What "avast overseer" is?

[REDACTED]

I noticed new application today: overseer.exe, is trying connect to internet. Is this a new application of Avast Free Antivirus?

[REDACTED]

no i don't

its location:
C:\Program Files\Common Files\avast software\overseer

it seems to have digital signature of AVAST Softwere s.r.o.

[drake127]

Hi, I was betting how long it would take for someone to notice.

It is our new application that is going to help us detect common (technical) issues with our products. In a sense, it behaves similarly to our Avast Emergency Update but is able to correct these issues independently and even catch them sooner. That's at least theory, currently we are evaluating its performance on small fraction of our users.

If somebody is interested in more details, don't hesitate to ask. ;-)

[bob3160]

Hi, I was betting how long it would take for someone to notice.

It is our new application that is going to help us detect common (technical) issues with our products. In a sense, it behaves similarly to our Avast Emergency Update but is able to correct these issues independently and even catch them sooner. That's at least theory, currently we are evaluating its performance on small fraction of our users.

If somebody is interested in more details, don't hesitate to ask. ;-)

Asking ....

[drake127]

Asking ....

OK, that's really vague question but I'll try. :-)

It's a small independent application residing in its own directory, therefore it should be able to fix even most broken Avast installations. It's being run daily from task scheduler but it has really small footprint and if everything is fine, exits within seconds. It also has its own release cycle and is able to update itself automatically.

During its run, it identifies some well-known (but very hard to prevent) issues with our products and attempts to fix them, if possible. For example, it detects whether the antivirus service is running and if it is not, it triggers repair. Right now, that's about it. We'll see if it actually helps as much as many people in the office hope it will. :-)

[Rundvleeskroket]

Hi. I got this same alert from my firewall today. Found this thread after i saw it resided in the Avast directory.

What communication is the executable trying to establish exactly?

I blocked it, and I am considering deleting it. Because I don't know what data it is sending, and I don't like unknown executables to suddenly start chatting away without being informed and given an option.

Does blocking/deleting/removing this form task scheduler adversely affect Avast functionality, or is it completely superfluous?

FYI, it did not quit after a few seconds. It remained running. Perhaps because it could not complete its task.  I killed the process.

The thing I want to know most is when will you guys finally learn to be better at communicating these changes? Do you really think it is best to have people be startled by strange executables wanting to talk to some server? You provide AV, yet this behaviour screams virus/spyware. Your little application might be benign, but this kind of roll out certainly does nothing to assuage mistrust.

[slama1304]

Asking ....

OK, that's really vague question but I'll try. :-)

It's a small independent application residing in its own directory, therefore it should be able to fix even most broken Avast installations. It's being run daily from task scheduler but it has really small footprint and if everything is fine, exits within seconds. It also has its own release cycle and is able to update itself automatically.

During its run, it identifies some well-known (but very hard to prevent) issues with our products and attempts to fix them, if possible. For example, it detects whether the antivirus service is running and if it is not, it triggers repair. Right now, that's about it. We'll see if it actually helps as much as many people in the office hope it will. :-)

I would like to know how are you able to install additional programs on my PC without me knowing?
What stops you from installing something else or someone exploiting this option to do same or worse?

[REDACTED]

Hi,

I have the same question as slama1304 and the others... why have you installed such a program on my computer without my permission and even worse intend for it run, daily, utilising my computers system resources (no matter how small you say it is) and even worse, having it communicating over the internet and updating itself without my express permission? I don't even allow Avast to automatically update as I have a limited data plan and besides want to update when I choose, not anyone else!

This is the behaviour of Spyware and immoral corporate practices. Please, respectfully, explain to me how to remove this immediately or I'll have to uninstall Avast.

I have now blocked this application via my firewall and it has repeatedly attempted to access the internet. I couldn't even end the process in Task Manager! It was utilising more and more system resources as it went through a loop until after 20 minutes or so it suddenly disappeared from task manager...

If I didn't know what this was I'd now be running anti-virus and malware scans which is exactly why I have Avast installed in the first place!

Honestly guys, what are you thinking?

The benefit of this seems minimal for the user compared to the potential privacy and system risks. The lack of transparency and upfront explanation of what was being done will impact upon your reputation, I know it has for me.

Finally, just to mirror Rundvleeskroket 'does blocking/deleting/removing this from task scheduler adversely affect Avast functionality, or is it completely superfluous?'. The fact  it ate up a large amount of processing power is concerning...

