Firewall does not recognise AVAST.SETUP

[Moriarty]

Currently, every time I boot my machine, and Avast (5 Free edition) checks for updates, I get the following warning from my firewall (Agnitum Outpost): -

"AVAST.SETUP is not the same program you allowed but it has the same name as a program you allowed. Either you just upgraded AVAST.SETUP or it is a fake. If you installed a newer (and trusted) version press "Allow It". Otherwise press "Block It" to move the program to the Restricted group and scan for virus."

I press "Allow it" and Avast appears to update normally. The worrying thing is that this warning has only started to occur since last Saturday, when I was redirected from a Google search to one of those malware sites where anything you click turns out to be a 'run' button for the malware! I don't THINK I clicked on anything, and as soon as I disconnected I ran an Avast scan, a couple of spyware scans, and another Avast scan to be on the safe side, and did not find any problems.

I'm aware that AVAST.SETUP is a file that only exists when the update is occuring, but Outpost has not objected to it before. Does this sound like something I should be worried about?

[Lisandro]

Yes, avast.setup is a temporary file created by the update process (setup.ovr) and it changes all the times.

[DavidR]

Whilst the avast.setup file is normally only created when it is required, this even though a new creation would be the same as the previous version, so shouldn't have any question from Outpost.

However there may be a time when something changes in the actual construction of the avast.setup file and that may cause outpost to ask again. This however, wouldn't happen very often and is unrelated to the redirection from a search as the avast self-defence module would be protecting this and all other avast files.

You don't say what Outpost firewall version you are using or what settings you have applied (Firewall Policy, Rules Wizard, etc.). Mine I have set to, see image, which doesn't get to obtrusive, I'm still using Outpost Firewall Pro 2009 (version 6.7.2) I haven't updated to version 7 yet.

[Moriarty]

Thanks to you both. I was going to ask whether avast.setup is actually identical each time, but you have already answered - I think (usually, but not always?). I've had a quick look at the file a few times over the last couple of days when the warning comes up, and it seems perfectly OK, and dated 30th June like a lot of other avast files.

I'm using Outpost free version, which is an ancient program, but very easy to use, and generally seems to work well enough for my needs. I run with it set to 'Block most' which doesn't allow anything to connect that hasn't been given permission, but warns when a file with a name previously allowed, but which Outpost detects as altered, as in this case, tries to. Maybe I should just try re-installing and setting up Outpost.

[DavidR]

Well the outpost free is far from ancient as the latest version of the free firewall is 6.5, If it allows you set the firewall to use the Rules Wizard then it should allow for the Level Of the Rules Wizard to be modified, the slider in my image. In the Rules Wizard position isn't too severe whilst providing adequate protection, so if you can set it to Rules Wizard.

If you retain the same settings then a reinstall wouldn't change anything.

[Moriarty]

You're not going to believe this (or maybe you will!!), but the version of Outpost Free I've been using is 1.0.242 dating from around 2002! Every time when I've upgraded machines and done a fresh installation I've checked to see if there was a newer version, and I swear I have always come up with the same old program, so I don't know what I have been doing wrong. Many thanks for the info., David. I have downloaded the current version and will be trying it shortly.

Since it doesn't appear it is possible for the Avast files to be corrupted, it can only be that my Outpost installation is incorrectly seeing avast.setup as changed, and hopefully an upgrade will sort it. It's just that I very rarely hit anything dangerous online, and when I do, and programs start behaving oddly immediately afterwards the paranoia kicks in with a vengeance!

[DavidR]

I can believe it and it is still a good basic firewall (it is the version of outpost that I started on) though ancient as you said and no longer developed, which is the main issue. Here is a link for it and information.

- Outpost Firewall 2009 free, a cut down version of the Outpost Firewall Pro version, which should still provide good protection, http://free.agnitum.com/. Download, http://www.filehippo.com/download_outpost_firewall/