Think twice before installing Avira Antivir 10 Service Pack 2

[c627627]

EDIT: May 09, 2012.


It's over. Version 10 now continuously nags to be updated.
Avira AntiVir Personal 12.0.0.1125 is out. Unlike previous builds, this one does not appear to require multiple reboots if you don't install spyware.

Previously we established that this is a program with one of the best antivirus definitions out there and it's free.

Sadly, since version 10 SP2, they introduced multiple nags to make you install Toolbars and other unacceptable crapware. Since it appears we can no longer simply update the definitions for version 10 non SP2 without updating the program, I was on the verge of giving it up - but it appears the just released build gets rid of the update nags which required multiple reboots to get rid of.

So as long as it is installed correctly, and Comodo Firewall or similar software is used to block these two files from accessing the internet:
C:\Program Files\Avira\AntiVir Desktop\apnstub.exe
C:\Program Files\Avira\AntiVir Desktop\ipmgui.exe

We should be good continuing to use this antivirus software instead of the pay-for alternatives, most of which have a track record of worse definitions than Avira.



Avira AntiVir Personal 12.0.0.1125

[There was no version 11.]

Disconnect Internet connection. Double click on Setup.exe to install the program.
UNCHECK everything when asked to install Avira Toolbars.

Allow the configuration wizard to keep the default extended threat categories. [Do not Select All.]
(UNCHECK: Application (APPL), Fraudulent Software, Games, Jokes, Programs that violate the private domain, and Unusual runtime compression.)

*ABORT any update process when it automatically pops up!* (If you haven't disconnected Internet connection as instructed above.)

Setup the program before connecting to the internet:


Subscription to new virus definitions for this program is renewed automatically through product updates. It is not renewed through virus definition updates. If product updates are disabled in order to prevent installation of a newer version of the program, download the latest key file from

http://dl2.avgate.net/down/windows/hbedv.key

and either copy it to
C:\Program Files\Avira\AntiVir Desktop
and restart or go to Help > License management > click on the blue hbedv.key link > browse to the new downloaded hbedv.key > Open.


Options:
C:\Program Files\Avira\AntiVir Desktop\avcenter.exe

System Scanner (on left) > Configuration (Right middle part of the window) > Yes > UNCHECK: Follow symbolic links (middle right) > System Scanner > Scan > Action for concerning files >
Set for Automatic, Primary action: Ignore if wanting to just scan folders and get a scan report without deleting files or being prompted what to do if virii/malware is found.


> Update > Product Update > Do not download product updates. [This option is only for Avira Antivir product updates (Antivirus definitions will still be downloaded automatically.) Product updates should be downloaded manually by going to Update > Start product update... because they may affect the Windows operating system. They should preferably be downloaded only *after* imaging the operating system partition so that if they cause problems you can reimage back to the state before product updates were installed.]


> General > Security >
Disable being notified every time USB drive has an AUTORUN.INF file:
UNCHECK: Block autostart function
> General > Alerts >
UNCHECK: Show notice if the virus definition file is out of date
then


To disable Notifier nag screen: Windows 2000/XP Control Panel > Administrative Tools [in Windows 7, click on System and Security first] > Local Security Policy > Right click on Software Restriction Policies > Create New Policies > Right click on Additional Rules > New Path Rule... > Browse... to the path of avnotify.exe default is
C:\Program Files\Avira\AntiVir Desktop\avnotify.exe
> Set the security level to Disallowed > OK

Also block these two files from accessing the internet, using Comodo Firewall or similar software:
C:\Program Files\Avira\AntiVir Desktop\apnstub.exe
C:\Program Files\Avira\AntiVir Desktop\ipmgui.exe



For Windows XP Home you would need to boot into safe mode and log in as Administrator, then
go to
C:\Program Files\Avira\AntiVir Desktop\avnotify.exe
and right click on it >
Properties > Security > Advanced > Edit > Select options not to let it execute for all users.


To submit a suspected virus, go to
http://analysis.avira.com/samples/
to upload it.

Turn off notification pop-ups after Antivir updates itself:
Administration (lower left) > Scheduler > Right-click on Daily Update > Edit job > Next > Next > Next > under Display mode, select Invisible > Finish.


You can scan multiple drives inside program options: Local Protection > Scanner > CHECK drives you wish to scan. The premium version also offers the option to scan multiple folders here. The free version does not.


