Easy Anti Cheat Turns Off Avast Shields

[Oner41]

I'm using Avast Premium Security.
Yes, that warning is Turkish but probably you will understand. Easy Anti Cheat detects Avast as "non safe system file" and turns off the Avast shields when I play War Thunder.

[bob3160]

Reported to Avast. Let's wait for their answer.

[Spec8472]

Hi Oner41,

this looks like the games anti-cheat is falsely identifying our properly signed AMSI provider as unsafe. https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal. As AMSI provider has global system registration, this can be solved only by adding an exception by anti-cheat vendor, or unregistering Avast AMSI provider completely (not recommended). Can you please specify which shields are turned off by game anti-cheat? This shouldn't be possible for 3rd party SW at all.

Thank you

[Oner41]

Hi Oner41,

this looks like the games anti-cheat is falsely identifying our properly signed AMSI provider as unsafe. https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal. As AMSI provider has global system registration, this can be solved only by adding an exception by anti-cheat vendor, or unregistering Avast AMSI provider completely (not recommended). Can you please specify which shields are turned off by game anti-cheat? This shouldn't be possible for 3rd party SW at all.

Thank you

I checked logs.
All of these shields closed:

[DavidR]

What do you mean by closed, how are you trying to open them and do you get any warning/notification ?

If you are using anything other than Windows Notepad, then you may be being blocked by Avast Self-Defence.
That said, given the reason of your topic, shields being turned off, is everything on when you are trying to access them ?

What is the second to last file (not something I've seen and not English file name like the others) ?

[Oner41]

What do you mean by closed, how are you trying to open them and do you get any warning/notification ?

If you are using anything other than Windows Notepad, then you may be being blocked by Avast Self-Defence.
That said, given the reason of your topic, shields being turned off, is everything on when you are trying to access them ?

What is the second to last file (not something I've seen and not English file name like the others) ?

Shields fully turned off when I play the game. I'm not meaning notifications, protection is closing. And yes, I'm using Visual Studio Code and Sublime Text. Sometimes Notepad++ too but I'm experienced that problem in War Thunder only. Other file means like "Full Virus Scan".

[loungehake]

To my simple mind, this seems to mean that Self-Defense is ineffective.  Can ANY software disable Avast?

[Leo3487]

As I understand, self-defense protect against uninstall attempts
(you must uncheck self-defense if want uninstall via control panel)

[Claudiu7]

Reported to Avast. Let's wait for their answer.

Simple like that???

Usually is

Which Avast?
Which Windows?
.....

[loungehake]

It would be nice to read assurances that Avast self-defense absolutely prevents interference with any of Avast's functions.  It must surely be the case that at least a few of the many millions of Avast users would have realised if its self defense was less than 100% effective.

[Spec8472]

Hi,

no self-defense can protect 100% especially against SW, which runs with administrative privileges (can load kernel driver for example), but we are trying. Our self-defense is also regularly tested as it is subject of our bug-bounty program. In this case, I am not convinced shields are really off. Oner41, is your shields-off observation based only on report files (c:\ProgramData\Avast Software\Avast\report), or are there any other hints? Like Avast AV UI is showing shields are off and also Windows Security Center reporting Avast AV is off (there is a action center notification when file-system shield is off). Can you please provide a support package from your system, so I can check our logs? It is possible to generate support package by using Settings->General->Troubleshooting->Send logs. A FileID will be generated for you, please let me know this FileID. Thank you.

Edit: Installed Steam + War Thunder (including Easy Anti Cheat). AV shields are running, not even aswAmsi.dll error message during gameplay. Is there anybody else with the same problem as Oner41 have?

[loungehake]

Thank you Spec8472.  It is most reassuring to know that a regime of regular self-defence testing is in being. There is obviously no complacency regarding the vital protection of the integrity of your software. That is all I wanted to know.

[Oner41]

Hi,

no self-defense can protect 100% especially against SW, which runs with administrative privileges (can load kernel driver for example), but we are trying. Our self-defense is also regularly tested as it is subject of our bug-bounty program. In this case, I am not convinced shields are really off. Oner41, is your shields-off observation based only on report files (c:\ProgramData\Avast Software\Avast\report), or are there any other hints? Like Avast AV UI is showing shields are off and also Windows Security Center reporting Avast AV is off (there is a action center notification when file-system shield is off). Can you please provide a support package from your system, so I can check our logs? It is possible to generate support package by using Settings->General->Troubleshooting->Send logs. A FileID will be generated for you, please let me know this FileID. Thank you.

Edit: Installed Steam + War Thunder (including Easy Anti Cheat). AV shields are running, not even aswAmsi.dll error message during gameplay. Is there anybody else with the same problem as Oner41 have?

Yes, when I open Avast interface, I saw all shields are closed on the GUI. But I'm played War Thunder today and Avast shields aren't closed anymore.