Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: andy675 on February 01, 2010, 01:30:05 PM

Title: Behaviour Shield Questions
Post by: andy675 on February 01, 2010, 01:30:05 PM
Hi,

I am unable to find a FULL explanation as too what the "Behavior Shield" actually does.

Could someone please advise the correct answer.......is it like Threatfire (behavior blocker)...is there any malware (like Eicar) that we can use too see it in action.....?

Many thanks

XP SP3      avast Free      WinPatrol Plus
Title: Re: Behaviour Shield Questions
Post by: Hermite15 on February 01, 2010, 01:54:59 PM
Hi,

it's been asked a million times, nobody really knows, and there are different theories. I've personally uninstalled it as it's completely inoperative anyway on 64 bit systems. My best guess is that shield can "call home" to describe malware behavior, so that Avast can analyze that and react as appropriate in upcoming updates...just guessing  ;)
Title: Re: Behaviour Shield Questions
Post by: andy675 on February 01, 2010, 02:46:33 PM
Thanks for your reply......

HOWEVER, could someone from Avast please respond to my initial questions. They were not difficult & it is only fair to get a proper response. I do not wish to disable the shield & potentially weaken my security.

Someone developed the "Behavior Shield" for a reason  & I seek to understand its purpose.

Many thanks
Title: Re: Behaviour Shield Questions
Post by: Hermite15 on February 01, 2010, 02:48:33 PM
then good luck  ;D
Title: Re: Behaviour Shield Questions
Post by: andy675 on February 01, 2010, 02:50:36 PM
Thanks but I/We should not need luck.

Could VLK or developer or someone PLEASE respond.

Many thanks
Title: Re: Behaviour Shield Questions
Post by: greenhatch on February 01, 2010, 03:15:36 PM
The good luck wish is well intended. Others have asked and even I have fished but no precise information from Alwil yet. I'm very interested too :)
Title: Re: Behaviour Shield Questions
Post by: andy675 on February 01, 2010, 04:29:07 PM
?????
Title: Re: Behaviour Shield Questions
Post by: andy675 on February 01, 2010, 09:47:31 PM
could someone please respond to the questions
Title: Re: Behaviour Shield Questions
Post by: olddog on February 02, 2010, 12:22:16 AM
Andy675,

There is no doubt that the behaviour shield does something, even if that "something" so far appears to have only been identified as some of the various problems it seems to cause, like one I posted about it preventing me printing from secure pages to my PDF printer in IE7, but not in Firefox. That post received no responses.

There are a lot of posts with queries as to what the behaviour shield is supposed to do, whether it blocks or doesn't block, what is its relationship to the community setting - some users have made guesses, but significantly there seems to have been no definitive comment by Avast.

I even sent an email to VLK some days ago, asking him whether he could clear up some of the confusion, but that too so far remains unanswered.
Title: Re: Behaviour Shield Questions
Post by: andy675 on February 02, 2010, 01:08:04 PM
Thank you all for your responses.

Regrettably......I give up.

Thanks again
Title: Re: Behaviour Shield Questions
Post by: anjandavid on February 02, 2010, 02:26:34 PM
hello.

i have the same question what is the activity of behaviour shield?? previously i have occurred this in this forum. But i can't find any suitable answere..

thank u..

English is bad..sorry
Title: Re: Behaviour Shield Questions
Post by: Fract504 on February 02, 2010, 05:42:06 PM
I tried the keylogger test from http://www.zemana.com/DE/keylogger_test.aspx
and Avast 5 Behavior Shield did not detect anything nor showing any event in the statistics.
Maybe it does not detect keyloggers... Who knows... ....

I am not satisfied with the current information regarding that specific avast 5 component  :-\
Title: Re: Behaviour Shield Questions
Post by: 2nd base on February 02, 2010, 05:48:54 PM
I'm pretty sure it operates much like Winpatrol in the fact that it monitors changes to files on a computer. Now, whether it makes the user or Avast! or both aware of the change is questionable. If it allows or blocks any changes is also up for question as well, assuming that this is what it does. That's as close as I can come to it......
Title: Re: Behaviour Shield Questions
Post by: olddog on February 03, 2010, 09:04:28 PM
VLK, Igor, how about some input from you.
Title: Re: Behaviour Shield Questions
Post by: Derelict_AZ on February 04, 2010, 12:50:24 AM
I think it is being used to emulate an executable's behavior to determine if it is malicious or not. Because the activity is so low perhaps it is only called upon when the traditional checks done by the other shields is inconclusive. I think there are similar things being done in other vendor's recent products, for example F-Secure's DeepGuard.

Only the devs know for sure and their lack of response to any posts about the Behavior Shield lead me to think they want to keep it under wraps... at least for now.  :-\
Title: Re: Behaviour Shield Questions
Post by: Hermite15 on February 04, 2010, 12:58:20 AM
the thing is the BS activity (just quoting the devs here) depends on rule sets, and it's been already stated that for misc reasons there would be none yet for 64 bit OS's, so one could indeed question what's there for 32 bit OS's... may be not much either yet, which would explain the lack of activity observed by most users.
Title: Re: Behaviour Shield Questions
Post by: bri on February 05, 2010, 05:14:28 AM
so im using win 7 64 bit and i have avast 5 free installed,does the behvior shield work or not?if not thats a big let down as the behaviour shield is the big addon in the free version.it would be nice if someone from alwil would answer this thread?
Title: Re: Behaviour Shield Questions
Post by: Fract504 on February 05, 2010, 09:42:45 AM
If you need a 64bit behavior blocker use PCTools Threatfire for the time being.
Title: Re: Behaviour Shield Questions
Post by: Hermite15 on February 05, 2010, 11:10:51 AM
If you need a 64bit behavior blocker use PCTools Threatfire for the time being.

unfortunately, at least on my system, it was really slowing down the browsing, for some reasons  ??? no big deal, I still got CIS def+ and there should be a behavior blocker on top of that in CIS 4. We'll see how it runs.
Title: Re: Behaviour Shield Questions
Post by: Fract504 on February 05, 2010, 11:16:53 AM
Logos,
have you checked out the new build of Threatfire they just recently released? I had an issue with slow opening tabs in chrome and this was fixed, as well as other 3rd Party software problems.
Title: Re: Behaviour Shield Questions
Post by: Hermite15 on February 05, 2010, 11:17:54 AM
Logos,
have you checked out the new build of Threatfire they just recently released? I had an issue with slow opening tabs in chrome and this was fixed, as other 3rd Party software problems.

no I haven't, thanks for the heads up, I might give it a try ;)