What "avast overseer" is?

[rocksteady]

Hi, Avast Overseer should be deleted by Avast Uninstall Utility.

@drake127
Please clarify: are you saying overseer is now deleted by avastclear, or only that it should be deleted by avastclear ??

[markcarsonboxz]

Hey all, just registered for the purposes of giving my two cents...

I downloaded Piriform CCleaner v5.55 on 22 March 2019 at 11:06am GMT from https://piriform.com. I have a copy of the original download executable (and a record to that site). During the installation wizard I was not prompted with an EULA for Avast Antivirus Free or informed of changes other than the installation of Piriform CCleaner v5.55. This is out of character for Piriform, and I can only believe that there was a mix-up when they released that file.

A SILENT installation of Avast Antivirus Free was started and I was prompted for a restart - (I should have logs of this). After restart and the realisation that Avast Antivirus Free was installed, I subsequently uninstalled BOTH CCleaner and Avast Antivirus Free. I will NEVER use either product nor promote their installations on any computer.

I have installed, recently, a firewall product called GlassWire which notified me of new Network Activity to an IP Address located in Australia (1.1.1.1) (Awesome IP address BTW).

Please bear with me. I have agreed to nothing about AVAST software installation and my usage of it which has allowed? me to investigate what exactly is occurring with Avast Overseer:

• Each time the Scheduled Task executes, it runs overseer which then proceeds to install an updated copy of itself with SYSTEM level permissions.
• It runs periodically sending small packets of information to 1.1.1.1
• It checks but does not report to the user that there has been a problem with Avast (i.e. "Avast doesn't exist")

I am analysing the packets using Wireshark and a few open-source Linux programs to 'look inside' those packets to find out WHAT is being shared. I have disabled the Scheduled Task and will be re-enabling the History tab. But I will stop short of reverse engineering the file itself.

To close, I would like to say:
A program installed without permission can be defined as malware. A program that isn't uninstalled by it's parent installation and runs silently, daily (twice), updating itself from a remote server can be defined as a 'trojan horse' virus. It executes with SYSTEM permissions, the same as most Windows services. It (Overseer.exe) could do anything!

This has been my experience with Avast

Thank you

[chris...]

1.1.1.1 obviously has nothing to do with the installation of avast or ccleaner.
It is an IP resolver like your provider's or google's (8.8.8.8 )
https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/
Check the settings of your network card (TCP/IPv4), the DNS server used by default must be the one of cloudflare (1.1.1.1)?

Apart from that detail, I agree with you quite a bit, avast's policy has become far too aggressive, but I think it's wisely managed on their part between the pros and cons.

[markcarsonboxz]

Thanks for clearing that up. I realised that this morning - it was 0030 here at the time of my post 

I will continue to monitor this thread as I am extremely concerned about the whole concept of these types of applications that are developed by reputable organisations.

After further thought, in defence (??!) of Avast, it may have been an oversight in the compiling of the installer/uninstaller of Avast AntiVirus Free. However, it highlights the topics in my aforementioned comments about malware and 'trojan horse' viruses i.e. software like Avast Overseer having similar 'functions' to these types of 'software'

I understand that my experience with Avast may not be what is experienced by other users, e.g. 'SILENT installation' in my previous post. And, may in fact be unique to users of a particular version of CCleaner.

I will update the forum, and quite possibly Avast themselves through another channel.

[Bosco123456]

Almost a month later.

I am running Clam and it notified me in red of Overseer.

I've just deleted the malware/trojan horse  that Avast installed and left on my computer without my permission in a deceptive manner since I expected the Uninstaller to delete ALL.

I'm through with Avast. This company has lost all credibility.

Also - bob3160's replies in all threads critical of Avast ("If you don't like it you are free to use another antivirus") type replies -
both hostile and defensive - are not helpful and lend themselves to feeling that Avast feels a need to cover up and stifle discussion.
Instead of pearl clutching perhaps he could take his own advice - if he can't deal with reading threads with valid criticism of Avast he's free to read something else.

Almost a month after the prior last post in this thread and nothing has been done to rectify the Uninstall situation - I just uninstalled Avast a few days ago.

[bob3160]

Almost a month later.

I am running Clam and it notified me in red of Overseer.

I've just deleted the malware/trojan horse  that Avast installed and left on my computer without my permission in a deceptive manner since I expected the Uninstaller to delete ALL.

