New update for Avira AntiVir

Discussion in 'Software' started by dlb, Jul 1, 2011.

  1. dlb

    dlb MajorGeek

    I've been using Avira AntiVir free antivirus for years, and once the splash screen is disabled, it is IMO the best free antivirus available. However, they just launched a new update in the form of an "Ask"-based toolbar. The prompt to install this update pops up above the Windows clock each time the PC is booted to Windows, and occasionally throughout the day. I haven't found a way to disable it, and it seems that installing the update/toolbar makes no difference either; the prompt continues to pop up at each restart. I attached a screen shot below to show what this prompt looks like. If anyone knows how to disable it, or can tell me why going thru the steps to install it doesn't make it go away, PLEASE POST!!!

    Thanks!
     

    Attached Files:

  2. solaris89

    solaris89 First Sergeant

  3. tgell

    tgell Major Geek Extraordinaire

    From what I have read on various forums, if you click the red X and close it out, after three times it will not come back. Cannot verify that though.

    Edit:
    Another solution posted.

     
    Last edited: Jul 1, 2011
  4. dlb

    dlb MajorGeek

    :banghead :cry :crybaby But I don't wanna bail!!!! :crybaby They've had such a great free AV app for so long, that it truly is a shame to see them go this route. I guess it shows the state of the global economy these days.... Avira needed to make a few extra bucks so they decided to try to milk it from their free customers by bundling a toolbar. The weird thing is that I actually tried to install it on at least 3 different PCs, and it never seemed to install (which is OK), but the prompt to install never disappeared either. My plan was to install the toolbar, then disable it in IE/FF.

    @ tgell: thanks for the info... I'll check it out and post my results (I just have to reboot my PC now that I'm at home ;) )

    EDIT- I just right-clicked the system tray Avira icon and selected "Start update" - I got a window that I have NEVER seen before with Avira: it said "A compulsory reboot is required after this update" and then has options to install, postpone, or cancel. I said "install now" so we'll see what happens. :confused

    EDIT #2- I clicked on the "Learn more" link in the toolbar prompt window and it led to me this page. I didn't read every word, but there is only a single mention of "Ask", and here's the exact quote: "The search component of the Avira SearchFreeToolbar was developed using technology from Ask.com. To learn about our commitment to users’ privacy, please refer to our privacy policy and the privacy policy of Ask.com. "
     
    Last edited: Jul 1, 2011
  5. dlb

    dlb MajorGeek

    @ tgell: I followed those steps and it made no difference :( thanks anyway....

    However, I did figure out how to stop it.... in the 1st link posted above by solaris89, the 4th post mentions blocking the files responsible via a security policy edit (I didn't try the reg hack in the 3rd post). In Win7X64, here's what I did:
    1. go to C:\Program Files (x86)\Avira\AntiVir Desktop
    2. scroll to the files ApnStub.exe and ApnToolbarInstaller.exe
    3. right click on one of the files, select "Properties", click the "Security" tab
    4. in the user list, be sure "SYSTEM" is selected, click the "Advanced" button
    5. a new window will open; in the user list, be sure "SYSTEM" is selected, click the "Change Permissions" button
    6. a new window will open; in the user list, be sure "SYSTEM" is selected, click the "Edit" button
    7. locate the "Traverse folder / execute file" option and check the "Deny" box
    8. click "OK" and click "Yes" when you get the "...are you sure?" warning
    9. click "OK" as needed until all boxes are closed
    10. go to step 3 and repeat for the 2nd file

    (screen shots below illustrate the final window with important stuff highlighted in red boxes)

    In WinXP Pro, you can use Administrative Tools > Local Security Policy (in the Control Panel) to accomplish the same thing.

    Thanks to solaris89 for the link above! Without that link, it probably would have taken me a week to think of this. I've used this EXACT same sequence to disable other pop-ups and nags, including the "Upgrade to full version" nag screen that is also included with Avira. LOL
     

    Attached Files:

  6. dlb

    dlb MajorGeek

    Oh yeah . . . the steps I listed above are identical for Vista and other versions of Windows 7. If the Windows version is not 64bit, then the path in step 1 would be: C:\Program Files\Avira\AntiVir Desktop without the "(x86)" after "Program Files".

