Avast! Emergency Update

On 22 Feb 2014, BillW50 wrote in
alt.windows7.general:

Oh course, I have 30+ machines and I only know two that has done
this. You need a few more dozens of machines before you might see
it.

I don't think so. Computer programs are designed to repeat certain
actions reliably. In a case like this, with several identical
installations, without any outside interferance by me, they would all
act the same. I've installed Avast on dozens of systems, and none of
them have or have had Chrome installed on them.

On the other hand, Avast is obviously out to get you, so in your case,
all bets are off.

On 2/22/2014 4:57 PM, Nil wrote:
On 22 Feb 2014, BillW50 wrote in
alt.windows7.general:

Oh course, I have 30+ machines and I only know two that has done
this. You need a few more dozens of machines before you might see
it.

I don't think so. Computer programs are designed to repeat certain
actions reliably. In a case like this, with several identical
installations, without any outside interferance by me, they would all
act the same. I've installed Avast on dozens of systems, and none of
them have or have had Chrome installed on them.

Nobody had any these until a few months ago. This is a new thing that
has been happening. I too have been using Avast for years and I never
had this happen until just recently.

On the other hand, Avast is obviously out to get you, so in your case,
all bets are off.

How could they get me? They tried to do this secretly and I am to smart
to let that happen. They would be better off to try this on you, since
you wouldn't believe your own lying eyes anyway. ;-)

--
Bill
Gateway M465e ('06 era) - Thunderbird v24.3.0
Centrino Core2 Duo T7400 2.16 GHz - 4GB - Windows 8 Pro w/Media Center

On 2/22/2014, John posted:
On Fri, 21 Feb 2014 15:59:50 -0800, Gene E. Bloch
wrote:

On 2/21/2014, BillW50 posted:
On 2/21/2014 4:51 PM, Gene E. Bloch wrote:
On 2/21/2014, BillW50 posted:
On 2/21/2014 1:15 PM, Gene E. Bloch wrote:
On 2/21/2014, Char Jackson posted:
On Fri, 21 Feb 2014 12:03:29 -0600, "BillW50"
wrote:

Having so many computers, snip

Does anybody know more about this than I do?
Must. Not. Take. The. Bait!

I was going to say LOL, but then I realized I'd possibly be
helping to
start a long, maybe inflammable, subthread.

So I decided not to reply.

See what you two clowns Char and Blue did? Somebody was going to
say
something intelligent and you discouraged them. So what are you
two
good for anyway?

As Char said...

And here I thought you were the intelligent one out of the bunch.
:-O

Well, now, I can't deny that, can I? :-)

Well, you could assume I am in the room and therefore measuring the
relative intellects of merely human beings is as foolish as comparing
the wit of sand grains.

And the answer to the original question is : yes.
Obviously.
J.

Well, if you come up with a low estimate, I will just ignore you, so
THERE!

Boy, am I a drama queen! As I typed the last part of the above, I was
really pounding the keys :-)

--
Gene E. Bloch (Stumbling Bloch)

BillW50 wrote:
On 2/22/2014 2:31 PM, Blue wrote:
BillW50 wrote:
On 2/22/2014 12:50 PM, Blue wrote:
BillW50 wrote:
On 2/22/2014 11:44 AM, Blue wrote:
BillW50 wrote:
On 2/21/2014 8:23 PM, Buffalo wrote:
Try using WinPatrol (free version) and it will notify you when
Avast
tries the Emergency bit and you can just deny it.
I have my free Avast Program Update set to "Ask when an update is
available" and WinPatrol alerted me when Avast tried to do the
Emergency
Update bit.
However, I do have my Virus Definitions set to automatic update.

Thanks Buffalo. I currently have AvastEmUpdate.exe blocked from ever
running. So I should be good for now.

Where did you find AvastEmUpdate.exe? It doesn't seem to be on my
computer and I'm using Avast!.

Well I got suspicious of v9, so I uninstalled it and downloaded and
installed the last version of v7 from oldapps and that file wanted to
run at startup (so I blocked it). Later versions they could have
changed
the filename.

