i have avast for many years, and alloed it in my firewall to connect to internet to not have alerts every time it needs to connect.
BUT, since last week i have everyday alerts from my firewall to ask if i can allow icarus.exe (from avast), each time i allow but the alerts come back everyday
the problem is because the exe file is not located at the same directory, since it is launched in temp directory and within folder with a name with many numbers, so my antivirus considers that it is not the same program and asks me every time if the exe is allowed to connect to internet.
i had not this problem at all until this last week or so.
Which Avast product do you have Free or Premium, also which Firewall i.e. Avast Firewall, Windows Firewall or other?
I have done a search here on the forum/community and found this from an old Beta release note for 20.7.2421 (build 20.7.5509), so was maybe a problem in the past, but I have no seen no other reports of icarus v firewall issues recently:
I have Avast Free build 24.10.9535.880, using Windows Firewall. It continues to trigger alerts with icarus.exe attempting to access the internet (which is blocked as there is no firewall rule to allow it out)
There are at least two other users here in the forum who have had exactly the same problem with Icarus exe for a few days.
One of them is me.
Best regards
The path you show is not the path where the Icarus exe is running from it always executes in the windows temp folder. When looking at the log file “c:\programdata\AVAST Software\Icarus\Logs\icarus.log” we see the line:
“cmdline” : "C:\WINDOWS\Temp\asw-091827e0-78bc-4045-9908-b339f3734a58\common\icarus.exe /icarus-info-path:C:\WINDOWS\Temp\asw-091827e0-78bc-4045-9908-b339f3734a58\icarus-info.xml
which matches with where it is running. But this location keeps changing making it impossible to put rules in place to allow it.
to answer your questions:
im using avast free
here is the number version
i use windows 7 (please dont tell me that it is the problem because i used it for many years and i had not this problem until one week ago)
the firewall is the windows firewall with the gui of “windows firewall control” program.
here is some different paths detected by the firewall
The image was more to show that the process was a legitimate Avast function to Update or check for updates for the program and for the virus definitions.
For some time I didn’t use the Avast Firewall component and just let the Windows Defender Firewall (in my win10 system) handle that. Fortunately I didn’t get any blocking.
I also did a short period a couple of months ago removing the Avast Firewall Component and no blocking by the windows XP firewall.
I subsequently added the Avast Firewall Component and no blocking in what is an Avast Component.
The reason for switching back I was getting error messages from Avast You Are Unprotected and not the firewall being blocked by the Windows Firewall.
Somewhat different to yours, being on a win10 system, but yes a temp location that may change - but with the winXP Firewall I didn’t once get blocked.
I really have no experience of the Windows Firewall, having never had an issue with it in the basic one in winXP - I have even less knowledge of the Win7 Firewall settings as it is many many years ago that I used it on a little Acer Aspire one and I never had a problem, but that will have been many many Avast Program versions ago when it was much less complex.
For how long will Avast Antivirus continue to support Windows 7?
Based on current user data, we intend to continue supporting Windows 7 for at least another 2 years from January 2020. However, this could change based on the number of users who continue to run Windows 7.
I’ve had icarus.exe pop up in my (3rd party) firewall a while ago now. I blocked it and have ever since.
It wants to connect to 34.160.176.28
It seemingly randomly either runs from C:\Program Files\Common Files\Avast Software\Icarus\avast-av-vps\icarus.exe or from C:\Program Files\Common Files\Avast Software\Icarus\avast-av\icarus.exe
These two instances of icarus.exe both exist and both have different filesizes and timestamps.
I haven’t seen it trying to run from a Windows\Temp subfolder though. I’m on Win 11.
Icarus.exe, just like overseer.exe, doesn’t seem required to run or update Avast. When blocked or even deleted, things seem to work just fine.
it is not a firewall problem, since the issue appears just these days.
the firewall does the job as usual and works like it should. I mean it asks the user if it can, or not, create a new rule for a new file that needs a connection.
The problem is, icarus is now each time considered as a new file since it changes everytime its location. So the firewall has now to ask everytime the user what to do with this new file that appears everytime that avast wants to update virus signatures or program version, that’s to say, everyday…
however in my screenshot above , i show that the directories taken by icarus use “legit” paths but generate random folders inside for its launch process
The solution is to let icarus at the same folder (like i supposed it was in older versions of avast)
You could add an exception with a (leading) wildcard, but you then run the risk that every file with the name icarus.exe in the Windows temp folder, legit or otherwise, will be allowed internet access.
Thanks for that, I know many programs allow for the use of wildcards, I just wasn’t sure about the windows firewall, especially as far back as win7’s firewall.
and you can keep the doubt… i’m pretty sure it is not possible (i just searched around again) and nothing found in this way.
But i wait for his answer, you never know.
your link leads to someone that asks the same question, that’s all. Now, where is the solution?
Or there is a biiiig answer with -1 as notation.
Or this screenshot
.
.
.
so no solution.
Maybe you can tell me the part which describe the process? I don’t see it.
That was just one of may hits I got from the first link in the post.
I’m totally unfamiliar with the Windows firewall for many, many years of its use I left it alone an let it get on with things without it every having thrown up any problem/blocking like this.
Sorry I may have misread. I’m not sure this is a thing in the Win 7 firewall. I use Comodo firewall and it accepts wildcards so I had that on my brain.
A search shows me people using batch files and powershell scripts to automate all sorts of firewall rule additions, but it often isn’t clear exactly for what version of Windows those are. There doesn’t seem to be an easy way to do this. I’ve found Windows Firewall to be very lacking in functionality and have reverted back to other solutions after every attempt to simplify. If you want decent control, Windows Firewall isn’t the tool for you.
What’s weird is that it does accept environment variables. Those are wildcard adjacent.
