3

Thank you for responding, still no response to the request ticket!

The VPS update from console didn’t work because it was still trying to process the existing 1492 file and failing signature check, forcing update from AEA just forced the error to happen.

Here is the solution i implemented to resolve for all users remotely.

Disable self protection on AEA console, then wait about 5 minutes just to be safe
psexec cmd script below on every machine in the company, or you can use a scheduled task injected with GPO that runs with an admin user
sc stop “avast! Enterprise Client Service”
sc start “avast! Enterprise Client Service”
ping 127.0.0.1 -n 10 > nul
del /Q “C:\Program Files\AVAST Software\Avast Business\Setup\vps_32-1492.vpx”
del /Q “C:\Program Files\AVAST Software\Avast Business\Setup\vps_32-1491.vpx”

after that, the auto update will continue as normal at specified intervals.

wait 24 hours to catch all clients, and then turn on self protection from the console again.

what above does is force a refresh of client settings by killing the avast agent, the client then turns off self protection within 5 seconds of contacting the AEA server, we wait 10 seconds to be safe, and then we delete the corrupt/broken/unverified vpx files.

i ran the above on our administrative scheduled tasks, which runs every hour, so even if the agent couldn’t disable the self protection within 10 seconds, it would automatically disable at the agent intervals and the script would delete the file the next hour.

PS. i found a tool that can bypass self protection! But i couldn’t find a CLI version of it, GUI only, but it can delete files with self protection enabled. If i find a CLI version of that i would have used it to delete the file and not bothered with the AEA console rigmarole.

Regards