No, I just checked on another machine that has Avast v2014.9.0.2011
and
it is there too. Mine is right in the "Program Files\Avast" folder.

It's there where you say it is but Win 7's search couldn't find it. It
hasn't caused me any problems so far nor has it updated without my
input.

If you find a folder in there named emupdate, I am pretty sure it did it
without your knowledge. And the number of exe files in there is how many
times it had done so. That folder shouldn't exist if it never did an
emergency update yet.

Well, no folder, just an .exe that has a shield on it.

Then it looks you are ok. It looks like only a small percentage of
users, this thing trips, activates and automatically updates your Avast
program to the latest version regardless of your settings.

Probably because I always upgrade Avast! when asked.

I have a
hunch, this might also install Chrome without your knowledge too.


I already have Chrome installed.

--
Blue

Juan Wei wrote:
Blue has written on 2/22/2014 3:31 PM:
BillW50 wrote:
On 2/22/2014 12:50 PM, Blue wrote:
BillW50 wrote:
On 2/22/2014 11:44 AM, Blue wrote:
BillW50 wrote:
On 2/21/2014 8:23 PM, Buffalo wrote:
Try using WinPatrol (free version) and it will notify you when Avast
tries the Emergency bit and you can just deny it.
I have my free Avast Program Update set to "Ask when an update is
available" and WinPatrol alerted me when Avast tried to do the
Emergency
Update bit.
However, I do have my Virus Definitions set to automatic update.

Thanks Buffalo. I currently have AvastEmUpdate.exe blocked from ever
running. So I should be good for now.

Where did you find AvastEmUpdate.exe? It doesn't seem to be on my
computer and I'm using Avast!.

Well I got suspicious of v9, so I uninstalled it and downloaded and
installed the last version of v7 from oldapps and that file wanted to
run at startup (so I blocked it). Later versions they could have changed
the filename.

No, I just checked on another machine that has Avast v2014.9.0.2011 and
it is there too. Mine is right in the "Program Files\Avast" folder.

It's there where you say it is but Win 7's search couldn't find it. It
hasn't caused me any problems so far nor has it updated without my input.

If you find a folder in there named emupdate, I am pretty sure it did it
without your knowledge. And the number of exe files in there is how many
times it had done so. That folder shouldn't exist if it never did an
emergency update yet.

Well, no folder, just an .exe that has a shield on it.

Look in Avast Software\Setup for the emupdate folder.


Nine instances of the .exe file in there.

--
Blue

BillW50 wrote:
On 2/22/2014 7:32 AM, Ann Watson wrote:
On 21/02/2014 4:32 PM, dadiOH wrote:

I just know that avast! updayed itself to the latest
program version a month or so ago despite the fact that ALL updates
are set
to manual.

I wrote to avast!, this was their reply on 12/27/2013...

"There must have been a server issue which has resulted in forcing the
avast! software upgrade on your machine.

It of course shouldn't be happening at all and we are sorry for the
inconvenience caused.

It is enough to keep program updates on manual so that avast! wouldn't
update itself (Settings Update PROGRAM Settings Manual update)"

Yeah, right..."server issue". Anybody want to buy a bridge?

I have never had Avast auto update itself; have always been notified
that an update is available.

How would you know, since it does so secretly? You can tell if Avast
ever did this without your knowledge by looking for an emupdate folder.
If you have one and have multiple exe in there, that is how many
automatic updates it did without your permission.


How do you know it's "without permission"? I've been asked by Avast to
upgrade and always do. I have eight .exes in the emupdate folder and
that's about how many times the program has been upgraded since I
installed Avast four years ago.

--
Blue

On 2/22/2014 6:24 PM, Blue wrote:
BillW50 wrote:
On 2/22/2014 7:32 AM, Ann Watson wrote:
On 21/02/2014 4:32 PM, dadiOH wrote:

I just know that avast! updayed itself to the latest
program version a month or so ago despite the fact that ALL updates
are set
to manual.

I wrote to avast!, this was their reply on 12/27/2013...

"There must have been a server issue which has resulted in forcing the
avast! software upgrade on your machine.

