Premium Security 24.3.6108 Unable to restore quarantine file.

[tmod700]

Did you submit the support package there? Can you post the ID of that package, not of the support case?

Here is a short video tech asked me for showing that AVG doesn't have the issue but Avast does, Both versions were released the same day.
http://www.norwestsuspension.com/Avast/AVG vs Avast.wmv Hmmm not sure if there is a way to get a WMV to play instead of download.

[tmod700]

I have to say I am a bit shocked to the lack of support from the AVAST tech support team,

I have sent numerous emails as well as create posts here to show them the issue is with Avast and to this date no resolution and no replies to latest emails. Has been 50 + days now since I submitted this issue so not like I was looking for a quick reply.

To those that have other issues hope you get a better response time then me.

[igor]

Well, thing is... we don't know why it happens. The logs in your support package indeed show that the file couldn't be restored - but the error code implies the file simply wasn't found, and it's not clear why (since the transfer to quarantine seems to have succeeded without any problems, according to the logs).
It's also not clear if the issue has actually any connection to the dual-boot scenario... or if it's something specific to the particular OS, without any connection to the other OS.

So, let me ask for some details that may help us reproduce the environment...

• You've got two Windows OSes, right?
• If so, do you have Avast installed in both of them? Or you've got Avast in one and AVG in the other... or the other is without an AV?
• What access rights does the C:\Temp folder have?
• The video shows that you have both Avast and AVG installed in the first OS. Was is always the case (i.e. could that fact be the cause of the problem), or did you install AVG only after you found out you couldn't restore the file?

[tmod700]

Well, thing is... we don't know why it happens. The logs in your support package indeed show that the file couldn't be restored - but the error code implies the file simply wasn't found, and it's not clear why (since the transfer to quarantine seems to have succeeded without any problems, according to the logs).
It's also not clear if the issue has actually any connection to the dual-boot scenario... or if it's something specific to the particular OS, without any connection to the other OS.

So, let me ask for some details that may help us reproduce the environment...

• You've got two Windows OSes, right?
• If so, do you have Avast installed in both of them? Or you've got Avast in one and AVG in the other... or the other is without an AV?
• What access rights does the C:\Temp folder have?
• The video shows that you have both Avast and AVG installed in the first OS. Was is always the case (i.e. could that fact be the cause of the problem), or did you install AVG only after you found out you couldn't restore the file?

Correct both are Win10 Pro 22H2 Build 19045.4412, All updates that come down the pipe are installed.

No, I have ESET ESSP 17.1.11.0 on Disk 1 Samsung SSD 850 EVO and then have Avast on Disk 4 Samsung 870 QVO, AVG did not cause the issue as the issue was present prior to it's install. I just installed AVG alongside Avast to show it worked perfectly fine in this scenario. I then uninstalled Avast and left AVG and AVG still continued to work flawlessly.
I also then created that video to show Avast that the same version of AVG does not have the same issue as Avast.

As far as permissions I have full control and I can create and read and write to any file in that folder as well as Eset is able to restore to that folder as well as AVG is able to. The only program unable to restore to that folder is Avast.

From my view Avast has the issue but AVG does not yet they are both the same versions, So what is different between the two that would cause the issue with Avast?

The issue does not present itself unless a drive letter is assigned to the non booted os drive. I can mount it as a volume in a folder and no issue. I can mount the non booted os to a folder and then assign a drive letter to that folder and it works correctly.
So it seems Avast has a issue when you have a os on two separate drives both with drive letters assigned, Maybe a hook causing the issue?

[igor]

From my view Avast has the issue but AVG does not yet they are both the same versions, So what is different between the two that would cause the issue with Avast?

That's a good question... but the answer is "nothing" [we know of], as far as the quarantine-related code goes.

The issue does not present itself unless a drive letter is assigned to the non booted os drive. I can mount it as a volume in a folder and no issue. I can mount the non booted os to a folder and then assign a drive letter to that folder and it works correctly.
So it seems Avast has a issue when you have a os on two separate drives both with drive letters assigned, Maybe a hook causing the issue?

So (I know you've written it before), but just to be 100% sure:

• you open diskmgmt.msc and assign the other OS partition a letter - and the problem starts to manifest
• you remove the letter of that partition again - and the problem disappears? Does it happen right away, or is a reboot required?

Is there anything "special" about that OS partition? I admit I don't know what it could be (since it's a system drive of another Windows OS, it has to be NTFS formatted)... BitLocker encryption? I mean, I may be missing something but the fact that it's another OS partition shouldn't be relevant for the current OS; until that partition is actually booted from, it should be "just another" partition - and you've got quite a few of them.

[tmod700]

From my view Avast has the issue but AVG does not yet they are both the same versions, So what is different between the two that would cause the issue with Avast?

That's a good question... but the answer is "nothing" [we know of], as far as the quarantine-related code goes.

The issue does not present itself unless a drive letter is assigned to the non booted os drive. I can mount it as a volume in a folder and no issue. I can mount the non booted os to a folder and then assign a drive letter to that folder and it works correctly.
So it seems Avast has a issue when you have a os on two separate drives both with drive letters assigned, Maybe a hook causing the issue?

So (I know you've written it before), but just to be 100% sure:

• you open diskmgmt.msc and assign the other OS partition a letter - and the problem starts to manifest
• you remove the letter of that partition again - and the problem disappears? Does it happen right away, or is a reboot required?

Is there anything "special" about that OS partition? I admit I don't know what it could be (since it's a system drive of another Windows OS, it has to be NTFS formatted)... BitLocker encryption? I mean, I may be missing something but the fact that it's another OS partition shouldn't be relevant for the current OS; until that partition is actually booted from, it should be "just another" partition - and you've got quite a few of them.

Weird for sure if there is no difference between the two, Obviously there is but what and where is the question. I did a compare of each folder between Avast and AVG and the files are different in size and code.

Nope nothing special about the partition, NTFS, No Bitlocker, Primary nothing other then a normal partition, I checked the drive serial numbers to make sure they weren't the same and they were not.

Correct on drive letter assignment, Used Diskmgmt.msc and assigned letter and rebooted. That is when the issue would start until I removed the letter assignment and rebooted.

Difference in registry from assigning D to removal of D.
https://norwestsuspension.com/Avast/Avast.zip

Restore failing with D assigned video
https://norwestsuspension.com/Avast/Restore fails D drive assigned.wmv

Restore working after removal of D
https://norwestsuspension.com/Avast/Restore works D letter NOT assigned.wmv

The above links were with only Avast installed on that drive, AVG was NOT installed at that point or had it been.

 

[tmod700]

Igor,

Found something odd, I removed both AVG & Avast and then installed AVG first and then followed with Avast and of course Avast now has Passive Mode On since AVG's Firewall is active.

With Avast set with passive mode on I no longer have issues restoring the test file.

I have since had customer service change my subscription from Avast to AVG as I am not able to fully use Avast even though I prefer Avast as it has a better UI then AVG.

If you want to continue working on this I am fine with that and will help where I can but if you want to close the case that is up to you.

[tmod700]

Igor, Messing with Avast a bit again and when I disable each module that you have listed for disabling when passive mode is enabled none of them allow Avast to restore the file.

If this is correct these modules are disabled when passive mode is enabled but there has to be something else or one is connected to another that prevents the restore of the file as I disabled each of them without being in passive mode and still no restore..

"DisabledProviders"="FileSystemShield,EmailShield,WebShield,AntiSpamShield,BehaviorShield,AntiRansomwareShield,SecureDnsShield,RemoteAccessShield,Sandbox,Firewall,SensitiveDataShield"