Advanced and no issues.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Vapor

  • Sr. Member
  • ****
  • Posts: 245
Re: Emergency update .exe files
« Reply #3 on: December 11, 2013, 06:01:16 PM »
Quote
I use Outpost Firewall Pro and I have not experienced the issue are stating. I don't know if that is related to your settings in Outpost Firewall Pro. I have my firewall settings set to Rules Wizard and Proactive Protection > Anti-Leak set to Advanced and no issues.
Exactly same settings here, and this morning when i brought one of my PC's from sleep outpost pops the window and asking for input, went to my other machine that was sleeping as well, same thing.


cooby

  • Guest
Re: Emergency update .exe files
« Reply #4 on: December 11, 2013, 06:04:57 PM »
The random naming of emergency update .exe files is a nuisance for users of HIPS.  I imagine that names such as 897b17a5-c4d9-41ee-bf23-2ac8b2c0d432.exe are used to prevent clashes with existing files.  Isn't there another way to do this? ...
In addition to HIPS, any firewall with behavior watch sees them as unknown programs, asks, and requires an answer. A big annoyance.

@DavidR,
Outpost normally asks about unknown, new programs, which those emergency updates are because of varying filename, and in v7 it was varying path as well.
Just curious - what's your setting for 'allow digitally signed...' - checked? unchecked?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 86808
  • No support PMs thanks
Re: Emergency update .exe files
« Reply #5 on: December 11, 2013, 06:38:37 PM »
I haven't changed anything in Outpost relating to digital signatures; in fact on my current settings of Rules Wizard and Proactive Protection > Anti-Leak set to Advanced. I see no reference to digital signatures.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7118
  • When you think you know, Think Again
Re: Emergency update .exe files
« Reply #6 on: December 11, 2013, 06:46:20 PM »
Well just to share,  I also ' have not' experienced any issue with OPFW Pro displaying any annoying popups. :)
***HP ENVY 15K LT W10 Pro 21H2 64Bit/250GB SSD/16GB Ram/ADU v.22.2b/VS/SANDBOXIE-plus/MailWasherPRO
**HP Compaq 8510p LT W10 Pro 21H2 64Bit/1TB HD/8GB Ram/ADU v.22.2b/VS/SANDBOXIE/HotSpot Shield
 Avast Mobile Security (Android)
LAYERED SECURITY SOFTWARE

cooby

  • Guest
Re: Emergency update .exe files
« Reply #7 on: December 11, 2013, 07:01:27 PM »
I haven't changed anything in Outpost relating to digital signatures; in fact on my current settings of Rules Wizard and Proactive Protection > Anti-Leak set to Advanced. I see no reference to digital signatures.
Correct, it's not "digital signatures"
What's in your Settings > General > ImproveNet - trusted vendors line.

I don't have avast where Outpost is, so couldn't remember, sorry.
In Antileak, if you set it to Maximum, will you get alerts about emergency update?


Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7118
  • When you think you know, Think Again
Re: Emergency update .exe files
« Reply #8 on: December 11, 2013, 07:09:23 PM »
I haven't changed anything in Outpost relating to digital signatures; in fact on my current settings of Rules Wizard and Proactive Protection > Anti-Leak set to Advanced. I see no reference to digital signatures.
Correct, it's not "digital signatures"
What's in your Settings > General > ImproveNet - trusted vendors line.

I don't have avast where Outpost is, so couldn't remember, sorry.
In Antileak, if you set it to Maximum, will you get alerts about emergency update?

Well I personally have not found the need/use to set Anti Leak to Maximum. I'm sure that would impede some software performance.
***HP ENVY 15K LT W10 Pro 21H2 64Bit/250GB SSD/16GB Ram/ADU v.22.2b/VS/SANDBOXIE-plus/MailWasherPRO
**HP Compaq 8510p LT W10 Pro 21H2 64Bit/1TB HD/8GB Ram/ADU v.22.2b/VS/SANDBOXIE/HotSpot Shield
 Avast Mobile Security (Android)
LAYERED SECURITY SOFTWARE

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 86808
  • No support PMs thanks
Re: Emergency update .exe files
« Reply #9 on: December 11, 2013, 08:08:21 PM »
I haven't changed anything in Outpost relating to digital signatures; in fact on my current settings of Rules Wizard and Proactive Protection > Anti-Leak set to Advanced. I see no reference to digital signatures.
Correct, it's not "digital signatures"
What's in your Settings > General > ImproveNet - trusted vendors line.

I don't have avast where Outpost is, so couldn't remember, sorry.
In Antileak, if you set it to Maximum, will you get alerts about emergency update?

Well ImproveNet really shouldn't be the classification (I have that disabled), but Rules auto-creation I have Auto create and update rules (which I believe to be a default setting) and also the 'Automatically create rules for applications signed by trusted vendors' checked, which is a default option.

I have absolutely no intention of setting Anti-Leak to maximum, I'm not that paranoid and you are going to get many more interventions from OFP for many applications not just avast.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

hake

  • Guest
Re: Emergency update .exe files
« Reply #10 on: December 13, 2013, 01:52:32 PM »
This problem makes Avast look poor.  It's cack-handed.  Surely it can do better than this?