I posted this yesterday on the Avast Business on-premises forum (
https://forum.avast.com/index.php?topic=323148.0), on the assumption that this might be a program bug or an actual attack rather than a false-positive. But I didn't get any responses there so now I'll try it here:
A Windows 10 Pro 64-bit user contacted me to tell me that they had seen an Avast pop-up warning of an issue with LTsvc.exe. That's a legitimate program in our case; we use ConnectWise (formerly LabTech) agents on our machines. Recently these agents have been automatically updating themselves, so that may have been the root cause of this event.
Whatever Avast did, it didn't affect the functioning of the ConnectWise agents; they are still working normally.
I do realize that there are exploits involving abuse of ConnectWise components, but as best I can tell they require user interaction to trigger. This user wasn't doing anything at the time the Avast alert occurred; they simply returned to their office and saw the alert being displayed. Unfortunately, I didn't copy the message details down, because I assumed I could get them from the console later. I was wrong.
That user's Avast client Alerts tab shows "No alerts yet" -- though after a reboot, so I don't know if there's a cumulative history there to be seen.
This computer was connected to the network at the time so it should have instantly sent a message to the console, which should then have emailed me. None of this happened. I didn't get an email and there's no notification of the event in the console.
So while I might have posted this in \Viruses and Worms as a likely false positive, I am wondering if there was some kind of malfunction with Avast that caused it to display an alert but not send it to the console.
Any thoughts?
Avast Business Pro
Program version 23.1.2738
Definitions version 230328-2
On-premises console version 7.29.968
Thanks.
