Avast! Antivirus Update pop-up

[coverland]

Seems that my firewall VERY frequently pops up with a request to let Avast! Antivirus Update access the Internet.  Even though I click 'remember this setting' and then the 'allow' button, I still get frequent requests.  Anyone know what's up with that?  I've had it installed for quite some time now and thought I had all the permissions for browsers, etc; set where I could pretty much set it and forget it.  Any ideas?  TIA

[DavidR]

Well it is a bit hard to say when you don't tell us what the firewall is.

What is your firewall ?
Does it allow avast.setup internet access ?
- If it does delete the entry for it and do a manual update, this should force the firewall to ask permission again.  Hopefully this time it will stick.

[vittau]

Probably because the file keeps getting modified, the firewall notices it and then asks again. At least ZoneAlarm used to work like this when I used it (now I just use Windows 7's built-in firewall).

[MikeBCda]

As David said, it's a little hard to answer if we don't know which firewall, as they do have different "personalities". 

I like the PC Tools Firewall (free version) because it's convenient to delete permission sets for applications which have been uninstalled or otherwise are no longer on the drive (most commonly, downloaded installers).  I found that leaving in the permissions for avast.setup, even though it "no longer exists" after an update, avoids repeated requests for permissions for it.

[coverland]

I'll take a look at that - thanks.  I'm using PCTools free ver 6.x and haven't experienced issues with anything but Avast where repeat requests are concerned.

[DavidR]

I would ensure that you have the latest version of PCTools Firewall as there were problems with an earlier version; I can't recall the exact version, but it is always best to keep your security applications fully up to date.

[MikeBCda]

Good point, David.  Mine is ver. 7.0.0.123, which is (presumably) right up to date.

[coverland]

This is weird guys and yet another problem that didn't show up with AVG but has shown up with AVAST.  Don't get me wrong, I want to lean towards making AVAST work or wouldn't have it on my machine but there are some odd things going on that I'd like to get behind me.  When I look at PCTools Firewall apps, there are NUMEROUS "Avast! Antivirus Update" entries so I guess it's no wonder I continue to get the pop-up requests to access the net.  Don't know what the 8 digit numerical entries are.  Picture of the apps here:

http://home.nctv.com/ajns/083111.JPG

[CraigB]

This is weird guys and yet another problem that didn't show up with AVG but has shown up with AVAST.  Don't get me wrong, I want to lean towards making AVAST work or wouldn't have it on my machine but there are some odd things going on that I'd like to get behind me.  When I look at PCTools Firewall apps, there are NUMEROUS "Avast! Antivirus Update" entries so I guess it's no wonder I continue to get the pop-up requests to access the net.  Don't know what the 8 digit numerical entries are.  Picture of the apps here:

http://home.nctv.com/ajns/083111.JPG

If you remove all the entry's for avast in your firewall then do a manual update for avast for new rules to be created within the firewall and then change all the in out exceptions for all avast processes to allow all should fix your problem.

[coverland]

Thanks for the info. 

What does the "Avast! Emulation Engine" do?

[CraigB]

Thanks for the info. 

What does the "Avast! Emulation Engine" do?

Not sure, one of the other evange's or the mod's will be able to answer that as iv not seen that in any firewall settings before, could be new ? but you should also set it to allow all as it's still an avast process.

[Pondus]

Code emulator

When a suspicious executable is encountered (during both on-demand and on-access scanning), avast! is able to emulate the program’s code in an isolated environment. The code emulator is used for two purposes. First, it is used for generic unpacking. secondly, it is used in the heuristics engine. Technically, this is done using dynamic translation, a method much faster than traditional emulation techniques.
http://network-security-software.biz/software/kumpulan-software-gratis-avast-internet-security-2011-full-license-key.html

[coverland]

Pardon my ignorance.  Still learning about Avast so thanks for your patience...

Craigb wrote:
"If you remove all the entry's for avast in your firewall then do a manual update for avast for new rules to be created within the firewall and then change all the in out exceptions for all avast processes to allow all should fix your problem."


I did delete all the entries for Avast in the apps of PCTools but am not sure what you mean by "do a manual update".  I *did* click 'update' in Avast to let it do it's thing but continue to get the mysterious 8 digit numerical requests to access the Internet from the firewall.  i.e. '00672230' wants to access the Internet and then at times, the browser won't access the net until or unless I click okay.  I'm wondering if it's that emulation engine causing that.  The obvious question becomes, when does something nasty spoof as one of those 8 digit numbers that one could almost be lulled into habit and just click 'approve' everytime it happens.  I think I like Avast and would like to give it a good effort but this didn't happen with the competition and as I say that, please don't opt for the easy reply "well then go back"... :-)

I just posted the latest request here:
http://home.nctv.com/ajns/AVAST.JPG

I clicked 'block' and a moment later received a message that Avast couldn't successfully update the latest sigs.

Help or ideas is appreciated...

[DavidR]

Some time back I suggested you ensure you have the latest version of PC Tools (as yours was out of date), did you ever do that ?

I don't believe that the 8 digit (anonymous) process that you blocked had anything to do with avast not updating. It has nothing to do with the emulation, which is within the control of the avastSvc.exe process.

I get very suspicious when I see anything like this were you can't identify what it is that is trying to access the internet. More so when although the 8 digit format is the same it is constantly changing.

So I would also be looking at possible hidden malware, which could possibly block updates and other issues like the unknown 8 digit process trying to connect to the internet.

####
If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

• 1.  MalwareBytes Anti-Malware (MBAM), On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
• 2. SUPERantispyware (SAS). On-Demand only in free version.

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.