    If running XP Home, you won't have a "Security" tab in your "Properties" window when right clicking on files. Sometimes, in Safe Mode, the Security tab appears, but it's not 100% consistent among all XP Home installs, so you can try it and see -OR- click on this link and download SCESP4I.EXE to a new empty folder. Double click SCESP4I.EXE after you've downloaded it to extract it, or extract it with 7-Zip, WinRAR, TUGzip, whatever your favorite 'unzipper' program is. This will result in about 8 or 10 files and some folders; right click on setup.inf and select "Install". When it's done, you normally get a prompt to reboot, so reboot if prompted. This whole sequence now gives you a "Security" tab in "Properties" when you right click a file/shortcut. Very handy, no? Once you have a "Security" tab, you can follow the steps in my post above.

    NOTE - This only works with Windows XP Home SP2 or SP3!!! I assume no responsibility for any problems that may arise from this, and it's not my fault if it doesn't work. I have personally used this EXACT same sequence HUNDREDS of times at work and NEVER had a problem, and ONLY ONCE did the "Security" tab refuse to appear, once.

    (BTW- if you have Windows XP Media Center Edition, it is more-or-less the same as XP Pro, so you can use Control Panel > Administrative Tools > Local Security Policy; if you're not familiar with this, just post and I'll provide some instructions ;) )
     
    Last edited: Jul 2, 2011
  7. solaris89

    solaris89 First Sergeant

    Glad you got it sorted, one less toolbar mucking up a computer! :)
     
  8. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    I agree with you Angie.... these toolbars that get bundled with free apps these days can be a PITA!
     
  9. satrow

    satrow Major Geek Extraordinaire

    I've had a quick browse through various 'fixes' for the Avira without Ask toolbar; would blocking the ApnStub.exe from contacting 66.235.120.94 (in your hosts file or firewall) prior to installation/upgrade and then ignoring the 3 slide-ups on subsequent reboots be enough?

    Only asking because I don't currently have the time or a spare PC to test it out on.
     
  10. plodr

    plodr Major Geek Super Extraordinaire

    I've done it the way I saw in a thread at dsl/broadband forum. (XP SP3 and 2K)
    1. Popup: Click the install now button
    2. Next screen: Let the circle at modify stand.
    3. Next screen: Be sure the toolbar option is unchecked.
    The browser will contact something. Then click Finish.
    You will be told to reboot.

    You have to reboot at least twice. You will no longer get the popup, web guardian will not be in the Control Center and you will be protected, shown by the open umbrella in the tray.

    If you block or remove the three files, ApnToolbarInstaller.exe, ApnStub.exe and ApnIC.dll, I'm not so sure that Avira will let it stand. Every time you update, it might check and send those three files back to you again.
     
  11. satrow

    satrow Major Geek Extraordinaire

    This was the part that interested me most ;), these files are all standard Ask, as is the IP address I mentioned earlier. My guess was that blocking the call to Ask might block the toolbar install and that it would have no impact on the Avira installation.

    From your walkthrough, it reads like: "The browser will contact something" wouldn't make contact; I'm unsure whether that would block the install of Avira (which is probably successfully installed at this point) or not.
     
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Interesting! I have Avira 10.0.0.650 on a couple of my test PCs. One is Win XP SP3 and the other Vista SP2. I have not seen this notification yet. I'll my Vista setup running today to see if it shows up.
     
  13. dlb

    dlb MajorGeek

    Removing the files will result in errors and/or other problems. Denying the files permission to run works because as far as AntiVir is concerned, the files ran just fine; it's Windows that denies them. I used the exact same method I outlined in post #5 above on the avnotify.exe file to stop the "Buy the Premium Pro version now" nag screen and AntiVir has been running perfectly this way for at least 2 years (probably longer).