It of course shouldn't be happening at all and we are sorry for the
inconvenience caused.

It is enough to keep program updates on manual so that avast! wouldn't
update itself (Settings Update PROGRAM Settings Manual update)"

Yeah, right..."server issue". Anybody want to buy a bridge?

I have never had Avast auto update itself; have always been notified
that an update is available.

How would you know, since it does so secretly? You can tell if Avast
ever did this without your knowledge by looking for an emupdate folder.
If you have one and have multiple exe in there, that is how many
automatic updates it did without your permission.

How do you know it's "without permission"? I've been asked by Avast to
upgrade and always do. I have eight .exes in the emupdate folder and
that's about how many times the program has been upgraded since I
installed Avast four years ago.

Well that is what happened to me and I have been currently reading on
the Avast Forum and boy are there a lot of people upset. Some report
some of them are reported as trojans by other security software. Avast
came online briefly and admitted they use this backdoor to update the
program. I also learned that AvastEmUpdate.exe runs every 12 hours to
check for emergency updates and grabs them if they are found, etc. It
appears that only v9 users are experiencing a lot of problems with it.
Here read this thread, I am on page 8 right now. I am sure there are a
lot more here that I haven't read yet.

http://forum.avast.com/index.php?topic=140730.0

--
Bill
Gateway M465e ('06 era) - Thunderbird v24.3.0
Centrino Core2 Duo T7400 2.16 GHz - 4GB - Windows 8 Pro w/Media Center

On 2/22/14 3:57 PM, Nil wrote:
On 22 Feb 2014, BillW50 wrote in
alt.windows7.general:

Oh course, I have 30+ machines and I only know two that has done
this. You need a few more dozens of machines before you might see
it.

I don't think so. Computer programs are designed to repeat certain
actions reliably. In a case like this, with several identical
installations, without any outside interferance by me, they would all
act the same. I've installed Avast on dozens of systems, and none of
them have or have had Chrome installed on them.

All this discussion of "It does it for me" and "It doesn't do it for me"
and placing the cause on Avast is a waste of time until you know what is
triggering it, and why.

Just because all the installations *may* be the same, Bill has not said
they are in his case, it should not be assumed the hardware is 100%
identical.

For all we know at the moment, it could be a particular combos of OS,
hardware, and software installs that trigger it.

Hopefully, Bill keeps after this and figures out what triggers the
emergency update. Until then, everything is just speculation.


snip



--
Ken

Mac OS X 10.8.5
Firefox 24.0
Thunderbird 24.0

On 2/22/2014 7:15 PM, wrote
: On Friday, February 21, 2014 12:03:29 PM UTC-6, BillW50 wrote:

Having so many computers, I have different versions of Avast (free),
mainly 7, 8, and 9. I used to always update to the latest program
version (not to be confused with engine and virus definitions which I
always update). But I noticed that the newer program versions have extra
protection for computer noobs which interfere with experienced users.

And Avast has out of the blue has upgraded to the latest program version
without my permission. Since I rarely reboot my machines, sometimes when
I do Avast will pop up saying installing Avast to the latest program
version. And I like to walk away from my computers if I reboot and get
some coffee or something. Of course, if Avast is updating the program it
pops up a window asking if it is ok to install Google Toolbar and Google
Chrome. The problem is, if you are not there, it will pick it is ok on
its own after xx amount of minutes. Damn them, I hate Google anything!

Anyway today on this machine AnVir Task Manager, warned me that Avast!
Emergency Update wants to run in startup. I know what it is suppose to
do, as it is suppose to override the regular updater (just in case it
gets corrupted or infected). And while I have seen this before, I think
this is how Avast sneaks the latest program version on some of my
computers. Although I wouldn't know for sure until I rebooted, which
could be months from now. Then I would have forgotten that I allowed
this service to run. So this time I blocked it with AnVir. Does anybody
know more about this than I do?

Avast Emergency Update?

Bill, I don't believe there is any such thing. This could be
malware trying to fool you. Ignore it. If Avast needs to do
an update it will run it itself - and you're right,
it won't ask you.