In case of error message:

The procedure entry point ?_Xbad@tr1@std@@YAX4error_type@regex_constants@12@@Z could not be located in the dynamic link library MSVCP90.dll

download and install Microsoft Visual C++ 2008 SP1 Redistributable Package
http://www.microsoft.com/downloads/...FamilyID=a5c84275-3b97-4ab7-a40d-3802b2af5fc2


Manual updates can be downloaded from:
http://dl.antivir.de/down/vdf/ivdf_fusebundle_nt_en.zip
Unzip the downloaded file and copy all the contents to
C:\Program Files\Avira\AntiVir Desktop


Using two Antivirus programs at the same time:
If there are two Antivirus programs installed, you should not have two Antivirus *Guard* programs active at the same time because this would slow the system down, Windows may even have problems booting with two Antivirus guard components being active. So if installing AntiVir on a system where there already is an Antivirus program installed, do not install AntiVir guard.

Also disable the guard component of one program if using another program to scan an entire disk drive.


Default log file location is
C:\ProgramData\Avira\AntiVir Desktop\LOGFILES
or
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\LOGFILES


For older versions:
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\LOGFILES
C:\Program Files\Avira\AntiVir PersonalEdition Classic
or
C:\Program Files\Avira AntiVir Personal\
C:\WINDOWS\Application Data\Avira AntiVir Personal\LOGFILES




===========================

Previous, now obsolete posts:


















EDIT 2011-10-17:

$!*$#@

Brand new popup:View attachment 100537



HKEY_CURRENT_USER\Software\Avira\AntiVir Desktop\Reminder

Set MsgID1054 and MsgID1057 values to 3 to get rid of it.


Or save this as a .reg file using Notepad:

REGEDIT4

[HKEY_CURRENT_USER\Software\Avira\AntiVir Desktop\Reminder]
"MsgID1054"=dword:00000003
"MsgID1057"=dword:00000003

===============
EDIT 1:

Lots of posts of people who installed Avira on computers of hundreds of customers, their phones are ringing off the hook because they are getting the blame. Most saying they are uninstalling and looking for the alternative.

10.0.0.690 is the version with SP2. Anything prior to that is OK. So both 648 and 650 are OK. I would stick with 650 on Windows 7/Vista and 567 on Windows XP then disable product updates and close any and all pop-ups offering product updates. Definitions for those can be updated automatically for a long time I would think. Hopefully by the time 650 reaches End of Life, things will sort themselves out.


Otherwise, stepping down to that thing Microsoft has is probably the only freeware option. Although I would rather start looking for free after rebate deals on Trend Micro, Kaspersky or McAffee. But really: uninstalling 690 / installing 650 then immediately blocking product updates is the best option now imo.

===============
EDIT 2:

Old version 10.0.650 (without SP2) download page while it lasts:
http://www.avira.com/en/support-download-free-antivirus


===============
EDIT 3 :

And for Windows XP, old version 10.0.567 since later versions may still have (allegedly fixed) memory leak issues affecting Windows XP but not Win Vista or Win 7:

For those using WinXP and needing version 567...@ Old Apps.


Thank you for using OldApps. Your download will start automatically
If not please click here: Avira AntiVir Personal 10.0.567 (42.05 MB)

===============
EDIT 4 :
I'm still looking into alternatives but until then I am using this workaround as posted above:


1. Disconnect internet then install v650 [or v567 if WinXP].

2. Disable product updates.

3. Connect internet and Start Update for definitions (not product).

4. Wait for the first pop-up to appear asking to install SP2, click on 'Install Later' then go to registry and
HKEY_CURRENT_USER\Software\Avira\AntiVir Desktop\Reminder

Change the value of MsgID1055 in the right window pane to 3


That workaround should work until v10 end of life.
The only down side I see is if Avira launches yet another new popup prompt in the future.


Subscription to new virus definitions for this program is renewed automatically through product updates. It is not renewed through virus definition updates. If product updates are disabled in order to prevent installation of a newer version of the program, download the latest key file from

http://dl2.avgate.net/down/windows/hbedv.key

and either copy it to
C:\Program Files\Avira\AntiVir Desktop
and restart or go to Help > License management > click on the blue hbedv.key link > browse to the new downloaded hbedv.key > Open.

===============



This is how I have Avirta Antivir setup
Configuration > Update > Product Update > Do not download product updates. [This option is only for Avira Antivir product updates (Antivirus definitions will still be downloaded automatically.) Product updates should be downloaded manually by going to Update > Start product update... because they may affect the Windows operating system. They should preferably be downloaded only *after* imaging the operating system partition so that if they cause problems you can reimage back to the state before product updates were installed.]


I do this because of the Windows XP killer update, which Avira released after v10.0.0.567, rendered Windows XP unusable due to a memory leak bug. After the initial fix, I still detected some problems and then decided to give up and not update the product on Windows XP. It was OK to update virus definitions - just not the product update.


