avast not updating when non-admin users are logged on

[Ecio]

Hello,
i've installed the demo version of Avast Professional on a couple of computers in my firm in order to evaluate it (if we decide for Avast we will deploy it as managed antivirus and we will use ADNM).

I've noticed this strange behaviour: on computers where the user is logged on with a non administrator account avast does not update itself. If I try to force the update (logged on with the low priviledge account), the antivirus does not try to contact avast servers but pops up immediately the "Summary" box (reporting  - i suppose - the details of the last successful update).
If I logon with Administrator account i can correctly update the VPS signatures (i suppose that avast would update itself automatically if I leave the machine logged on as Administrator for enough time)

The computers are currently on a workgroup (no windows domain currently, but we will have it in a couple of months) and Avast is Pro (no managed version). Avast was of course installed as Administrator (and the machine was rebooted).

My question is: is this problem due to the fact that i'm running the demo version (but so why does the antivirus update itself when logged on as admin?) or there is something else?


Thanks in advance

[Lisandro]

I'm not used to the ADNM version. But in normal PC version, if avast! is run from non-admin account, it does spawn the setup process using the service with LocalSystem rights. That brings two things:
a) it should update program without problem.
b) there may be problems reaching the Internet if there is some non-standards-compliant proxy (read ISA) in way which authenticates using NT credentials.

So, to sum it up: it should be possible to run whole program update from an limited user account, avast's setup was designed that way.

I think it's not related to the fact the version is demo.

[Ecio]

thanks "Tech" for the quick reply.

Actually we are NOT using the ADNM version (we are planning to do so IF we decide to buy Avast as our enterprise antivirus solution).
The problem im reporting is with Avast Professional Demo version.

The pc is a simple windows XP SP2 and the installation was launched as Administrator. There is no ISA proxy between the pc and the internet, we are behind a NAT but computers take IP via DHCP and there's no need to configure any proxy. Of course not all the tcp/ip ports are opened but http/ftp are ok, infact as stated above i can update the antivirus with admin accounts.
Non-admin users can of course use internet

PS You're talkin about "update setup program": i'm talkin about th signature update (iAVS), not the program update, i have not tried to update the program but i suppose it wont work too..


 

[Lisandro]

Please, post the last 200-250 lines of avast log: C:\Program Files\Alwil Software\Avast4\DATA\log\Setup.log

[Ecio]

tomorrow i'll try to replicate the problem on a virtual machine so i wont disturb my users.. stay tuned!

[Ecio]

Hi,
I've successfully replicated the problem in this way:
-freshly installed Windows XP SP2 on a virtual machine. Two accounts, Administrator and Test (non admin user, he belongs to "User" group)
-installed Avast Professional Italian Version as admin (setup downloaded some months ago, so im sure VPS is not updated). Version is 4.7.1043, VPS is 00779-0 october 2007
-machine rebooted, logon with Administrator (with network disconnected in order not to update the program), check that install does not report any error -> everything ok
-machine rebooted, user Test logged in -> tryin to update iAVS pops up "Summary" box with no information inside (i suppose it tries to show the previous update summary and it cant find it)
-checking setup.log file doesnt show anything particular, but i have found a Warning.log that reports one line for each failed attempt:

11/01/2008   11.06.44   1200046004   test   164   Function setifaceUpdatePackages() has failed. Return code is 0x00000426, dwRes is 00000000. 
11/01/2008   11.12.45   1200046365   test   164   Function setifaceUpdatePackages() has failed. Return code is 0x00000426, dwRes is 00000000. 

All the Avast services are up and running as Local System account (i have not changed anything here, just verified everything's ok)

PS Using Internet Explorer i can successfully reach avast.com site (so browsing is ok)

Now i'll try to do some more testing...

[Ecio]

Gotcha!
Giving write/modify permission to normal users on "%programfiles%\alwil software\Avast4\Setup" folder make iAVS updates work.
I must check if program updates work too, btw I think it's a bit strange given that there are services running as local system... aint it ?

[Lisandro]

11/01/2008   11.06.44   1200046004   test   164   Function setifaceUpdatePackages() has failed. Return code is 0x00000426, dwRes is 00000000. 
11/01/2008   11.12.45   1200046365   test   164   Function setifaceUpdatePackages() has failed. Return code is 0x00000426, dwRes is 00000000. 

I've posted something similar here:
http://forum.avast.com/index.php?topic=32590.msg272542#msg272542

About folder permissions, hmm... you're not supposed to change them... something is wrong.

[Ecio]

Hi Tech,
I've had a look to other posts on the forum and i see that this problem sometimes (always?) happen since 2007 (or even before).
I see that many times the suggested solution is "add/remove Avast" but this solution is not feasible when you have many clients (of course when you have many clients you can use ADNM deployment but it's not a great solution and actually this problem denotes some serious bug in this product). Modifying folder permission is not the best solution but it if works it could be done via GPO when you work in a domain...but im a bit perplexed about using this product in our deployment scenario (50-100 client in AD) seein this kind of problems.

As you said "something is wrong" but I cant spend too much time tryin to figure out how to solve this. As stated above i did a simple new install on a fresh XP Sp2 and the problem immediately appeared...

I dont know.. i really dont know...

[Lisandro]

I've asked for superior help, can't do more than this...