SafeZone installed itself, Avast tries to KILL PC when uninstalling. WTF!?

[Aditza]

this morning i discovered that my PC auto-installed SafeZone... and Avast tried to KILL my PC when i decided to uninstall it from appwiz.cpl -> Avast -> Change

the  PC-Killing batch script is even named "K.BAT" and is dropped after uninstall in C:\Program Files\AVAST Software\SZBrowser\k.bat

it tries to kill some processes and at the end it tries to DELETE the ENTIRE Avast installation and then the ENTIRE C:\Program Files\ folder and then, as if that was not enough, it tries to delete itself after commiting the crime!


WTF? Avast?!!! now you're delivering malware?



source code of k.bat:

Code: [Select]

SET PID1_RUNNING=TRUE
SET PID2_RUNNING=TRUE
:again
IF %PID1_RUNNING%==TRUE (
TASKLIST /FI "PID eq 3476" | FIND /c /i ".exe"
IF ERRORLEVEL 1 SET PID1_RUNNING=FALSE
)
IF %PID2_RUNNING%==TRUE (
TASKLIST /FI "PID eq 3328" | FIND /c /i ".exe"
IF ERRORLEVEL 1 SET PID2_RUNNING=FALSE
)
ping -n 2 127.0.0.1
IF %PID1_RUNNING%==TRUE GOTO :again
IF %PID2_RUNNING%==TRUE GOTO :again
del "C:\Program Files\AVAST Software\SZBrowser\1.48.2066.44\installer.exe"
rmdir "C:\Program Files\AVAST Software\SZBrowser\1.48.2066.44"
rmdir "C:\Program Files\AVAST Software\SZBrowser"
rmdir "C:\Program Files\AVAST Software"
rmdir "C:\Program Files"
del %0


[Eddy]

Ofcourse it wasn't there when you installed avast free because it was only in the paid versions.
Now it is in the free version also :
https://forum.avast.com/index.php?topic=184616.0;topicseen

[Skakara]

Somebody needs to comment on this "K.BAT" thing!! If it's true or not. I'm now afraid to the remove the crap Avast showed on my rig not asking.

[Vlk]

Guys,

This is getting a bit ridiculous, isn't it? I mean, I have no idea whatsoever what this fuss is all about.

The k.bat file is a totally standard way of removing the remnants of an uninstaller after reboot. So, if you uninstall SafeZone, then this file will run to remove the binaries that may be left after the uninstall, and finally delete itself (that's the last line of the file).

So, what's the issue, really?


Edit: ah, I see what you mean. You're concerned with the part
rmdir "C:\Program Files\AVAST Software"
rmdir "C:\Program Files"
correct? Well, you don't have to be. This is a pretty standard construct in batch files, relying on the fact that rmdir only deletes empty directories, i.e. it always fails if there's at least one file (or subdirectory) in it.

But otherwise, funny, I have never thought we would discuss batch file programming in this forum. :-)

[Skakara]

That's quite high and mighty attitude you take against users of your product, not all are technically advanced to understand. And given how you sneak the module to peoples computers, your behavior is even more dubious. Laugh all you want, but people will not take that nicely.

[Vlk]

Apologies if I insulted you in any way, or if my answer came across as offensive. I was just trying to say that you don't have to worry about the k.bat file in any way, it's 100% safe -- which hopefully resolves this whole thread.

[abruptum]

k.bat file didn't delete itself after I removed SafeZone browser through Control Panel (Uninstall/Change).
SZBrowser folder with k.bat file is still present and also some locked .log files in Windows/Temp.
CCleaner didn't delete those files from Windows/Temp folder.

Edit :

I was able to delete SZBrowser folder after I disabled Avast self protection module.
SafeZone files in Windows/Temp will be deleted tomorrow because of setting 'Only delete files in Windows Temp folders older than 24 hours'
in CCleaner.

[REDACTED]

Thanks abruptum for that info as I hadn't a clue how to get rid of the k.bat file and the folder that contained it. Now it's history…

[REDACTED]

Edit: ah, I see what you mean. You're concerned with the part
rmdir "C:\Program Files\AVAST Software"
rmdir "C:\Program Files"
correct? Well, you don't have to be. This is a pretty standard construct in batch files, relying on the fact that rmdir only deletes empty directories, i.e. it always fails if there's at least one file (or subdirectory) in it.

But otherwise, funny, I have never thought we would discuss batch file programming in this forum. :-)

Yes, we're concerned about this part, and you are wrong to laugh off our concerns.

If it's known in advance that rmdir "C:\Program Files" isn't going to do anything useful, why include it at all?  That's a pretty scary thing for a user to notice.

Vlk, you and I have had long productive discussions in the past regarding Avast, going all the way back as far as v4.1 or even earlier (not sure).  You should take me seriously when I say that I don't think Avast is doing itself any favors by turning their collective noses up and dismissing our concerns as if we're stupid and our objections don't matter.  I have long been a proponent of Avast and thanks to me, many users I know have it installed on their systems.  Some may have even become paid customers - I have no way of knowing.

But the combination of the drive-by installation of SafeZone Browser plus the "we can't do anything wrong so stop worrying" attitude displayed on this forum has me seriously considering whether I should try something other than Avast.

[Patrick2]

I'm Too seriously considering dropping Avast after Safezone browser silent install, without warning,   Not sure what I may go with yet, but do know will be something of my choosing if I do switch household PC's

Whos idea was it at Avast to do this Silent Rollout of Safezone browser anyways to Portion of Free users?

Don't think was too smart of move in my eyes and a lot of other folks eyes

[REDACTED]

I'm Too seriously considering dropping Avast after Safezone browser silent install, without warning,   Not sure what I may go with yet, but do know will be something of my choosing if I do switch household PC's

Whos idea was it at Avast to do this Silent Rollout of Safezone browser anyways to Portion of Free users?

Don't think was too smart of move in my eyes and a lot of other folks eyes

Have been using AVG Free on a few systems for over a year and zero real problems. AVG does try to get you to install some crapware as time goes by, but a cautious user can easily choose to Opt Out, a CHOICE that is ALWAYS Offered in one form or another. ZERO silent installs to date.

Have done a number of AVAST uninstalls over the last few days. Using Zonealarm Firewall Plus Antivirus (by Kaspersky) on three of these including my main system with no issues so far. Have installed Avira Free on 2 other systems I maintain and all is well so far.

My past experiences with Panda and Bitdefender Free have me leery of giving either another chance. Both made installing/downloading new software a major pain. Both blocked stuff I didn't want or need blocked. In short, both were far more trouble than they were worth, even free.

[REDACTED]

How to remove SafeZone? I got red cross icon.

[Asyn]

How to remove SafeZone? I got red cross icon.

See: https://www.avast.com/faq.php?article=AVKB96#artTitle

[Skakara]

How to remove SafeZone? I got red cross icon.

See: https://www.avast.com/faq.php?article=AVKB96#artTitle

But that's not enough. You need to disable Avast self-protection OR boot in safe-mode to remove the files from avast program folder. And then you have to manually clean the registry. What a mess. First Avast sneak install and then doesn't even clean out properly.

[REDACTED]

And then you have to manually clean the registry.

Always be careful in the registry.  Note, there are a lot of reg cleaners out there but they can cause MUCH more damage than help.
The only reliable one that has long/great reputation is CCLEANER.....one of the best free utils still out there........
https://www.piriform.com/ccleaner/download