This morning Avira rolled out a Service Pack 2 for version 10 which wanted to install itself even though I had product updates disabled. I drive imaged the system so I let it go ahead just to see what's up. All of a sudden it wanted to install the ASK toolabar (!) Avira had previously detected ASK toolbar as malware and now it partnered with them (!) As most of us know installation of ANY toolabar is not OK.

It also wanted to install Uniblue's registry "optimizer" which it also previously detected as malware. It is certainly scareware, falsely making you think something is seriously wrong with your system and only by paying Uniblue will you get the fix.


If you refuse to install these, Avira umbrella remains closed until you accept the installation of ASK toolbar and make ASK your default search engine!!! As a matter of fact, the protection is actually still up - but you have no way of knowing because there is no way to reopen the umbrella w/o installing crapware. Therefore:

Do not install Service Pack 2 for Avira Antivir 10.

 

[EarthDog]

Is this only for XP?

Seems to work OK in W7..?

 

[deathman20]

And all the more point to me not running anything but MSE on my PC or nothing at all. More likely to screw up my PC running a virus software then actually getting a virus.

Thanks for the tip!

 

[c627627]

Is this only for XP?

Negative, issues with Service Pack 2 apply to all operating systems. I mentioned Windows XP only in reference to what happened with a post v10.0.0.567 Windows XP killing update and why I had product updates disabled on v10.0.0.567 on Windows XP.

 

[RollingThunder]

Negative, issues with Service Pack 2 apply to all operating systems. I mentioned Windows XP only in reference to what happened with a post v10.0.0.567 Windows XP killing update and why I had product updates disabled on v10.0.0.567 on Windows XP.

c6,

Just updated to v10.0.0.648 out of necessity (license expires June 30) and all that crap did pop-up which I didn't install. I didn't know the extent of the SP2 installation. Was very disappointed with Avira...

Thanks for being the guinea pig on this.

 

[c627627]

I am immune to these problems because I drive image so often and document every minute change I make to my multi-boot system so that when something like this happens, I can reimage and figure out what caused it.

Here is a direct link for you, to updated key which you can download and replace over the old one, without needing to do anything else (last time I checked). Avira keeps updated keys here:
http://dl2.avgate.net/down/windows/hbedv.key

 

[c627627]

http://forum.avira.com/wbb/index.php?page=Thread&threadID=132664

 

[c627627]

Oh man, ASK AppStub.exe is running with every Windows reboot even if you chose not to install the Toolbar. Isn't this the very definition of what Avira was supposed to protect us from?

Definitely stay away from Version 10 SP2.

 

[DocClock aka MadClocker]

Avira webguard disabled..Toolbar?

Ok, I get this popup from Avira saying that they want to install a toolbar...(like I need another toolbar to waste desktop real estate)

So as per usual, instead of clicking on install now, or install later, I just hit the red X.

Avira wanted a re-start after an update, so I restart, and I notice that the Avira "umbrella" is closed meaning that all is not right with my setup...I open Avira, and it says online protection is disabled, and in the config dialog, the "turn on Webguard" checkbox is checked....so, I am at a loss as what to do next....except wait for the Avira popup to come up again, and say yes to the freaking toolbar

Why does everybody want to give you a toolbar? If I said yes to every toolbar offered, I couldn't see the browser window.
We need to somehow write an open letter to all the developers out there that we have had enough of these toolbar offerings....instead, why not develop a toolbar extension for existing toolbars.

I have 1 toolbar in FF, and it is the one that came with FF and I have NEVER used it, not once.

The way My browser is setup, I have a google search window/bar to the right of my address bar, and that is enough for me....if I can't navigate from the address bar, or the google search pane, then I don't need to be on the net.
I suppose I could add a 1 touch button to my favorite links in a toolbar, but meh
I guess this is a rant, because I am 78% sure that the webguard will re-activate once I install the (insert expletive here) toolbar.
:end of rant

 

[RollingThunder]

Doc,

Merged your thread to here.

 

[FireMogle]

I may just leave it to MSE or bareback soon. I will not use some asinine malware so that I can be protected from malware.

 

[DocClock aka MadClocker]

Well, I have a fix for the Avira problem...since they insist they want me to install a toolbar, I will just un-install Avira....see how they like that!

For now, I will just stay with MS SE and see how it goes. They want to force me to get into a situation where I will be forced to purchase something in the near future..and it ain't happening here...no on my watch.
I will also try to give Avira some feedback as to why I have now abandoned their software...we get enough heavy handedness from our respective governments to put up with trash tactics like this.
SHAME ON YOU AVIRA! I'm done with you!

 

[Adragontattoo]

well thanks Avira! Ill finally figure out how to get ClamAV working to scan all traffic and set up MSE to doublecheck. Goodjob!

