Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: DarkMasters on January 04, 2011, 07:33:53 PM

Title: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 04, 2011, 07:33:53 PM
I'm using Windows 7 64-bit and updating Avast Free 5.0.667 (clean install on this version) to the latest 5.1.864 through GUI. Restarting my computer after the update and still see the old version number in Avast GUI and Windows Programs and Features (Control Panel). I try updating it through GUI again and it says it's already updated. Then, I noticed problem with all shields component which shows 0/0 at scanned/infected. Searching this forums and I repair Avast installations using Programs and Features in Control Panel. Restarting my computer and all seems OK (the version number and all the shields).

I do a small test by inserting DVD which contains harmless (music, video, pictures, document, etc) and malware (old and new viruses, trojans, dialers, keyloggers) I've found from internet and other sources. Avast 5.0.667 warn me in an instant the moment I open the folder which contains harmless and malware infected files which means the File System Shield warn me about the existence of this malware on access basis. However, the new version didn't do this.

Perplexed by this, I try to to scan the folder and Avast did find the malware though it missed two infected files (virus kind) which recognized before by the 5.0.667.

I try to copy the malware and malware infected files to my hard drive. Avast warn me and seems to delete the virus and dialers upon arrival (which shows by file with 0 kb size at destination folder), though it missed all trojans and keyloggers. I never tried this before with Avast 5.0.667, so I can't say much about this.

I can't test whether the Network Shield and Web Shield running OK, since I don't want to risk it with unknown dangers (it seems to scan all my web activity and I did try the eicar site, but who knows?).

So, can anyone confirm about this? I'm wondering because I'm going through a bad update.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 04, 2011, 07:37:42 PM
Oh, I forgot to mention that I set all Avast Shield and scans to highest sensitivity and to scan for PUP.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: olli_av on January 07, 2011, 12:12:21 AM
Hello DarkMasters!

Excellent Observation  :o - I'm too using Win7 x64 - updated via GUI from 5.0.677 to 5.1.864 and noticed that the on-access FileSystem Shield ceased functioning. No spinning tray icon and the statistics graph shows zero activity since the update (Web Shield is OK btw.)

I sent a screenshot and problem description to the GERMAN avast support (because this is my native tongue) and I hope they go into this matter. I can tell from the answer so far that german isn't their preferred language. So an english Q would sure be helpful :)

I also strongly encourage you AND everyone else affected to write to the avast support team. I'm pretty sure there are many like us but not all will notice that fact because there is no error message whatsoever and one has to look at the avast built-in statistics function for the FS Shield to see.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Asyn on January 07, 2011, 12:19:10 AM
Please try this: (Sollte deine Probleme lösen...)
Free AV: http://files.avast.com/files/beta/5.0.874/setup_av_free.exe
Pro AV: http://files.avast.com/files/beta/5.0.874/setup_av_pro.exe
Internet Security: http://files.avast.com/files/beta/5.0.874/setup_ais.exe
asyn

Übrigens, der deutsche Forenbereich ist hier: http://forum.avast.com/index.php?board=24.0
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: olli_av on January 07, 2011, 12:27:11 AM
Hallo Asyn,

ich installier' mir sicher keine BETA von einem av-Tool. Weiters will ich schon über die GUI updaten (inkrementell) und nicht komplett drüber bügeln. Ich hoffe halt nur dass die avast Leut' den Fehler auch bei sich reproduzieren können!

english short: NO betas ;D

olli
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: YoKenny on January 07, 2011, 12:31:08 AM
No problem on my Windows 7 system 8)

The beta works well for me  8)
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Asyn on January 07, 2011, 12:31:29 AM
english short: NO betas ;D
olli

Hi olli,
it's not really a beta, it's a fix for the problems with 5.1.864... ;)
http://forum.avast.com/index.php?topic=68927.0
But it's up to you, if you want to install it.
asyn
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: olli_av on January 07, 2011, 12:47:07 AM
@YoKenny: well, good for You. I'm not so lucky - see shot

@all: that shows, once more for me, waaiiiiit some time for an amended version if important sw gets a (major) update if You dont want time eating troubles! :P
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Asyn on January 07, 2011, 12:50:24 AM
@all: that shows, once more for me, waaiiiiit some time for an amended version if important sw gets a (major) update if You dont want time eating troubles! :P

I can only repeat: That has already been fixed, please use the links I provided...
asyn
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Charyb on January 07, 2011, 12:58:35 AM
Why don't you send the virus samples to Virus Total to see what turns up? Also, are these trojans zipped? Avast won't scan these if they are zipped unless you change the settings in the file shield. Once they are extracted Avast will scan them.

http://www.virustotal.com/
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: olli_av on January 07, 2011, 01:01:47 AM


I can only repeat: That has already been fixed, please use the links I provided...
asyn


And I can repeat only too: build 874 is not final yet - so its still BETA with maybe more/other bugs in it. AND its not available via GUI! Thats why I'll wait and would be better off if I never had updated early. Sorry
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Vlk on January 07, 2011, 01:06:16 AM
oli_av, for your information, the problem you're describing is not in build 864 itself, but instead in the update process from 5.0 to 5.1.