    It's worth a shot.... I'm still using the method from post #5 above and after about 24hours and 3 or 4 reboots, I still have not seen the "install toolbar" prompt, AntiVir is running as normal, so I'll assume that my method is stable and working. I'd be interested to hear the results of blocking the IP address... let us know if it works! ;) (however, I'd block both the stub.exe and the installer.exe)
     
    Last edited: Jul 2, 2011
  14. mcsmc

    mcsmc MajorGeek

    And this is one of the many reasons I like Comodo. Yeah, I have to go into preferences to disable the "message center", and untick "geek buddy" when installing... but I don't have to trick it into behaving the way I want it to.
     
  15. satrow

    satrow Major Geek Extraordinaire

    All these 'extras' should be opt-in, not opt-out! Jumping through what feels like hoops of real fire is not what any computer user wants or expects to do when just running an update.
     
  16. augiedoggie

    augiedoggie The Canadian Loon - LocoAugie (R.I.P. 2012)

    I agree but 'money talks' these days as there's a lot of programmers not working and Ask.com etc. seem to have ample funds, probably supplied by unwitting consumers using some 'free software'.

    I doubt it's going to get better either. Comodo might even go that way if the offer is right, many others have gone that way already.:(
     
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I have allowed my Vista PC with Avira to run all day and have rebooted it several times after installing this latest version of Avira. I still have not see the popups that you are seeing. No signs of Ask anywhere. However I have had a policy on this PC for a long time that disallows avnotify.exe from running. So I would assume that is why I don't see it. Also it would seem that this may still be good enought to block this.
     
  18. Buck_nekid

    Buck_nekid Specialist

    I also have not seen this popup for Ask, I do have avinotify blocked from running but not sure how that would stop it but I've been wrong before. What are other "Light" AV would some of you recommend? I am half temped to run without one (ducks, waiting for the firestorm) Avira has never once popped up blocking anything so don't know if I have super safe surfing practices or just lucky. I mean a re-image is but a reboot away...
     
  19. dlb

    dlb MajorGeek

    @ chaslang: interesting that you haven't seen the toolbar prompt. It is not related in any way to avnotify.exe which is the "buy the pro version" nag screen. I have also had avnotify.exe blocked via a "deny" permission but it doesn't affect this new 'update'. I don't want to 'force' this update on anyone, but it didn't appear on my home PC until I manually used "Start update" from the umbrella in the system tray.

    EDIT - after posting this, I again decided to do exactly what I just described - I right-clicked the Avira icon in the system tray, selected "Start update", and the updates downloaded and installed perfectly, no pop-ups, no toolbar prompts. So, it would seem that setting up a security policy or a "deny" permission for the files I listed above in post #5 works perfectly to squash the now-infamous "toolbar update".

    :major
     
    Last edited: Jul 2, 2011
  20. plodr

    plodr Major Geek Super Extraordinaire

    June 30th I got the popup on my five windows partitions. I went through the steps outlined above on one of the computers only. The other four, I simply clicked "ask me later". I had to do this two or three times. If you chose to close the popup with the x, it just pops up again. July 1st, four computers were quiet but one had the popup again. July 2nd no popups on any computer.

    At this point I'm not sure when the popup will happen again. I did not stone wall any of the Apn items because I'm curious how this plays out. I want to see how long is "ask me later" and compare it to the one computer I selected "install now" but did not actually install the toolbar.

    None of my computers has the web guardian item in the control panel. One did briefly on the 30th and it was disabled so the umbrella remained closed. I assume from the closed umbrella I was really protected so I fixed that.

    I also have tweaked AntiVir so I never see the ad for purchasing the paid version. So this ask toolbar popup occurs despite the fact that avnotify has been neutered.
     
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes I had not been clicking on the start update selection but it just allowed it to update on its own and it was showing updates each day. When I right clicked on the tray icon and selected Start update, this popup did finally show up.

    I blocked those two files from running like you did. ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds