Why Windows Defender cannot discover the avast! publisher?

avast! is shown into Windows Defender as belonging to an unknown publisher?
Can’t be Alwil Software? ::slight_smile:

Tech,
I hardly think it has any meaning when you consider that their own
program IE7 rates the same classification as avast! and a brand new product
like PCTools Firewall is recognized ??? ???

But look at the Publisher… it is there, Microsoft Corporation ::slight_smile:

I would hope that they reconize their own product ;D
So is Avast going to be reconized as a known publisher or not ?

Thanks

Al968

It already is take a look:

Even stranger… Why ashWebSv.exe is recognized and ashdisp.exe isn’t?

The only difference between them is that one service is an
on-line function (the Web Shield) and the main program isn’t.

I thought that it would get this information from the file properties and if you check both you will see that in the ashDisp.exe, the ‘Company’ Item name entry isn’t present so the information isn’t available.

There was a post recently which mentioned this for a few avast files with either blank fileds or missing Item name: entries.

Maybe you’ve found the problem…
Why doesn’t Alwil add this info into the file properties?

I also think this would be a good idea :slight_smile:

Al968

Something that I also noticed since posting the image, the file version in properties is unchanged from 4.7.936 and not the latest 4.7.942, unless the changes didn’t effect these files, which I doubt.

This missing ‘Company’ might also have been why some of the avast entries were detected previously by HiJackThis as unknown owner. This should have changed as ashWebSv.exe and ashMaiSv.exe now have the ‘Company’ Item name: entry, but HJT still detects them as unknown owner.

I’m not sure, but I think the 023 entries for avast into HJT where related to /service parameter after the file name, making the ‘file missing’ error, because it is only present the file itself ‘\ashMaiSv.exe’, for instance.

o23 - service: avast! mail scanner - c:\program files\alwil software\avast4\ashmaisv.exe" /service (file missing) - Avast’s mail provider running as a service
o23 - service: avast! web scanner - c:\program files\alwil software\avast4\ashwebsv.exe" /service (file missing) - Avast’s webshield provider running as a service

Well the new HJT beta 2.0 resolves the missing file as it doesn’t show the /service and it is able to show the Owner in two of the four avast services it lists.

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe

The non-service ashDisp.exe is obviously different and I don’t know if the [avast!] is their idea of the owner or program description.
O4 - HKLM..\Run: [avast!] D:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe

It looks like Alwil has some housekeeping chores to perform on those
executables which don’t have all of the properties listed.