If it is NOT broken, DON'T "FIX" it!

[dewild1]

 
Please do not make updates to your program without thinking about the usability and how it will affect their computers.

For example.
1. My own mother is calling complaining about how her computer is real slow after Avast asked to reboot because of an update.
I have gotten several other calls from clients that i have installed Avast onto complaining of slow downs as well.
The ashServ.exe root kit scan is taking about 50% cpu on the systems I have seen it on a few min after boot.

People turn on their system so they can use it, not wait for it.

I customize Avast, AntiSpyware and many other things so their system will boot fast and do maintenance when they are not using their computers. I spent a lot of time configuring Avast or the other Antivirus we use to be hassle free and fast etc. You're killing that.

2. I would not mind the above one so much because I used to be able to modify avast.ini before you did the self protect stuff.
I have repeatedly asked for a way, (that I would keep private), to turn it off.
I can not shut it off now by switching it to not start in the registry.
I can not shut it off by deleting the registry key.
I can not shut if off by adding it to PendingFileRenameOperations.
I can not fix these new features to keep my family and clients happy unless I turn it off.
It has cost be over a $1000 in waisted bandwidth too.
You see, my program, I made it to change the Avast.ini if I needed to and do scans, etc, was in the Avast directory.
Avast thought it was a virus and deleted it.
I informed you that it was not a virus and sent the file to you. (with in 24 hours, you excluded it.. You guys are FAST )
My update system keeps trying to download it and it is wasting tons of bandwidth on my server and slowing their internet down.

If anyone knows of a way to turn it off, (a command, script, or other way, not manually so I do not have to call a bunch of clients), please PM me so they will not "patch" it.. 

Avast is great, but please.....

[alanrf]

It is all too easy to extrapolate a few examples and assume they represent the whole community. 

Should I extrapolate my certain knowledge that the rootkit scan on my system lasts 3 seconds and that none of the folks I support are complaining to a "there is no problem to fix"?

You can turn off the rootkit scan via Program Settings > Troubleshooting  (this creates an avast4.ini setting).

You can also review the last rootkit scan log in the avast logs folder (aswAr.log) which contains the start and end times of the last scan and what was scanned.  It may help the whole community if there is something that can be identified in the scans on the systems you are reporting that is (perhaps unnecessarily) prolonging the scans on these systems compared with others.

Final thoughts - if you can programatically turn off and modify the self protection features then so can any hacker.  I  hope the avast developers will not devote any time to supporting the ability to reduce the enhanced security of avast in this way.

I am not entirely unaware of the kind of problem you face.  Certain features I have written for myself to assist me with testing problems reported in this forum and some I used with the folks I support no longer work with the enhanced security of avast.  Yes, I whined about it - but I have accepted that these changes are for the greater good of the majority of avast users.

[Vladimyr]

alanrf
I think I understand dewild1's problem but it appears to be largely of his own making.
He markets a product which includes a customised version of avast! (I assume he is an authorized reseller) with a number of guaranteed benefits, including that Your PC will boot up TWICE as fast as it does now. and recent changes to avast! have "put a spanner in the works". I'd be frustrated too!

I think the first line "Please do not make updates to your program without thinking about the usability and how it will affect their computers." is very informative. He has very particular requirements which are at odds with what most people expect a self-defense module to do.

[alanrf]

Vladimyr,

I edited my comments while you were posting. 

I have some sympathy with the problem encountered by the poster since I too support others.  However, I did not modify the package but provided expected settings to my users.  Nevertheless, as you may have seen in other places it would be dishonest of me not to admit that I whined about the effects of the new security features on my ability to get things done. 

I think I have made clear that my frustrations (as perhaps those of dewild1 too) must give way to greater good of the whole avast community.  I only have to remember what I and those I support pay for this product and be glad I found it (and this forum). 

[Lisandro]

I think it WAS broken and Alwil team did a good think fixing it.
Self-defense module and antirootkit scanning were more than welcome.
We can help troubleshooting if something get wrong...

[dewild1]

Vladimyr, Yes, boot up twice as fast!  We do say in the "fine print" that we can only make XP boot up twice as fast and it can not be a fresh install of windows, it needs to at least be a few months old. If you promise to keep it secret, PM me.. Its already not a secret on the net, but I do not want to promote it.

