New update for Avira AntiVir

[dlb]

I've been using Avira AntiVir free antivirus for years, and once the splash screen is disabled, it is IMO the best free antivirus available. However, they just launched a new update in the form of an "Ask"-based toolbar. The prompt to install this update pops up above the Windows clock each time the PC is booted to Windows, and occasionally throughout the day. I haven't found a way to disable it, and it seems that installing the update/toolbar makes no difference either; the prompt continues to pop up at each restart. I attached a screen shot below to show what this prompt looks like. If anyone knows how to disable it, or can tell me why going thru the steps to install it doesn't make it go away, PLEASE POST!!!

Thanks!

[solaris89]

Avira recently partnered with UniBlue, so no shock a toolbar is being shoved down users throats.

Someone posted a registry hack here (third post down):
http://groups.google.com/group/alt.c...59ee2a0b030e7d

Seems lots of people are bailing on Avira, can't say that I blame them.
http://www.ghacks.net/2011/06/29/bew...k-and-uniblue/

Someone also posted a possible fix there too, little past halfway down.

[tgell]

From what I have read on various forums, if you click the red X and close it out, after three times it will not come back. Cannot verify that though.

Edit:
Another solution posted.

Please follow these steps:
1. Select Start → Control Panel → Add/Remove Programs (for Windows XP) or Programs and Features (for Vista and Windows 7)
2. In the list of programs, select “Avira AntiVir Personal - Free Antivirus”
3. Click on the Change button
4. Choose “Modify” and click on the Next button
5. Uncheck the two boxes about Avira SearchFree toolbar
6. Click on the Next button
7. Click on Next and close the next window with Finish
8. Select the Yes button to allow a system restart

[dlb]

Originally Posted by solaris89

Seems lots of people are bailing on Avira, can't say that I blame them

But I don't wanna bail!!!! They've had such a great free AV app for so long, that it truly is a shame to see them go this route. I guess it shows the state of the global economy these days.... Avira needed to make a few extra bucks so they decided to try to milk it from their free customers by bundling a toolbar. The weird thing is that I actually tried to install it on at least 3 different PCs, and it never seemed to install (which is OK), but the prompt to install never disappeared either. My plan was to install the toolbar, then disable it in IE/FF.

@ tgell: thanks for the info... I'll check it out and post my results (I just have to reboot my PC now that I'm at home )

EDIT- I just right-clicked the system tray Avira icon and selected "Start update" - I got a window that I have NEVER seen before with Avira: it said "A compulsory reboot is required after this update" and then has options to install, postpone, or cancel. I said "install now" so we'll see what happens.

EDIT #2- I clicked on the "Learn more" link in the toolbar prompt window and it led to me this page. I didn't read every word, but there is only a single mention of "Ask", and here's the exact quote: "The search component of the Avira SearchFreeToolbar was developed using technology from Ask.com. To learn about our commitment to users’ privacy, please refer to our privacy policy and the privacy policy of Ask.com. "

[dlb]

@ tgell: I followed those steps and it made no difference thanks anyway....

However, I did figure out how to stop it.... in the 1st link posted above by solaris89, the 4th post mentions blocking the files responsible via a security policy edit (I didn't try the reg hack in the 3rd post). In Win7X64, here's what I did:
1. go to C:\Program Files (x86)\Avira\AntiVir Desktop
2. scroll to the files ApnStub.exe and ApnToolbarInstaller.exe
3. right click on one of the files, select "Properties", click the "Security" tab
4. in the user list, be sure "SYSTEM" is selected, click the "Advanced" button
5. a new window will open; in the user list, be sure "SYSTEM" is selected, click the "Change Permissions" button
6. a new window will open; in the user list, be sure "SYSTEM" is selected, click the "Edit" button
7. locate the "Traverse folder / execute file" option and check the "Deny" box
8. click "OK" and click "Yes" when you get the "...are you sure?" warning
9. click "OK" as needed until all boxes are closed
10. go to step 3 and repeat for the 2nd file

(screen shots below illustrate the final window with important stuff highlighted in red boxes)

In WinXP Pro, you can use Administrative Tools > Local Security Policy (in the Control Panel) to accomplish the same thing.