[Pondus]

https://www.avast.com/en-eu/eula

https://www.avast.com/privacy-policy

[Rundvleeskroket]

Finally, just to mirror Rundvleeskroket 'does blocking/deleting/removing this from task scheduler adversely affect Avast functionality, or is it completely superfluous?'. The fact  it ate up a large amount of processing power is concerning...

It popped up again today for me too. Just like last time, I blocked it in my firewall, killed the process, and deleted the folder with its executable. Avast runs just fine without this 'tool'.

After I previously deleted the scheduled task associated with it, that hasn't yet come back.

[drake127]

Hi guys, please keep in mind that I am not PR marketing specialist but mere developer (and key author of this feature). From my perspective, there is no significant difference between program update, VPS update, emergency update, MS hotpatch update etc. It's just content delivery mechanism while taking in account number, importance and severity of changes made to a computer. Same thing applies to a decision whether we update existing DLL, create a new one or create entirely new executable. In this case, there are some very good reasons to have completely independent executable. I am aware that because of this it is more visible and I am willing to shed some light why and what it does. But to say it bluntly, if we included said functionality into primary service, nobody would noticed or cared (and we do on hourly basis - it's called VPS update).

To answer some of the questions (valid for current build):

• How does it communicate:
  It always attempts to connect to the Internet to download its updated definition file. It's signed plain text, so feel free to check for yourselves: [link removed]
  It also reports to our server its start and any encountered error during its run with some basic information about computer. Please note that it is just minimal subset of information regularly sent by Avast itself.
  
• Can I block or remove it?
  It is now considered integral part of Avast installation. You can disable it but it will reappear sooner or later (during program update etc.).
  However, if you disable it, you may lose VPS updates under some (currently quite rare) circumstances.
  In a way, it's similar to our emergency update service. If you disable it, your computer will run just fine. Until you won't be able to boot your computer next Tuesday because MS is going to release some incompatible changes to Windows and we need to update some of our drivers before then.
  
• It eats my CPU. What's wrong with you guys?
  OK, this should not happen and goes directly on my head. If you can, send me memory dump or any details by personal message and can look into it. Nevertheless, it runs as low priority process and makes very little IOPS and it should eat virtually no memory
  

[slama1304]

https://www.avast.com/en-eu/eula

https://www.avast.com/privacy-policy

Where is anything saying Avast can install additional software?

[Pondus]

https://www.avast.com/en-eu/eula

https://www.avast.com/privacy-policy

Where is anything saying Avast can install additional software?

here i guess

3. UPGRADES AND UPDATES

Vendor, from time to time during the Subscription Term and without your separate permission or consent, may deploy updates of, or replacements for, any Solution, and as a result of the deployment you may not be able to use the applicable Solution or Device (or certain functions of the Device) until the update is fully installed or activated. Updates will be deemed a part of the Solution for all purposes under this Agreement. Updates may include both additions to, and removals of, any particular features or functionality offered by a Solution or may replace it entirely, and Vendor will determine the content, features and functionality of the updated Solution in its sole discretion. Vendor or your Device is not required to offer you the option to decline or delay updates, but in any event you may need to download and permit installation of all available updates to obtain maximum benefit from the Solution. Vendor may stop providing support for a Solution until you have accepted and installed all updates. Vendor in its sole discretion will determine when and if updates are appropriate and has no obligation to make any updates available to you. Vendor in its sole discretion may stop providing updates for any version of the Solution other than the most current version, or updates supporting use of the Solution in connection with any versions of operating systems, email programs, browser programs and other software with which the Solution is designed to operate.

[igor]

It is not additional software - it is simply another module of Avast Antivirus, not a new or unrelated program.

As drake127 said, new executable files appear (and disappear) in Avast installation folder daily, during virus definition updates - and sometimes even at other occasions, if needed. If the file is an "EXE" (which you are probably calling a program) or a DLL (a library), it doesn't matter, it's just a technical decision whether to make a piece of code an EXE or DLL (or something else, like a driver, or even just a "data file").  Btw, the difference between an EXE and DLL file is exactly one bit somewhere in the beginning of the file.
When I look at the installation folder of Avast Free, there's about 90 DLLs and 25 executables there - yet it's not an installation of 25 programs, it's just one - Avast Antivirus.

The discussed functionality (and much more) is already present in the "main" Avast modules, and has been there for years. It has only been extracted to (or possibly duplicated in) a standalone module in attempt to make the product more robust/reliable (and subsequently to provide a better protection with less compatibility issues).

[bob3160]

@ igor,
Thanks for the clarifying explanation. Is it possible that these types of changes are mentioned when the
happen. Possibly in the beta section where we would see them first?
Thanks