But hey, that is nothing..  We offer Guaranteed Protection!

Most don't believe so we are not huge yet, http://www.guaranteedpcfix.com/news to see proof. I am surprised you did not scoff at that!

I may have come off wrong last night, I have a bad cold and got bitched at for the $1000 of waisted money by my wife.. (it rolls down hill you know )

We have set up Avast with a script that reads then deletes a key in my MS Access database on my web server, as we use it, but we don't install Avast much. Its to expensive. The other antivirus we use is only $7 (our price).
I think, (if I remember correctly), Avast is about twice as much for the volume we do. So we have not signed up yet.
When I made my script - ASP page that talks with the Access database, I was hoping to get better prices.. (HINT HINT)

I have installed it on my computer, a few techs and family and a few clients we work close with. I did this so we can test it out and make sure everything works smooth.

You see, I love how Avast is one fricken click and it is installed and we are currently only going to use it if we ever get real busy.
The other ones we use are semi scripted.. So they take more time, but hey $$$$$ talks, and for everything we do and the promises we deliver, every penny counts.
If a client gets re-infected, we truly have to earn our money. (and yes, this does happen, I am not promising eternal computer life you know)

While we are on the subject, the avast Create silent install has a wee bug.. It sometimes does not export exclusions correctly. If you have many of them, like I do.
This is ANOTHER reason I need to shut off self protect via a script or program that is run remotely.

When I originally set up the script that talks to my server, reads the record, then deletes the record, and then it edits the Admin.ini with that variable using RegEx replacing the line "Serial=" and if my ms Access database is out of licenses, (like is is now :'(), my script pops up with an input box for my techs to paste a license in...
After that, the silent install does the rest, I did not catch the exclusion bug, the folders that I needed excluded, were not excluded because of this bug and that is where this whole mess started from.
I need to replace the Avast4.db and Avast4.ini with ones that are not corrupt.
Unfortunately, I did not record who we installed Avast on, and who we did not, and in many cases, they bought it themselves after I told them it was the best one out there and the fastest one with the special way we customize it. Kind of like a protection upgrade. (I still say that is true, but like I said, $$$$ talks)
So my update will check to see if Avast is on the clients PC, then replace the two files and then I want to turn SP back on because it is a good feature.
And if I did not open my BIG FAT MOUTH here http://forum.avast.com/index.php?topic=35291.msg296770#msg296770 I could have..

Also, as for rootscan..
Sure, great idea, poor sensitivity.
The number one reason why people buy computers, is to USE them.

The reason people come back to me year after year, is because I set up their PC to be user friendly and hassle free, self updating, self maintaining, self protecting.

May I suggest that you do what I do with my scans, updating, etc.
1. Wait for a few minutes after booting up. (you already are doing that one)
2. Monitor idle time.
     a. Do not start the scan until about 5 minutes of no mouse or keyboard activity has occurred.
     b. Stop the scan if any activity does occur on the mouse or keyboard.
     c. go back to "a."
3. Set depth of scans. If it is between 6 am and 11pm do a light scan.. 12am-5am, heavy - deep scan for the people that leave it on all night.
   

[igor]

While we are on the subject, the avast Create silent install has a wee bug.. It sometimes does not export exclusions correctly. If you have many of them, like I do.

Any more details on that? (so that we could reproduce the problem)

So my update will check to see if Avast is on the clients PC, then replace the two files and then I want to turn SP back on because it is a good feature.

Well, you can modify avast4.ini with notepad.exe - if you confirm the subsequent consent dialog.
Now, it doesn't really have to be notepad - it just has to be called notepad.exe... so, if you rename your tool to this name, you should be able to modify the files (provided you confirm the warning - or two, actually, and serialize the operations somehow).

And if I did not open my BIG FAT MOUTH here http://forum.avast.com/index.php?topic=35291.msg296770#msg296770 I could have..

Not really - the omission has already been fixed in our internal builds when you wrote about it on the forum.