Thanks to solaris89 for the link above! Without that link, it probably would have taken me a week to think of this. I've used this EXACT same sequence to disable other pop-ups and nags, including the "Upgrade to full version" nag screen that is also included with Avira.

[dlb]

Oh yeah . . . the steps I listed above are identical for Vista and other versions of Windows 7. If the Windows version is not 64bit, then the path in step 1 would be: C:\Program Files\Avira\AntiVir Desktop without the "(x86)" after "Program Files".

If running XP Home, you won't have a "Security" tab in your "Properties" window when right clicking on files. Sometimes, in Safe Mode, the Security tab appears, but it's not 100% consistent among all XP Home installs, so you can try it and see -OR- click on this link and download SCESP4I.EXE to a new empty folder. Double click SCESP4I.EXE after you've downloaded it to extract it, or extract it with 7-Zip, WinRAR, TUGzip, whatever your favorite 'unzipper' program is. This will result in about 8 or 10 files and some folders; right click on setup.inf and select "Install". When it's done, you normally get a prompt to reboot, so reboot if prompted. This whole sequence now gives you a "Security" tab in "Properties" when you right click a file/shortcut. Very handy, no? Once you have a "Security" tab, you can follow the steps in my post above.

NOTE - This only works with Windows XP Home SP2 or SP3!!! I assume no responsibility for any problems that may arise from this, and it's not my fault if it doesn't work. I have personally used this EXACT same sequence HUNDREDS of times at work and NEVER had a problem, and ONLY ONCE did the "Security" tab refuse to appear, once.

(BTW- if you have Windows XP Media Center Edition, it is more-or-less the same as XP Pro, so you can use Control Panel > Administrative Tools > Local Security Policy; if you're not familiar with this, just post and I'll provide some instructions )

[solaris89]

Glad you got it sorted, one less toolbar mucking up a computer!

[DavidGP]

Originally Posted by solaris89

Glad you got it sorted, one less toolbar mucking up a computer!

I agree with you Angie.... these toolbars that get bundled with free apps these days can be a PITA!

[satrow]

I've had a quick browse through various 'fixes' for the Avira without Ask toolbar; would blocking the ApnStub.exe from contacting 66.235.120.94 (in your hosts file or firewall) prior to installation/upgrade and then ignoring the 3 slide-ups on subsequent reboots be enough?

Only asking because I don't currently have the time or a spare PC to test it out on.

[plodr]

I've done it the way I saw in a thread at dsl/broadband forum. (XP SP3 and 2K)
1. Popup: Click the install now button
2. Next screen: Let the circle at modify stand.
3. Next screen: Be sure the toolbar option is unchecked.
The browser will contact something. Then click Finish.
You will be told to reboot.

You have to reboot at least twice. You will no longer get the popup, web guardian will not be in the Control Center and you will be protected, shown by the open umbrella in the tray.

If you block or remove the three files, ApnToolbarInstaller.exe, ApnStub.exe and ApnIC.dll, I'm not so sure that Avira will let it stand. Every time you update, it might check and send those three files back to you again.

[satrow]

Originally Posted by plodr

If you block or remove the three files, ApnToolbarInstaller.exe, ApnStub.exe and ApnIC.dll, I'm not so sure that Avira will let it stand. Every time you update, it might check and send those three files back to you again.

This was the part that interested me most , these files are all standard Ask, as is the IP address I mentioned earlier. My guess was that blocking the call to Ask might block the toolbar install and that it would have no impact on the Avira installation.

From your walkthrough, it reads like: "The browser will contact something" wouldn't make contact; I'm unsure whether that would block the install of Avira (which is probably successfully installed at this point) or not.

[chaslang]

Interesting! I have Avira 10.0.0.650 on a couple of my test PCs. One is Win XP SP3 and the other Vista SP2. I have not seen this notification yet. I'll my Vista setup running today to see if it shows up.

[dlb]

Originally Posted by plodr

If you block or remove the three files, ApnToolbarInstaller.exe, ApnStub.exe and ApnIC.dll, I'm not so sure that Avira will let it stand. Every time you update, it might check and send those three files back to you again.

