Author Topic: _avast5_ folder  (Read 6915 times)

0 Members and 1 Guest are viewing this topic.

Offline J. L.

  • Jr. Member
  • **
  • Posts: 30
_avast5_ folder
« on: June 06, 2010, 07:28:30 AM »
Location: C:\Windows\Temp\_avast5_
I've found out that Avast Web Shield stores temporary files here for some reason. Those temporary files are being detected by other AV's (on-demand).

What is the purpose of this? I thought Avast Web Shield aborts the connection?

Offline mikaelrask

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1557
Re: _avast5_ folder
« Reply #1 on: June 06, 2010, 09:18:36 AM »
welcome to the forum.

what other program detects that avast folder as a threat?

it most be a false threat.

I think avast is collected information on the websites you have been visiting there, not 100% so let wait and see if someone else on this forum can give a better explanation on it if mine is wrong.
Windows 8.1 amd a10-5700 64 bit
12 GB ram 1 tb hard drive. Avast 18, MBAM

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85131
  • No support PMs thanks
Re: _avast5_ folder
« Reply #2 on: June 06, 2010, 03:56:38 PM »
Location: C:\Windows\Temp\_avast5_
I've found out that Avast Web Shield stores temporary files here for some reason. Those temporary files are being detected by other AV's (on-demand).

What is the purpose of this? I thought Avast Web Shield aborts the connection?

Its purpose is plain, that is where the http port 80 traffic is scanned before being allowed to be saved into the browser cache if clean. If a detection is made, the connection is dropped and the file in the temp folder is cleared.

This is also where other shields unpack files that are to be scanned, so what you are seeing is a conflict between two scanners. You say this is an on-demand scan by another AV (which one), now the problem is that when you run another scan, that forces avast to actually scan that file first (duplication of scanning).

Now that _avast5_ folder once avast has scanned its files, the unp*****.tmp files is cleared so there shouldn't be anything in it for another AV to scan on an on-demand scan. So I would have to question if this is truly an on-demand AV (why we have asked what it is) or why this folder isn't being cleared by avast after a scan. The most common cause of this I believe is hooking by another security application so they are locked and avast can't clear them.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.5.2470 (build 21.5.6354.675) UI 1.0.646/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline MossyRock

  • Jr. Member
  • **
  • Posts: 38
Re: _avast5_ folder
« Reply #3 on: June 06, 2010, 06:48:38 PM »
I'm seeing the same thing.  Every day for the past few days when I run HitMan Pro on-demand it finds these unp*.tmp files in c:\windows\temp\avast5_\ and says they are suspicious.

Avast hasn't aborted any port 80 connections recently due to malware, and hasn't reported finding any malware anywhere.

I have SpyBot running with SD helper and TeaTimer enabled and also have Windows Defender running.

I recently starting running Firefox in the Avast sandbox but it was several days after starting this that I began seeing HitMan Pro reporting these temp files as suspicious.

It looks like that I should just ignore what HitMan is saying, but I wonder why these temp files are not being deleted by Avast if indeed they are part of port 80 scans.


Offline Mr.Agent

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2769
  • Proud to be an avast! user.
Re: _avast5_ folder
« Reply #4 on: June 06, 2010, 06:53:02 PM »
I do delete them and its dont harm anything to me. And of course some will say its suspicious and if they are then send them a email by saying its a false positive and if they dont want to correct it then ignore it. ;) avast! isnt there to steal you something or what ever. They are there to protect you.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: _avast5_ folder
« Reply #5 on: June 06, 2010, 08:06:34 PM »
I'm seeing the same thing.  Every day for the past few days when I run HitMan Pro on-demand it finds these unp*.tmp files in c:\windows\temp\avast5_\ and says they are suspicious.
False positives of HitMan Pro. That are legit and clean avast files.

Avast hasn't aborted any port 80 connections recently due to malware, and hasn't reported finding any malware anywhere.
The free version is an antivirus, not a firewall. It does not block connections. It scans only.
The best things in life are free.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85131
  • No support PMs thanks
Re: _avast5_ folder
« Reply #6 on: June 06, 2010, 08:11:16 PM »
@ MossyRock
As I said it isn't only the web shield but all avast shields/resident scanners that use this folder to scan files if they need unpacking, etc.

So not having aborted connections recently isn't the only related to port 80 http traffic scans. Essentially you should exclude the _avast5_ folder from other security scans.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.5.2470 (build 21.5.6354.675) UI 1.0.646/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline J. L.

  • Jr. Member
  • **
  • Posts: 30
Re: _avast5_ folder
« Reply #7 on: June 06, 2010, 09:36:21 PM »
Now that _avast5_ folder once avast has scanned its files, the unp*****.tmp files is cleared so there shouldn't be anything in it for another AV to scan on an on-demand scan. So I would have to question if this is truly an on-demand AV (why we have asked what it is) or why this folder isn't being cleared by avast after a scan. The most common cause of this I believe is hooking by another security application so they are locked and avast can't clear them.
Actually I do have Immunet Protect 2 Beta which did interfere with it. It's supposed to be officially compatible with Avast. Some of my on-demand scanners also detected them though.

Deleted the temporary files and added _avast5_ folder to exclusions. Thanks!

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85131
  • No support PMs thanks
Re: _avast5_ folder
« Reply #8 on: June 06, 2010, 10:04:11 PM »
No problem, glad I could help.

Whilst Immunet Protect 2 Beta is meant to be compatible with avast, it is still resident and could well be hooking the temporary files in the _avast5_ folder, blocking avast. So excluding _avast5_ in Immunet Protect 2 Beta should hopefully resolve that.

Welcome to the forums.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.5.2470 (build 21.5.6354.675) UI 1.0.646/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline J. L.

  • Jr. Member
  • **
  • Posts: 30
Re: _avast5_ folder
« Reply #9 on: June 07, 2010, 05:22:04 AM »
Problem is resolved. No more temporary files that stays in the folder.

Offline MossyRock

  • Jr. Member
  • **
  • Posts: 38
Re: _avast5_ folder
« Reply #10 on: June 07, 2010, 04:20:09 PM »
Tech,

"The free version is an antivirus, not a firewall. It does not block connections. It scans only."

I have the paid version, and the web shield was what I was referring to with regard to aborting connections when malware is detected.

Thanks for all of the info.  I will exclude this avast temp folder from on-demand scans.