[RejZoR]

Antiviruses have to be updated if you like it or not. It's not kind of type of program where you'd make it once and pretty much forget about it. It has to be updated to cover all the malware. It worked for their internal tests and it worked for all the beta testers here. So they released it to public. It's how every program release cycle looks like. Predicting how it will affect milions of combinations of all sorts is impossible and simply cannot be expected. Even the best software companies (and i count ALWIL there!) have and will always experience such problems regardless.

It's funny though that usually no one gives ANY compliement to companies when programs work as expected or even better (that especially applies to free ones) while they make a lot of noise when something doesn't work.
I usually contact the vendor, give him as much info as possible regarding the issue and so far i've solved it in no time for every program there is, be it payable, freeware or even open source. But just ranting about stuff that has nothing to do with it won't help anyone. Not that you can't write that too, but if you do, don't forget about important stuff. I know i have ranted this way too, even here, but you can use this only to show how serious the issue was.
For starters you could at least mention what OS and avast! edition you're using, but you forgot even that... Steps to reproduce the issue, what happened before those symptoms, error messages if any, provide log files, check Windows Event Viewer and so on are also important. ALWIL programmers don't have telepathic capabilities so writing as much as possible about issue helps more than you think.

[dewild1]

My post last night, again, was poorly written. I apologize.

I have two identical laptops 2.4 duo, 64 gig SD hard disk, 2 gig ram, Vista biz, it took about 1 min on each.

On my moms, accessing it remotely after reboot, (extra 30-60 second delay before I get connected), it ran for about 3 minutes. It has XP, 512, maybe 2 GHz, hard drive was replaced last year.

The other clients that have complained, I have no clue.. Untested..

Now I know I am just a small guy but over the last 20 years, I have gathered something the big corporations have not... I deal directly with, and listen to the end user, and I know that with all the junk they collect over time, every little bit counts and the fast startup is one of the most important things to them.. (well, its what they bitch about most when its slow).
On, that note.. Yes, we are in an unappreciated field.

If it is working OK or semi OK, you never get thanked.. But if it breaks, you just killed their cat, kids and stole all their money.. OK, well, that is how they act...

Please trust me, this works well and gets the job done eventually.

1. Wait for a few minutes after booting up. (you already are doing that one)
2. Monitor idle time.
     a. Do not start the scan until about 5 minutes of no mouse or keyboard activity has occurred.
     b. Stop the scan if any activity does occur on the mouse or keyboard.
     c. go back to "a."
3. Set depth of scans. If it is between 6 am and 11pm do a light scan.. 12am-5am, heavy - deep scan for the people that leave it on all night.

If you want to see some of my code that does it, and you promise not to laugh, I can PM or email you.

igor, please edit your post, that info could be used against Avast.

But thank you! Now I have a way to fix it! YEAAAAAAAAAAA!!!!!!

[igor]

How? That's why the confirmation dialogs are there...
The restriction to notepad.exe (which can be extended in avast4.ini itself) is there only to prevent false warnings when other programs open the .ini file for write access, even though they don't need it. So, I don't think there's any secret here...

[dewild1]

 :'( :'( :'( :'( UGGGGG
You are right, I can not get past the ashCnsnt.exe..
So am I just screwed or is there something I can do, besides calling everyone because I have no clue who has what?


The tasks.xls corruption looks like this,

      <STANDARD--Exceptions>&lt;RW>?:\PAGEFILE.SYS,&lt;RW>*.TXT,&lt;RW>*.LOG,&lt;C:\some dir\*,&lt;C:\some dir\*,&lt;RW>*.INI,&lt;RW>C:\WINDOWS\TEMP\*.TMP,&lt;RW>*\_AVAST4_\UNP*.TMP,&lt;RW>C:\WINDOWS\WINSXS\*.MANIFEST,&lt;RW>C:\WINDOWS\WINSXS\*.CAT,&lt;RW>C:\WINDOWS\WINSXS\*.POLICY,&lt;RW>C:\WINDOWS\CS</STANDARD--Exceptions>
      <STANDARD--Exceptions1>C\*.TMP,&lt;RW>W>*\EDB.CHK,*.fdp,C:\some dir\*,C:\some dir\*,some dir\*</STANDARD--Exceptions1>

RW>W>*
>&lt;RW>?: are the problems, I think
When I edit it manually and exclude all the strange stuff, it works fine in the testing I am doing now.

