Disabling and re-enabling shields causes problems

[sparge]

Greetings folks,

I've tried searching the forum for the key word "shields" and there seems to be plenty of posts about problems, but the first page of hits was all from three to four months ago. Couldn't find anything recent. The search facility would be so much more useful if it could sort results by date .... ho hum. Anyway ...

Twice now since I upgraded to Avast Internet Security I have had cause to disable the shields temporarily, in order to install software. On both occasions it has caused me problems. The second time, today, I went right through the troubleshooting process detailed here:

http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=496&nav=0,1,82

and was all set to submit a ticket, but when I logged on again some hours later the problem had rectified itself.

What I have found is that when I disable the shields until machine is rebooted, when the machine is rebooted, Avast is reporting that my system is not fully secured, and three of the shields are still switched off. Worse, the button that is supposed to switch everything back on again doesn't work, and nor do the controls that are supposed to switch them back on individually. The first time it happened, I think I tried rebooting again and that seemed to fix it, but today even two reboots didn't fix it. I ended up in a state where Avast was a) telling me that my system was fully secured, and b) also telling me that two filters were switched off (Mail and Web IIRC). Then I closed the GUI and reopened it and it was just blank white. At that point I rebooted and went looking through the knowledge base and found the article referenced above, and generated all the necessary information, intending to submit when I got back home after work. However, as I say, when I logged back on again, everything was sorted out.

If nothing else, this is a big disincentive to disabling the shields to install stuff because I know I'm going to be storing up more problems when I reboot. But more to the point, I'm concerned that something as fundamental as the requirement to disable and enable the shields is so shonky. It makes me wonder if the problems I am having getting .NET to install, for example, might be because when I disable the shields they're not properly disabled at all.

Grateful for all thoughts.

[DavidR]

Personally the time you need your AV most is when installing software.

I rarely if ever disable avast to install another application (even security ones and that is possibly the only area I might consider it); I always wonder what it is that they are trying to hide or do that warrants their asking you to stop your AV if they aren't doing anything suspect or might be thought suspect. The days of recommending you stop your AV are in the dark ages of the 80s & 90s, now a days there really shouldn't be a reason to do it.

That however, doesn't get away with why having stopped the shields (and you shouldn't have to stop them all anyway). .net framework has been a royal pain in the rear for as long as I can remember I have had occasions where there was no problem and others where it wouldn't install no matter what I tried. I have one application that requires it or I wouldn't give .net framework hard disk space on my system.

How are you stopping avast and what three shields aren't started again ?

[sparge]

Hi DavidR,

Well, I hear what you say about AV software and installation, but surely scanning the installer is all that's required? I don't usually stop Avast to install apps, but I often disable it if I'm installing something low-level or drivery. I specifically got told this by the MS support guy:

"I would like to explain that some third party program such as anti-virus software may block the permissions to access related folders and registry keys.

Not that he went on to include anything useful in his instructions relating to when to disable and re-enable it even though I explicitly asked him to.

The problem today was when I updated my graphics card driver to see if it would solve a graphics blackout problem I've been having for a while (it didn't).

I'm stopping Avast by right-clicking the system tray icon and selecting "Avast shields control - disable until computer is restarted". I can't reliably remember which three did not re-enable on restart, but I'm pretty sure two of them were Mail and Web, because they were the two that refused to restart even after I clicked all the buttons that were supposed to make it happen.

[DavidR]

The installer could well be a packed file that can't completely be unpacked and scanned, if that is the case there you are in the middle of the room with your trousers round your ankles and no protection. MS are just covering their a** when suggesting this.

Well avast doesn't fall into that category of third party AVs; avast doesn't block, but scans and alerts to infection. that's all.

The only thing in the registry that avast would top you playing with are those directly related to avast and that is the self-defence module which can be disabled, but the application should have no reason to modify those avast specific registry keys.

The main area of concern for installation is the File System Shield (or perhaps the behaviour shield) and they can' be stopped for a certain amount of time, 10 minutes, 1 hour, until the system is restarted. the first or second options should be adequate if you feel the need and go back in and restart them manually rather than wait for the time to delay expire.

[sparge]

Hi David,

Whatever the theory, the practice was that I tried to install two .NET-related updates from a clean boot using downloaded standalone installers. I was told how to disable all services and startups using msconfig, and the first time I tried the one thing that did not obey was the AvastUI startup. On that occasion, installation failed. So when I tried again, I disabled the Avast self-protection module and on that occasion, installation succeeded. (Hasn't stopped me getting offered the same two updates over and over again since, but that's a separate story which it seems a lot of people are being subjected to at the moment).

So Avast being fully disabled was necessary for a successful installation in this case.

But regardless of whether or not it, is or should be, necessary to disable some or all of Avast! in order to install something ... the fact remains that the facility is offered to disable the shields, and controls are offered to re-enable them. If those controls don't work, and on my machine at any rate they don't, then a) that is a bad bug, and b) it calls into question whether the disabling and enabling is working properly (at least, it does in my book).

[Joe S]

I know there has been a lot of discussion on this. Last week when I tried installing software from disk for a Linksys router I got  a message to disable antivirus. It's happened on a couple other occasions in the past with legit software. I think one may have been VMware tools.
Joe

[DavidR]

The .net framework updates have IMHO been a disaster from day one and I only wish I didn't have the one single application that uses .net and I wouldn't have this piece of c*** on my system at all. Ones that I did get to work, did so even with avast installed as .net shouldn't be doing anything that avast would consider malicious and alert on. So in that regard if avast were the problem directly then none of my .net updates would have worked as I didn't disable avast for any of them.

MS trot out this you must disable your AV dross with monotonous regularity without knowing even what your AV is or how it works. Yes there are some that would block suspect things, but avast doesn't block but scans and alerts to infection or the suspicion of infection, but you would at least get an alert and an idea it was involved.

As for the shields not turning on after being stopped I have never had that problem either and I Have XP Pro SP3, so the same OS effectively. Whilst I don't have the AIS version I can only presume that they have the same functionality in regard to stopping and starting Shields.

So I believe there may be more to this than simply avast and I suspect possible conflict with another security application or remnants of one.

Have (or did) you another Anti-Virus installed in this system, if so what was it and how did you get rid of it ?

I don't know how you updated to AIS, if you had the free version did you do a clean install (uninstall previous version of avast  4.8/5.0 and reboot) of AIS ?

[sparge]

(.NET) Well, the MS line in the support ticket is now, hide the updates that are causing the problems. Apparently they are installed successfully, it's just that Windows Update can't get its head around that fact. Personally, the only reason I'm so keen to get them installed is because I don't know what other more important updates might be getting blocked while Windows Update thinks these are still outstanding. So I'm going to hide them and see what fun awaits next.

I don't know how you updated to AIS, if you had the free version did you do a clean install (uninstall previous version of avast  4.8/5.0 and reboot) of AIS ?

No previous AV software to worry about, I nuked the HDD and reinstalled only a few weeks ago. I started with Avast 4.8 and did an in-place upgrade to AIS. The only other security software on the box at the moment is MBAM.

[spitf1r3]

I have almost the same problem on my win7 64 bits machine. The only difference is that I do not have to stop the shields 'cause avast is stoping by itself, randomly.(all of the shields) The only way to re-enable the shields is by restarting the PC.

[RunBeerRun]

I have to disable Avast every time I go into the program Synthedit to make plugins, because they haven't had time to de-list some false positives that I submitted.

When I re-enable the shields, there is always one that won't turn back on until I reboot.

[sparge]

Thanks, guys, always nice to know one is not alone.