Please go to Control Panel -> Programs and Features -> avast Antivirus and use the Repair option. Then reboot the computer and hopefully, the problem will be solved.

Thanks
Vlk
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: olli_av on January 07, 2011, 01:17:35 AM
oli_av, for your information, the problem you're describing is not in build 864 itself, but instead in the update process from 5.0 to 5.1.

Please go to Control Panel -> Programs and Features -> avast Antivirus and use the Repair option. Then reboot the computer and hopefully, the problem will be solved.

Thanks
Vlk

Dear Vlk,

thank you for this Information! Can You please answer me the following Q (for my understanding)
- what exactly happened during the update process that results is this discribed behavior?
- is everyone effected who updated via GUI?
- what exactly does the repair process do (to the installation) which has the potential to
cure the symptom?
- can you estimate when the next final version of avast will be available via GUI

thanks
olli
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 07, 2011, 01:22:02 AM
Still no confirmation about mine?

Well, I do a clean install of Avast 5.1.864 (that's before I know there's a new fix) and all the shields seems to work fine except that one problem I mention above about there's no warning from Avast when I open folder which contains malwares (the old 5.0.677 warns me about this), and I still can copy all the trojans and keyloggers without any interception from Avast.

Anyone got any idea about this? I'm thinking about doing clean install of the old 5.0.677, but I like the 'now working' behavior shield and boot-time scan.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Charyb on January 07, 2011, 01:24:32 AM
Will you read my post above and comment on it? I would like to see if Avast as well as other scanners are detecting it at Virus Total. And would like to know if the files you are copying are zipped.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 07, 2011, 01:45:56 AM
Why don't you send the virus samples to Virus Total to see what turns up? Also, are these trojans zipped? Avast won't scan these if they are zipped unless you change the settings in the file shield. Once they are extracted Avast will scan them.

You're right about the trojans and keyloggers are in a zip file and my file system shield settings for packers is at it's default (self-extracting executables, droppers, and NTFS streams). Thanks, that explains about copying.

However, I'm still wondering about on access scanning thing since most of the viruses and dialers are in executable form (not zipped) and I know that the old version of Avast warns me when I open the folder containing this files while the new version didn't do anything.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 07, 2011, 02:02:20 AM
Will you read my post above and comment on it? I would like to see if Avast as well as other scanners are detecting it at Virus Total. And would like to know if the files you are copying are zipped.

Most of the malware samples in my DVD are things which I collect from internet by using Linux and scanning it in Linux, cleaning my friends computer, and from internet cafe. Any security products such as Norton, McAffee, ClamWin, Malwarebytes, SUPERAntiSpyware, Security Essentials, Avast recognize it as virus, trojans, etc.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Charyb on January 07, 2011, 02:07:51 AM
Why don't you send the virus samples to Virus Total to see what turns up? Also, are these trojans zipped? Avast won't scan these if they are zipped unless you change the settings in the file shield. Once they are extracted Avast will scan them.

You're right about the trojans and keyloggers are in a zip file and my file system shield settings for packers is at it's default (self-extracting executables, droppers, and NTFS streams). Thanks, that explains about copying.

However, I'm still wondering about on access scanning thing since most of the viruses and dialers are in executable form (not zipped) and I know that the old version of Avast warns me when I open the folder containing this files while the new version didn't do anything.

What happens when you right click scan the virus files and dialers? The thing is you are opening the folder but not yet accessing the file.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 07, 2011, 02:15:50 AM
What happens when you right click scan the virus and dialers?

Avast do recognize it. But, what I'm trying to say is the 5.0.677 warns me when I open the folder which contains this files eventhough I'm not scanning the folder, while the new Avast didn't do it.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Charyb on January 07, 2011, 02:26:18 AM
There is no way I can answer this. I don't know what defaults have changed in the scanning process if any. Maybe someone else will have the answer to this. It seems to be scanning properly as far as I understand it.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 07, 2011, 02:43:55 AM
Yup, you're right it does scanning properly. It's only one different behavior, it's quite matter though. Before this, I thought it's because of the bad update process. Now, I've install it clean and it's still the same which means either I accept it or rolling back to the old version.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 07, 2011, 02:45:34 AM
Though, I'm still hoping there's someone who can confirm me about this...
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: Charyb on January 07, 2011, 03:42:21 AM
Yup, you're right it does scanning properly. It's only one different behavior, it's quite matter though. Before this, I thought it's because of the bad update process. Now, I've install it clean and it's still the same which means either I accept it or rolling back to the old version.

I wouldn't go back. Unless it is a new behavior that you completely dislike. Something may have changed for you but that doesn't mean it isn't a better product. Avast keeps getting better and better with each new release.
Title: Re: Is this how Avast 5.1.864 File System Shield suppose to work?
Post by: DarkMasters on January 07, 2011, 10:29:27 PM
Yeah. You're right. I do like a new behavior shield and the boot-time scan which now working. It's quite useful in case I got my system compromise.