I'm through with Avast. This company has lost all credibility.

Also - bob3160's replies in all threads critical of Avast ("If you don't like it you are free to use another antivirus") type replies -
both hostile and defensive - are not helpful and lend themselves to feeling that Avast feels a need to cover up and stifle discussion.
Instead of pearl clutching perhaps he could take his own advice - if he can't deal with reading threads with valid criticism of Avast he's free to read something else.

Almost a month after the prior last post in this thread and nothing has been done to rectify the Uninstall situation - I just uninstalled Avast a few days ago.

@ Bosco.
Apparently you took that advice you found not to your liking. Good luck with your choice.

[tomalex1]

I have used Avast free version for several years. Several months ago, I uninstalled Avast (at least I thought it was uninstalled) and installed the Comodo Internet Security product. Comodo has a higher learning curve than Avast but their product is both comprehensive and free.

Now regarding Avast; just this morning Comodo popped up and told me overseer.exe was trying to create a file. I looked it up and found out overseer is an Avast file that was left behind after uninstall. I checked and deleted some folders Avast had left on my PC, although I reckon there are still more and also I have not entered the registry yet to check there. It seems to be a common practice for software Devs to leave part of their installation behind, possibly for telemetry purposes. Avast is one of the biggest if not the biggest player today in the Anti-malware world. Obviously, they want to protect their market share and become even bigger, so these aggressive tactics should be expected. A suggestion would be to use an uninstaller program like Revo Uninstaller. There are also many others that are similar and they specialize in removing all traces of software installations, whether folders, files, or registry entries. I think Avast is a good product, but I recommend going in with your eyes open.

[bob3160]

I have used Avast free version for several years. Several months ago, I uninstalled Avast (at least I thought it was uninstalled) and installed the Comodo Internet Security product. Comodo has a higher learning curve than Avast but their product is both comprehensive and free.

Now regarding Avast; just this morning Comodo popped up and told me overseer.exe was trying to create a file. I looked it up and found out overseer is an Avast file that was left behind after uninstall. I checked and deleted some folders Avast had left on my PC, although I reckon there are still more and also I have not entered the registry yet to check there. It seems to be a common practice for software Devs to leave part of their installation behind, possibly for telemetry purposes. Avast is one of the biggest if not the biggest player today in the Anti-malware world. Obviously, they want to protect their market share and become even bigger, so these aggressive tactics should be expected. A suggestion would be to use an uninstaller program like Revo Uninstaller. There are also many others that are similar and they specialize in removing all traces of software installations, whether folders, files, or registry entries. I think Avast is a good product, but I recommend going in with your eyes open.

Use the Avast removal tool. https://www.avast.com/en-us/uninstall-utility

[cnc.hobby.set]

Why is it still running when avast is uninstalled ?
Can you take care of this point please ?

[Rundvleeskroket]

Because it is a (imo poorly implemented) tacked on monitoring tool, and Avast doesn't clean up after itself very well.

Just delete the file and folder. Kill the process if you have to, and then delete it all. Delete the scheduled task too.

Hell, I have Avast installed but overseer is not on my system. Doesn't affect functionality one bit.

[chris...]

hi,
Can anyone tell us if overseer still stays using the uninstaller of the latest version (19.6) of the antivirus ? Where it is indicated in "What's new"

A cleaner goodbye - If you ever uninstall us (gasp!), we now do a better job of removing all our files

[cnc.hobby.set]

Rundvleeskroket: Thanks for the tips, i did almost everything you said, except the scheduler, i'll remove the task.

chris.. Yes i did use that last version even before i post this and id does not remove it.

[rocksteady]

Is overseer.exe still part of the avast free av package or not?
I have latest 19.6.2383 (build 19.6.4546.517).
I do not see it running in Task Manager, but files of that name are still listed in two places on my drive.

[bob3160]

Is overseer.exe still part of the avast free av package or not?
I have latest 19.6.2383 (build 19.6.4546.517).
I do not see it running in Task Manager, but files of that name are still listed in two places on my drive.

https://forum.avast.com/index.php?topic=210028.msg1427323#msg1427323

[Rundvleeskroket]

Rundvleeskroket: Thanks for the tips, i did almost everything you said, except the scheduler, i'll remove the task.

If the executable is no longer present on the system, the task can't actually do anything. But still. An uninstall should remove everything. It is just sloppy.