Avast refuses to open a program

[rwn0072]

Hello!

I tried to open a program that I have been using before, but now for some reason Avast does not let me open it.
The file is inside of a folder that is in the exceptions list, which means it should really let me start that program.

Instead, what happens is that a new process is started, "Avast Software Analyzer", and it takes around 30-50% CPU and makes the cursor go between loading and normal states rapidly (which is extremely annoying to look at), as shown here:
https://gyazo.com/5d03a3fde67f0dd9f62e8609d10b2389

I have tried restarting the computer and starting the program again, but same problem.
I have even scanned that file for virus but it says it is clean.
I have waited for it to finish for over an hour but nothing happens, the process just keeps grabbing 30-50% CPU and using memory up to 2500 MB and keeps just running until I restart my computer or log out.
I have also tried closing the program that causes this from the windows task manager, but it seems Avast is keeping me from doing that as well.

Also, I am on the latest versions:
Virus defintions: 210905-4
Application version: 21.7.2481- build 21.7.6523.688
I am using Windows 10 Home 64-bit.

[rwn0072]

Below is the code of the entire program that makes this happen (C++, compiled using Visual Studio 2012).
The file the code tries to open does NOT exist, but it is strange that Avast for some reason almost locks my computer because a file does not exist...



#include "resource.h"

#include <windows.h>
#include <string>

enum Type
{
   TYPE_COPY_LATEST_VERSION,
   TYPE_COPY_FOR_BACKUP,
};

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
   Type tmpType = TYPE_COPY_FOR_BACKUP; // ONLY CHANGE THIS WHEN COMPILING

   std::string tmpDir = "";
   std::string tmpFileName = "";
   if( tmpType == TYPE_COPY_LATEST_VERSION )
   {
      tmpDir = "CopyLatestVersion\\CopyLatestVersion\\bin\\Release\\";
      tmpFileName = "CopyLatestVersion.exe";
   }
   else if( tmpType == TYPE_COPY_FOR_BACKUP )
   {
      tmpDir = "CopyForBackup\\CopyForBackup\\bin\\Release\\";
      tmpFileName = "CopyForBackup.exe";
   }

   SetCurrentDirectory(tmpDir.c_str());
   ShellExecuteA( NULL, "open", tmpFileName.c_str(), 0, 0, SW_SHOWNORMAL);

   return 1;
}

[r@vast]

Hi,

Can you please provide us with a support file ID?
To generate the support file, please see this link.
https://support.avast.com/en-ww/article/Submit-support-file

[rwn0072]

I ran the program now and here is the ID: 8NIUQ

[PDI]

Hi rwn0072,

I tried your code on my testing machine and I'm not able to reproduce it.

Could you please share the performance log with us?

It's located in the Settings->general->Troubleshooting just above the sending logs.

Btw is the file, which tries to open the file, on the exclusions as well?

Thanks a lot,
PDI

[rwn0072]

I ran a recorder with the performance problem as you described, I did not recieve a number or anything for it though, but I wrote in my e-mail and this forum thread address. Note that I had to log out of my user in Windows to be able to remove the performance issue again

The file it tries to open is in a subdirectory of the .exe file I try to start, so it is for sure in the exclusion list since it takes all subdirectories with it.
More specifically it looks like this in the exclusion list: C:\ASD\*

Then the .exe file path is in: C:\ASD\Tools\AutoServers.exe

Note that when the file it tries to open in the program exists, everything works.
The bug with Avast only happens when the file does not exist.

I would recommend you to create a file directory like this:
C:\ASD
C:\ASD\Tools
C:\ASD\Tools\AutoServers.exe

Note there is only one file in that file directory and that the file that should exist in "C:\ASD\Tools\CopyForBackup\CopyForBackup\bin\Release\CopyForBackup.exe" that the program itself tries to run, does not exist.
Therefore I think that Avast thinks the program is doing something suspicious since the file it tries to start (and sets current directory to) does not exist.

[PDI]

Hi,

thank you. I'll try to look on our backends for it.

I did the same test yesterday and I wasn't able to reproduce the issue. Could you try the AV 21.8 Beta if the issue wasn't fixed in the new release?

again thanks,
PDI

[rocksteady]

@rwn0072. It is not a good idea to post your email address on a public forum, unless you wish for spam.
I suggest you edit your post and delete or obscure it.

[rwn0072]

@rocksteady
I altered my post now, thank you!

[rwn0072]

Is it this beta version I should install?:
https://forum.avast.com/index.php?topic=301855.0

[PDI]

Hi,

yes, it's the latest beta. I found the performance recording and I'm looking into it.

Regards,
PDI

[rwn0072]

It seems the old link was for AVG and not for Avast, I installed this one now and tried it:
https://forum.avast.com/index.php?topic=301854.0

I followed the instructions of it and restarted my computer. It now says "Avast Free Antivirus BETA" in its toolbar.
It also says "ver. 21.8.2483- build 21.8.6555.561" on application version and "ver. 210909-0" on the virus definitions.

The same issue still exists on that one (I again had to log out of my user to remove the issue).
I had to fight with it for a while now to get my servers started again on my computer though (because of the new Firewall setting, I had to make my network trusted there to make them connect).

[rwn0072]

Hi rwn0072,

I looked into the log and I'd like to know why you are running AutoServers.exe multiple times (280x to be exact). I got impression from you post that you execute it just once.

Can you describe your workflow with more details regarding this executable?

The load can be caused by this behavior not by the non existing file itself.

Thanks for the info,
PDI

I tried twice to answer to that post but it did not show up in the "Sent messages" so I'll post the answer here instead:

I only execute it once, I only double-click it and that is it.
If it really starts 280 instances of that program, it means Avast is doing it (since it sometimes starts programs in a diagnostic mode before opening them, right?).
It really makes sense as well, since from my first post it shows that the "load" icon of the cursor comes on and off all the time, which would then be when a new instance of the program is started, shown here: https://gyazo.com/5d03a3fde67f0dd9f62e8609d10b2389

That means that Avast is starting new instances of the program, since I only double-click it in the standard Windows explorer.

But it then seems that Avast is only creating new instances of it when happens when the program crashes (since it has to crash when trying to set current directory to a non-existing one and then try to open a non-existent file). Maybe that is a part of a diagnostic process or something?

[PDI]

Hi rwn0072,

I got both messages and replied in the PM.

Just to point for other users: Avast AV will never create a process which isn't using our executables and we didn't execute it in the provided data. If we did then it's a bug and it have to be fixed. The only case is when the sandbox is executed but this isn't your case.

To the user sign off solving the issue: The problem is solved because the windows terminates all user processes related to the sign-off profile. The never ending spawn chain is broken by it.

Regards,
PDI

[rwn0072]

Hey!

I found the chain problem now.

What happens is actually pretty simple:
First, the code sets the current directory, which fails completely because that directory does not exist.
Then, the code starts the file named "CopyForBackup.exe", which should also fail. But, it does not fail.

The exe file itself is also called "CopyForBackup.exe", and it then instead calls itself, since it ignores setting the current directory.
This creates a chain like you mentioned PDI, and it never ends until the directory when using "SetCurrentDirectory" exists.

Therefore it means that Avast Software Analyzer takes so much CPU, since it starts so many instances so fast.
So this is a user error for sure by me, but how do I actually disable Avast Software Analyzer for exe files?
Because it is in the exclusion list but it still gets used by Avast Software Analyzer for some reason.

Update: Avast Software Analyzer even starts with all shields off in Avast.