 

[c627627]

How can I remove the Avira Toolbar?
http://www.avira.com/en/support-for-free-faq-detail/faqid/863


Another update has been released to fix the umbrella issue but SP2 which is v10.0.0.690 introduces a host of potentially buggy new features, so in addition to reasons posted above, installing v10.0.0.650 on Windows 7/Vista or v10.0.0.567 on Windows XP (post 567 may have memory leaks on XP) then Configuration > Update > Product Update > "Do not download product updates" is recommended.

[This option is only for Avira Antivir product updates (Antivirus definitions will still be downloaded automatically.)]


v10.0.0.650 is still available so I would grab that one and hold on to it refusing to allow any product updates when they pop-up after installing it.
http://www.avira.com/en/support-download-free-antivirus
The important thing is to Configuration > Update > Product Update > "Do not download product updates" immediately after install, maybe even installing on a computer with internet disconnected to make sure it doesn't download before you switch auto product updates off.

 

[c627627]

And so now here's the crown reason to not product update after v10.0.0.650:

Avira folder itself contains
ApnToolbarInstaller.exe
ApnStub.exe (Boots with windows whether you accept to install the Toolbar malware or not, then attempts to Phone home)
ApnIC.dll

You can delete these from Safe Mode or by first going to Avira Antivir > Configuration > Expert Mode > Security > UNCHECK: Protect files and registry entries from manipulation.

Then deleting them then CHECKING this ↑ config entry again.



Well guess what? The moment you do an update again, all three are added to the Avira folder again. Avira made malware a permanent integral part of its program not a separate uninstallable addition like we thought (!)

 

[RollingThunder]

And so now here's the crown reason to not product update after v10.0.0.650:

Avira folder itself contains
ApnToolbarInstaller.exe
ApnStub.exe (Boots with windows whether you accept to install the Toolbar malware or not, then attempts to Phone home)
ApnIC.dll

You can delete these from Safe Mode or by first going to Avira Antivir > Configuration > Expert Mode > Security > UNCHECK: Protect files and registry entries from manipulation.

Then deleting them then CHECKING this ↑ config entry again.



Well guess what? The moment you do an update again, all three are added to the Avira folder again. Avira made malware a permanent integral part of its program not a separate uninstallable addition like we thought (!)

c6,

v10.0.0.648 doesn't have those files. Looks like Avira shot themselves in the foot this time.

 

[c627627]

Lots of posts of people who installed Avira on computers of hundreds of customers, their phones are ringing off the hook because they are getting the blame. Most saying they are uninstalling and looking for the alternative.

10.0.0.690 is the version with SP2. Anything prior to that is OK. So both 648 and 650 are OK. I would stick with 650 on Windows 7/Vista and 567 on Windows XP then disable product updates and close any and all pop-ups offering product updates. Definitions for those can be updated automatically for a long time I would think. Hopefully by the time 650 reaches End of Life, things will sort themselves out.


Otherwise, stepping down to that thing Microsoft has is probably the only freeware option. Although I would rather start looking for free after rebate deals on Trend Micro, Kaspersky or McAffee. But really: uninstalling 690 / installing 650 then immediately blocking product updates is the best option now imo.

 

[RollingThunder]

Lots of posts of people who installed Avira on computers of hundreds of customers, their phones are ringing off the hook because they are getting the blame. Most saying they are uninstalling and looking for the alternative.

10.0.0.690 is the version with SP2. Anything prior to that is OK. So both 648 and 650 are OK. I would stick with 650 on Windows 7/Vista and 567 on Windows XP then disable product updates and close any and all pop-ups offering product updates. Definitions for those can be updated automatically for a long time I would think. Hopefully by the time 650 reaches End of Life, things will sort themselves out.


Otherwise, stepping down to that thing Microsoft has is probably the only freeware option. Although I would rather start looking for free after rebate deals on Trend Micro, Kaspersky or McAffee. But really: uninstalling 690 / installing 650 then immediately blocking product updates is the best option now imo.

c6,

Thank you for sorting this all out for us. When the SP2 offer came up, I just had a "gut" feeling and disallowed it to look further and you had it all right here.

What a PITA Avira has made it.

 

[TempliNocturnus]

My firewall caught that Ask stub executable and the Ask Toolbar did not install on my system when I received the update. Since then, I just created disallow path rules in my Software Restriction Policies for those Ask.com executable.

 

[Sojourner]

If anyone has an account at Avira: http://forum.avira.com/wbb/index.php?page=Board&boardID=135

Can you REPLY to any of the threads started by other users? Or is Avira controlling thre issue by limiting people to only posting in threads they started?

No. I am not able to REPLY to any threads by other users. Their techs very seldom answer users using the free antivir.