Removing the files will result in errors and/or other problems. Denying the files permission to run works because as far as AntiVir is concerned, the files ran just fine; it's Windows that denies them. I used the exact same method I outlined in post #5 above on the avnotify.exe file to stop the "Buy the Premium Pro version now" nag screen and AntiVir has been running perfectly this way for at least 2 years (probably longer).

Originally Posted by satrow

I've had a quick browse through various 'fixes' for the Avira without Ask toolbar; would blocking the ApnStub.exe from contacting 66.235.120.94 (in your hosts file or firewall) prior to installation/upgrade and then ignoring the 3 slide-ups on subsequent reboots be enough?

It's worth a shot.... I'm still using the method from post #5 above and after about 24hours and 3 or 4 reboots, I still have not seen the "install toolbar" prompt, AntiVir is running as normal, so I'll assume that my method is stable and working. I'd be interested to hear the results of blocking the IP address... let us know if it works! (however, I'd block both the stub.exe and the installer.exe)

[mcsmc]

And this is one of the many reasons I like Comodo. Yeah, I have to go into preferences to disable the "message center", and untick "geek buddy" when installing... but I don't have to trick it into behaving the way I want it to.

[satrow]

Originally Posted by mcsmc

And this is one of the many reasons I like Comodo. Yeah, I have to go into preferences to disable the "message center", and untick "geek buddy" when installing... but I don't have to trick it into behaving the way I want it to.

All these 'extras' should be opt-in, not opt-out! Jumping through what feels like hoops of real fire is not what any computer user wants or expects to do when just running an update.

[augiedoggie]

Originally Posted by satrow

All these 'extras' should be opt-in, not opt-out! Jumping through what feels like hoops of real fire is not what any computer user wants or expects to do when just running an update.

I agree but 'money talks' these days as there's a lot of programmers not working and Ask.com etc. seem to have ample funds, probably supplied by unwitting consumers using some 'free software'.

I doubt it's going to get better either. Comodo might even go that way if the offer is right, many others have gone that way already.

[chaslang]

I have allowed my Vista PC with Avira to run all day and have rebooted it several times after installing this latest version of Avira. I still have not see the popups that you are seeing. No signs of Ask anywhere. However I have had a policy on this PC for a long time that disallows avnotify.exe from running. So I would assume that is why I don't see it. Also it would seem that this may still be good enought to block this.

[Buck_nekid]

I also have not seen this popup for Ask, I do have avinotify blocked from running but not sure how that would stop it but I've been wrong before. What are other "Light" AV would some of you recommend? I am half temped to run without one (ducks, waiting for the firestorm) Avira has never once popped up blocking anything so don't know if I have super safe surfing practices or just lucky. I mean a re-image is but a reboot away...

[dlb]

@ chaslang: interesting that you haven't seen the toolbar prompt. It is not related in any way to avnotify.exe which is the "buy the pro version" nag screen. I have also had avnotify.exe blocked via a "deny" permission but it doesn't affect this new 'update'. I don't want to 'force' this update on anyone, but it didn't appear on my home PC until I manually used "Start update" from the umbrella in the system tray.

EDIT - after posting this, I again decided to do exactly what I just described - I right-clicked the Avira icon in the system tray, selected "Start update", and the updates downloaded and installed perfectly, no pop-ups, no toolbar prompts. So, it would seem that setting up a security policy or a "deny" permission for the files I listed above in post #5 works perfectly to squash the now-infamous "toolbar update".

[plodr]

June 30th I got the popup on my five windows partitions. I went through the steps outlined above on one of the computers only. The other four, I simply clicked "ask me later". I had to do this two or three times. If you chose to close the popup with the x, it just pops up again. July 1st, four computers were quiet but one had the popup again. July 2nd no popups on any computer.

At this point I'm not sure when the popup will happen again. I did not stone wall any of the Apn items because I'm curious how this plays out. I want to see how long is "ask me later" and compare it to the one computer I selected "install now" but did not actually install the toolbar.

None of my computers has the web guardian item in the control panel. One did briefly on the 30th and it was disabled so the umbrella remained closed. I assume from the closed umbrella I was really protected so I fixed that.

I also have tweaked AntiVir so I never see the ad for purchasing the paid version. So this ask toolbar popup occurs despite the fact that avnotify has been neutered.