[Vladimyr]

Most don't believe so we are not huge yet, http://www.guaranteedpcfix.com/news to see proof. I am surprised you did not scoff at that!

No scoffing intended! Your requirements are very particular, especially the need for no user intervention. As I said, I'd be frustrated too.

Also, as for rootscan..
Sure, great idea, poor sensitivity.
The number one reason why people buy computers, is to USE them.

To be clear, are you saying the rootkit scan is taking 3 minutes on your mom's XP PC? Does the log file give any clues?
This is not an issue for anyone I'm supporting. I just checked 'aswAr.log' on this PC. The rootkit scan today took place about 7 minutes after startup and took 7 seconds. I don't remember what I was doing at the time but I didn't notice it.

igor, vlk
Is it possible to tweak 'aswAr.log' generation for diagnosis, to temporarily add a timestamp to each line?

[MiguelAngelXP]

My post last night, again, was poorly written. I apologize.

I have two identical laptops 2.4 duo, 64 gig SD hard disk, 2 gig ram, Vista biz, it took about 1 min on each.

On my moms, accessing it remotely after reboot, (extra 30-60 second delay before I get connected), it ran for about 3 minutes. It has XP, 512, maybe 2 GHz, hard drive was replaced last year.

The other clients that have complained, I have no clue.. Untested..

Now I know I am just a small guy but over the last 20 years, I have gathered something the big corporations have not... I deal directly with, and listen to the end user, and I know that with all the junk they collect over time, every little bit counts and the fast startup is one of the most important things to them.. (well, its what they bitch about most when its slow).
On, that note.. Yes, we are in an unappreciated field.

If it is working OK or semi OK, you never get thanked.. But if it breaks, you just killed their cat, kids and stole all their money.. OK, well, that is how they act...

Please trust me, this works well and gets the job done eventually.

1. Wait for a few minutes after booting up. (you already are doing that one)
2. Monitor idle time.
     a. Do not start the scan until about 5 minutes of no mouse or keyboard activity has occurred.
     b. Stop the scan if any activity does occur on the mouse or keyboard.
     c. go back to "a."
3. Set depth of scans. If it is between 6 am and 11pm do a light scan.. 12am-5am, heavy - deep scan for the people that leave it on all night.

If you want to see some of my code that does it, and you promise not to laugh, I can PM or email you.

igor, please edit your post, that info could be used against Avast.

But thank you! Now I have a way to fix it! YEAAAAAAAAAAA!!!!!!

I sympathize with you dewild1 , we the guys who help people to fix their computers experience seldom time they acknowledge our job. I like my profession and I like to help others but in my personal case this happens

1.- When a average user has a problem it get panicked, so I have to cooldown
2.- But when you have to explain to the user to avoid some risky situation and make him/her the importance of backup policy, the last thing they do is listen to you

In my case I had the Antirootkit disease, but simple I solved by disabling it, but since version 4.8.1195 I almost don't need to disable it, excepting the case of installing an application

Thanks
MiguelAngelXP 

[igor]

You are right, I can not get past the ashCnsnt.exe..
So am I just screwed or is there something I can do, besides calling everyone because I have no clue who has what?

No, there's no deliberate backdoor, if that's what you are asking.

However, I don't know if I understand correctly what you are trying to achieve. Are you running a program remotely on your clients' computers to change some settings... or why is it a problem to click away the confirmation dialog?

The tasks.xls corruption looks like this,
...

Now I'm not completely sure what corruption has been done to the original file, and what was changed by the forum software when pasted in. Could you please attach the tasks.xml file as an attachment?
Thanks.

[Vladimyr]

Are you running a program remotely on your clients' computers to change some settings... or why is it a problem to click away the confirmation dialog?

Yes igor, that's exactly what he is doing.
It's all in his initial post. He adds a program to the avast4 folder that silently edits the avast4.ini file, which of course, avast! objects to.
http://www.guaranteedpc.com/
http://www.guaranteedpcfix.com/news