Maybe you will believe Avast themselves then:

I think I need to explain this one so we can hopefully avoid
another fiasco like with previous EmUpdate. Although I cannot
explain the issue in detail, I can say that we had very few
options in this regard and had to forcibly update some of our
users to avast! 2014.

This can only happen if you use Windows 8 as Microsoft
identified issues with its updates related to avast!. You can
imagine they were very adamant and the only option given to us
was to update the affected users to avast! 2014 (specifically to
build 2014.9.0.2008 or higher). Builds 2014.9.0.2006 and
2014.9.0.2007 should have already received the necessary fix by
EmUpdate, so no action is necessary there.

I am very sorry for any inconvenience caused, the affected users
should have received information pop-up about necessity of the
update few days back to allow them to update on their leisure
but it just wasn't enough.

If you are worried about Chrome offer, you can easily untick
those offers in "Complete" screen after a system reboot.

http://forum.avast.com/index.php?top...968#msg1027968

--
Bill
Gateway M465e ('06 era) - Thunderbird v24.3.0
Centrino Core2 Duo T7400 2.16 GHz - 4GB - Windows 8 Pro w/Media Center

On Sat, 22 Feb 2014 14:47:59 +0000, John wrote:

"START"/"Task Manager" click on the Performance tab. Somewhere in
there, near the bottom is "uptime". It should tell you which box
hasn't been restarted in a while.

Out of curiosity, I checked my uptime. It was something like
1:04:24:38.

I don't understand that, frankly. It can't be time since last boot:
that was a week ago. It can't be time since last resume from
hibernation: that was six or seven hours ago. I don't think it's
elapsed time since last boot, disregarding hibernation time, though I
can't be 100% sure of that. I booted last Saturday, and I'm pretty
sure I've been running the computer for more than 28 hours since
then. I did a LOT on Sunday and on the holiday Monday.

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://OakRoadSystems.com
Shikata ga nai...

On 2/22/2014, Stan Brown posted:
On Sat, 22 Feb 2014 14:47:59 +0000, John wrote:

"START"/"Task Manager" click on the Performance tab. Somewhere in
there, near the bottom is "uptime". It should tell you which box
hasn't been restarted in a while.

Out of curiosity, I checked my uptime. It was something like
1:04:24:38.

I don't understand that, frankly. It can't be time since last boot:
that was a week ago. It can't be time since last resume from
hibernation: that was six or seven hours ago. I don't think it's
elapsed time since last boot, disregarding hibernation time, though I
can't be 100% sure of that. I booted last Saturday, and I'm pretty
sure I've been running the computer for more than 28 hours since
then. I did a LOT on Sunday and on the holiday Monday.

I looked at mine. The time of last boot plus the uptime is right now.

That obviously makes sense. Of course your situation doesn't make sense
to me either.

--
Gene E. Bloch (Stumbling Bloch)

On 22 Feb 2014, Ken Springer wrote in
alt.comp.os.windows-8:

Hopefully, Bill keeps after this and figures out what triggers the
emergency update. Until then, everything is just speculation.

I don't question that the emergency update happens. I'm certain that it
does. What I don't believe is his claim that Avast has recently
installed Google Chrome out of the blue without asking.

There's quite a bit of information on the 'net about the Avast
Emergency Updater. I wasn't interested in it enough to read all that
stuff, but I did find out that Avast installs a Scheduled Task that
runs it daily. I've disabled the task for now to see what happens.

On Sat, 22 Feb 2014 21:01:30 -0500, Stan Brown
wrote:

On Sat, 22 Feb 2014 14:47:59 +0000, John wrote:

"START"/"Task Manager" click on the Performance tab. Somewhere in
there, near the bottom is "uptime". It should tell you which box
hasn't been restarted in a while.

Out of curiosity, I checked my uptime. It was something like
1:04:24:38.

I don't understand that, frankly. It can't be time since last boot:
that was a week ago. It can't be time since last resume from
hibernation: that was six or seven hours ago. I don't think it's
elapsed time since last boot, disregarding hibernation time, though I
can't be 100% sure of that. I booted last Saturday, and I'm pretty
sure I've been running the computer for more than 28 hours since
then. I did a LOT on Sunday and on the holiday Monday.

