Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: TheSpirit on December 15, 2008, 11:25:47 AM

Title: Behavior blocker - any logging?
Post by: TheSpirit on December 15, 2008, 11:25:47 AM

I find the behavior blocker quite useful for trouble shooting/malware tracking to identify programs that modify files with a given extension, but there is a small hole in the situation when the blocker cannot ask for confirmation. In this case you have to either allow or deny by default, and you get no alert.

So the question is: Can blocker events be logged somehow? I can find no settings or ini-file/registry entries for this. Anybody with insider knowledge?

Title: Re: Behavior blocker - any logging?
Post by: Lisandro on December 15, 2008, 02:37:50 PM

If it is not logged in any of avast logs (set the Debug level, the lowest in the slider), I don't think it has a special, separated, log for it. Anyway, which extension are you working with?

Title: Re: Behavior blocker - any logging?
Post by: TheSpirit on December 15, 2008, 03:44:34 PM

Thanks Tech. The debug log doesn't seem to work in the free version. Does it require admin rights? I need to track normal user accounts. Maybe you have to turn on debugging?

Title: Re: Behavior blocker - any logging?
Post by: Lisandro on December 15, 2008, 03:52:02 PM

Quote from: TheSpirit on December 15, 2008, 03:44:34 PM

Thanks Tech. The debug log doesn't seem to work in the free version. Does it require admin rights? I need to track normal user accounts. Maybe you have to turn on debugging?

It works... the slider must be at the bottom... boot (if necessary).
All informations (available) will be logged in the logs. But, I think behavior block is not logged there...

Title: Re: Behavior blocker - any logging?
Post by: TheSpirit on December 15, 2008, 04:07:22 PM

Thanks again Tech. I forgot that in Avast you don't press enter, you boot.  ;D It works and it doesn't work. The log file is created, but the log viewer doesn't display it. No big problem. The blocker doesn't log, though.

Extensions? Maybe you want to know which programs create all those TMP files? What about DAT files? Most applications have special extensions that you may need to track. This feature could be most useful, though most users seem to think that it is useless.

Title: Re: Behavior blocker - any logging?
Post by: Lisandro on December 15, 2008, 10:47:08 PM

Quote from: TheSpirit on December 15, 2008, 04:07:22 PM

This feature could be most useful, though most users seem to think that it is useless.

Well... it's outdated really... I don't think you're increasing that much your system security.
I won't be able to use a tmp file blocker... I'm continuously installing programs, updates, etc...