avast4.ini File Modification alert on avast.setup

[DavidR]

I think the subject says it all, since the 4.8.1185 beta update if you do a manual update you get the avast4.ini File Modification alert on avast.setup.

What would avast.setup need to access avast4.ini for but more important why is the avast.setup not a whitelisted application ?

[Lisandro]

I need to boot to test that… just updated to latest beta few minutes ago…

[system]

I’ve made manual program update yesterday and didn’t obtain any modification alert. So it is not common problem.

[igor0]

Sounds like something for Vlk…
Can you please post the content of HKLM\System\CurrentControlSet\Services\aswSP\Parameters key?

[DavidR]

See image 1 for contents.

Just tried a manual update and I don’t know if it is because there are no updates, but I didn’t get the alert again.

[system]

Hi all!

I have the same problem after updating to 1185. I got this message twice today and as far as I remember I did not hear that voice telling that my virus database was update. Unfortunately when I try manual updates I do not get this message but I I am not sure if this is because there are no new updates.

Thanks!

[Lisandro]

@dimidimi post:6

I have the same problem after updating to 1185.

Did you boot after updating?

[DavidR]

Interestingly, just not I have done a manual iAVS update and there was a VPS update available and it was downloaded and installed with no avast4.ini file modification alert, weird.

[system]

This alert has occurred twice on two different machines, one with XP Home the other with XP Pro, both running SP3-RC2. I have been allowing the countdown to the default “NO,” with apparently zero problems, at least so far.

[Lisandro]

Hmmm… why isn’t this process whitelisted? ???

[system]

I’m sure it is just a simple oversight, soon to be fixed.

[alanrf]

My system (WinXP SP2) is set for automatic updates.

I just started the system and the avast.setup prompted the avast4.ini update screen trying to update from 080426-0 to 080427-0.

[system]

Got a similar problem with maybe a few more helpful details in a new thread I accidentally made. The information can be found here though:

@Solemn

Well I’m not sure if this is a glitch or not, but for some reason I received the warning that the avast! INI file was being modified by avast’s own setup program! The details of this message can be seen in the picture I attached, and I can also say that this has never happened to me before until now. How I got to this was quite out of the blue since I wasn’t running anything else at the time, however I think it may have had some connection with me continually invoking the update procedure just to check for new updates. If there’s anything else I can do to help diagnose this problem, I’ll see what I can do.

Also, after getting the error message, if you simply click “yes” and then retry updating again it won’t produce the error message which is rather odd.

[alanrf]

I had the same experience (I think) as Solemn.

The pup-up that occurred during the avast automatic update on my system resulted in a red pop-up window from avast saying that an error had occurred in updating. avast showed I was still on 080426-0. A little later I did a manual update which took me from 080426-0 to 080427-1 but this time without any alerts from avast.

[DavidR]

We will have to see if answering Yes has the effect of whitelisting the application, dangerous, if accidental and there appears to be no way to correct this.

Another possibility, perhaps the 080127-1 corrected the issue with avast.setup, though it wouldn’t take effect until after successful update. Or the Yes is good for that session until you reboot, which doesn’t appear to be the case as there was a day and a reboot between my previous posts, original post and Reply #4, Reply #7.

Whatever it might be I think we need some clarification from the Alwil team on what actions are taken on answering Yes and is there a way to correct this if the answer was incorrect ?

[alanrf]

In support of your thoughts above David …

I just restored my system to the start of day. On restarting the system the avast automatic update was now going from 080426-0 to 089427-1 and the automatic update proceeded without any alert. It may well have been an oddity with the 080427-0 update.

[system]

@alanrf post:16

In support of your thoughts above David …

I just restored my system to the start of day. On restarting the system the avast automatic update was now going from 080426-0 to 089427-1 and the automatic update proceeded without any alert. It may well have been an oddity with the 080427-0 update.

Hmm… I don’t believe so as the signature file I had during this issue was the 080426-0 one which may indicate that it could’ve been either an older false positive of some sort or nothing to do with the signatures at all. But other than that I’d also love to hear more about this as I hope I didn’t accidentally whitelist anything.

[DavidR]

@ Alan

I don’t know as it first happened to me on the 26th so before the 080427-0 VPS update and I had no alert when going from 080426-0 to 080427-0 as my reply #7 image shows. I also didn’t get an alert going from 080427-0 to 080427-1.

So my alert would appear to have been between 080425-0 and 080426-0

So it is another mystery ??? which needs clarification.

[DavidR]

Well the mystery deepens, I have just had an auto update check kick off and even though there was no update available it was enough to throw up the avast4.ini file modification alert again.

This is becoming tiresome why oh why is avast.setup not whitelisted if it must have write access to avast4.ini ?
Even more so what is it doing opening the avast4.ini with write access if there isn’t even an update to download ?
What changes would it be making to the avast4.ini after an update ?

[alanrf]

Alan reminds David that we are in a beta program … so we voluntarily signed up for tiresome and this is clearly a screw-up that must be just as embarrassing to the team (somebody is gonna have to buy beers all round to the rest of them - though sadly not us).