Is it possible that Windows restarted after auto-installing an update, or
auto-started after crashing? I don't know if your system settings allow for
either of those scenarios or not. You probably would have noticed that any
apps you had left open were now closed.

I think you can get a second opinion by running "net stats srv" or "net
statistics server" from a command prompt. What you see there should match
what Task Manager shows.

--

Char Jackson

On 2/23/2014 12:27 AM, Nil wrote:
On 22 Feb 2014, Ken Springer wrote in
alt.comp.os.windows-8:

Hopefully, Bill keeps after this and figures out what triggers the
emergency update. Until then, everything is just speculation.

I don't question that the emergency update happens. I'm certain that it
does. What I don't believe is his claim that Avast has recently
installed Google Chrome out of the blue without asking.

It happened to Windows 8 Avast users who have their machines set to not
update the program recently (one claimed he happened to him and he is
using Windows 7). Anybody running an older version of Avast, Avast
forced some machines to update the Avast program in the background
without the users knowledge. And the next time one rebooted, Avast
installed the latest Avast program and supposedly flash up the window
about whether to install Chrome or not.

Well I didn't know Avast was doing this and I rebooted for some reason
and left the room. When I came back, Chrome was installing. Later a
second Windows 8 machine of mine was doing the same, except I didn't
leave the room (as I was expecting the same funny business from Avast).
And the box showed up and I unticked the options on this machine and the
box just vanished. Others too have reported similar things.

http://forum.avast.com/index.php?top...968#msg1027968

There's quite a bit of information on the 'net about the Avast
Emergency Updater. I wasn't interested in it enough to read all that
stuff, but I did find out that Avast installs a Scheduled Task that
runs it daily. I've disabled the task for now to see what happens.

This Avast Emergency Updater is a backdoor that allows Avast to install
anything they want to on your system at any time they want to. One IT
guy on the forum was up in arms about this. He stated they can't have
somebody else have free control over their computers. And frankly, I
totally agree.

http://forum.avast.com/index.php?topic=140730.0

Also in the 15 pages about this, some has noted that this Avast
Emergency Updater doesn't phone home to an Avast server, but to a Google
server. If this is true, I see this has a huge security risk. Some
hacker could hack into this server and they could install almost
anything on any Avast users machine that hasn't manually disabled Avast
Emergency Updater. Of course some doesn't trust Google much either.

--
Bill
Gateway M465e ('06 era) - Thunderbird v24.3.0
Centrino Core2 Duo T7400 2.16 GHz - 4GB - Windows 8 Pro w/Media Center

On Sun, 23 Feb 2014 01:14:00 -0600, Char Jackson wrote:

On Sat, 22 Feb 2014 21:01:30 -0500, Stan Brown
wrote:
Out of curiosity, I checked my uptime. It was something like
1:04:24:38.

I don't understand that, frankly.

Is it possible that Windows restarted after auto-installing an update, or
auto-started after crashing? I don't know if your system settings allow for
either of those scenarios or not. You probably would have noticed that any
apps you had left open were now closed.

I hope there have been no automatic Windows updates. I have them set
to manual. And there wouldn't have been any crash-and-reboot because
I'd have seen them. (When I'm not using the computer for more than a
couple of minutes, I hibernate it. Also, I have it set not to
restart automatically -- if there's a BSOD I need time to read it.)

I think you can get a second opinion by running "net stats srv" or "net
statistics server" from a command prompt. What you see there should match
what Task Manager shows.

I tried that, and the first line was "Statistics since 2014-02-16
9:40:46 AM". That seems consistent with when I last booted, though
it leaves the meaning of "uptime" on my system still a mystery to me.

It really is amazing how much can be done with the command-line
command "net" that can't be done any other way, or at least not
conveniently.

--
Stan Brown, Oak Road Systems, Tompkins County, New York, USA
http://OakRoadSystems.com
Shikata ga nai...