Using EndPoint Protection 8.0.1603 on a Windows XP machine (administered by SOA 1.3.3.35).
A self-updating fat-client system downloaded a file when it started up, and the avast! File Reputation Warning window appeared, saying "The file you are downloading seems to be very new or very rare." (etc). This window offers "Abort the connection (recommended)" under Actions to Take.
However, I was able to observe that the system that was downloading the file had already completed the download and updated itself at the time the avast! warning appeared (the application displays its own results message in its own window, which was behind the avast! window).
There is no "OK" button in the avast! window, just an "X" close button in the upper right corner. So I would assume that, first, avast! should have suspended the file download before it displayed this warning, and that pressing the "X" in the avast! window with "Abort the connection" chosen should have blocked the download.
Apparently it did not. The download had already completed by the time the avast! window appeared, and closing that window with the "Abort..." option chosen had no effect. The new version of the file was installed.
Now in this particular case, the downloaded file was a legitimate update for a legitimate program.
But what would have happened if it had not been?
Is there something I need to set in the SOA to cause avast! to actually suspend and abort file downloads in situations like this?
Thanks for any help.
