Blocking Avira "avnotify"

Learn about Computer Security Other Security Products
1

When I was using Online Armor I could successfully block the Avira pop up “avnotify” and still get normal updates. I tried blocking it with Comodo and no luck. I have it blocked on the firewall end but cannot seem to do it with D+. I added it to “my blocked files” which does work but then Avira will not update properly and if you do a manual update then you will need to reboot. Avira is on to people blocking the free version pop up and the reboot required is how they are paying people back for blocking “avnotify”. I tried making “avnotify” a limited appclication and receviced an error. Anyone having any luck at successfully blocking “avnotify” with Comodo?

2

Not with Comodo, but with XP Pro you can create a policy that avnotify is not allowed to run. That works fine.

There was also a way to achieve that on XP Home (that is lacking the group policy editor of Pro) but I forgot. Perhaps in safe mode?

EDIT: Alternatively one could invest a few euros and even get additional mailguard and stuff with it…

3
  1. Start-> Control Panel
  2. Administrative tools-> Local security policy
  3. Click on Software Restriction Policy-> Action (at the top)-> create new restriction policies
  4. Right-click additional rules (on the right side)-> new path rule
  5. Click Browse and navigate to C:\Program Files(Avira)\AntiVir Desktop\ and double-click avnotify.exe
  6. Set the security level to Disallowed-> apply-> ok
4

Summat you could try with regards to blocking it with Defence+ is to add avnotify.exe as a Blocked Application in the Run an executable section for update.exe

Double click the update.exe–>Access Rights–>Modify next to run an .exe–>Blocked applications–>Add/Browse to avnotify.exe

It`s a while since i used Avira with CIS so it may not be Update.exe you need to block it from,it may be avcenter.exe…

Sure you`ll figure it out, but like you said Avira have cottoned on :wink:

Matt

5

Try doing it in windows “safe mode” Make sure avira isn’t running
C:\Program Files\Avira\AntiVir PersonalEdition Classic\ In the avira program, right click on avnotify.exe
and rename it to avnotify.exe.bak

6

@Matty: That won’t work because you will get another notification that you have to reboot your computer (not forced, but another thing to click away).

@jay: I think the updater will see avnotify missing and quickly reinstalls it.

7

Im pretty sure i’ve successfully blocked it on my Nephews laptop. I ran the avira update, the pop up appeared, i went to “view active processes”, i blocked and terminated it, ran the update again and it worked. No reboot was asked for.

Ill have to check it then if you guys say it doesn’t.

8

On two laptops running XP home I didn’t succeed with adding it to D+ blocked files list.

9

:slight_smile:

start → run → regedit
then go to…

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Find avnotify and add " /nosplash " to the end.

Hope this helps

10

None of those help actually. Avira is on to people blocking “avnotify”. I got a free upgrade license for the premium form a buddy. ;D

11

Sounds more like an issue with Avira than D+. If I understand correctly, you wish it to update you regularly, but not have the notification popup when it does?

12

It is not an issue. One of the draw backs to Avira free is the daily update nag screen. You use to able to block it via a Windows trick. I was able to block it with Online Armor and no errors. If you block “avnotify” then the next time you run an update you will be asked to reboot. Its all over the forums for Avira. They are catching on to people so this is how they are paying us back. Block “avnotofy” and your updates will require reboots.

13

So what it really needs it to be permitted to run, but block any screen outputs (thus fooling the module).
If you have your D+ rule to allow this module to run, try this:
Edit the rule, select ‘Access Rights’. Block ‘Computer Monitor’ or ‘Windows Messages’.
Do any of these help you?

14

That’s a good idea I may try. However the screen message needs a click on OK. We’ll see…

EDIT: I didn’t try it with Comodo, but found the lost instructions for XP home. It was indeed via safe mode:
http://www.tipsfor.us/2009/03/18/avira-antivir-updates-to-version-9-make-it-more-usable/
That works for XP home.

15

Just did what you said word for word and when Avira updates it asks for a reboot cause it knows that avnotify is being blocked. This is Avira 8 I am referring to.

16

Did not work.

17

I managed to block it back then (and it was with Avira 8.x), it was not the obvious option to define avnotify.exe as isolated app. It was something similar to what Matty said but not quite I think. Try looking in D+ for policies for . “run as executable”… Or an exception to the allowance for explorer.exe to “run as exe”… Or the same but for . instead of explorer.exe… Something like that, my memory is weak.

18

That worked… ;D

19

Would this help??

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifie
rs\0\Paths{3f4dabe0-8061-4eb3-8ae7-265a4c579700}]
“Description”=“Start von avnotify.exe”
“SaferFlags”=dword:00000000
“ItemData”="C:\Programfiles\AntiVir PersonalEdition Classic\avnotify.exe <–you probably need to edit this :slight_smile:

I removed the quote
I felt it was inappropriate :frowning:

20

Ill have to check it out, But it definitely didn’t ask for a reboot. And it is avira 8 also.