Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Jack 1000 on February 24, 2012, 08:07:05 PM
-
Hey Guys,
1.) On Avast 7, what features/settings can be changed in the Cloud through the GUI?
2.) How does the Cloud work to avoid server overload, since Avast Definitions are now released when available?
3.) Will the instantly available definition updates, also apply to Program updates in the Cloud when new program versions are released? Will update options be able to be modified/turned off in settings?
Jack
-
1. Enable/Disable.
2. It's very small and does not overload the servers even with million of users. The infraestructure will grown if/when necessary.
3. They're applied instantly.
-
In the settings menu, you can chose to disable and enable two features related to cloud services. I turned off both. They seem pretty pointless to me.
-
In the settings menu, you can chose to disable and enable two features related to cloud services. I turned off both. They seem pretty pointless to me.
Thanks!
If you disable cloud services, than does Avast go back to the traditional 4 hour check for updates schedule like in previous versions?
Jack
-
They seem pretty pointless to me.
Pointless? They're a major security protection to zero-day malware of avast 7.
-
If you disable cloud services, than does Avast go back to the traditional 4 hour check for updates schedule like in previous versions?
Yes. Or any other lesser interval you've set into avast settings.
-
Pointless? They're a major security protection to zero-day malware of avast 7.
The reputation services or the streaming updates? How exactly does it work then?
-
The reputation services or the streaming updates? How exactly does it work then?
Both.
Reputation checks prevalence and emergence of executable files. Rare files and very new ones (that nobody has around the world) could be zero-day malware signal.
Streaming updates are more frequent and smaller than the common updates and will release the updates almost just in time to protect you.
-
Reputation checks prevalence and emergence of executable files. Rare files and very new ones (that nobody has around the world) could be zero-day malware signal.
Streaming updates are more frequent and smaller than the common updates and will release the updates almost just in time to protect you.
I can see how the first one can be useful, but I still see no point for the second one. I mean I'm still getting the same signatures right? It just keeps the program working non stop to download data which it would acquire anyway in just a few hours.
-
The streaming update works over and on top of the normal updates.
-
Pointless? They're a major security protection to zero-day malware of avast 7.
In what way? Tying people to the cloud so that their machines are used as instrumentation to look for newer malware versions/tactics theoretically could result in more rapidly improved periodic updates. If the periodic updates are promptly and fully improved to reflect the knowledge gained by avast's cloud, even a user running without avast cloud related features enabled would still fully benefit once they've received their next update. IOW, there would seem to be just one n-hour window during which that user would be vulnerable and only if they happened to download some brand new malware that had just been recognized by avast's cloud.
I don't know if I'm communicating the idea well, but what I'm trying to distinguish between is cloud enabled improvements to knowledge of malware vs cloud enabled improvements to detection of malware once that knowledge is gained. For many professionals, the cloud related features are just too much of a security/privacy issue and *cannot* be enabled *ever*. A short n-hour window of potential vulnerability to only bleeding edge malware certainly wouldn't be desirable, but that would be acceptable.
-
Even a user running without avast cloud related features enabled would still fully benefit once they've received their next update.
Sure. 4 hours later. Streaming updates will rise to 20 updates a day...
IOW, there would seem to be just one n-hour window during which that user would be vulnerable and only if they happened to download some brand new malware that had just been recognized by avast's cloud.
Yes... and these few hours would be enough for some (or many) computers to get infected.
I don't know if I'm communicating the idea well, but what I'm trying to distinguish between is cloud enabled improvements to knowledge of malware vs cloud enabled improvements to detection of malware once that knowledge is gained.
It does both.
For many professionals, the cloud related features are just too much of a security/privacy issue and *cannot* be enabled *ever*.
If file uploads is involved... maybe. But what more could be a privacy issue?
-
The streaming update works over and on top of the normal updates.
Does that mean if I disable it, there are signatures I WON'T be receiving? I really hope I misunderstand because that would make no sense.
-
If I understand, for Avast to be efficient we shoud stop to run other anti-malware on our PC ?
-
IOW, there would seem to be just one n-hour window during which that user would be vulnerable and only if they happened to download some brand new malware that had just been recognized by avast's cloud.
Yes... and these few hours would be enough for some (or many) computers to get infected.
Some or many at the world level though. The probability of many computers on earth being infected during such a "vulnerability window" could be 100%. However, the probability of "the average computer" falling victim to that would be much lower I think. If we're talking about a cautious user or admin who disables automatic updates (the installs, not the notifications of availability) and is careful about what they install and from where and when, I think the probability would be much much much lower. I seriously wonder if it would even register as a threat worth worrying about.
I don't know if I'm communicating the idea well, but what I'm trying to distinguish between is cloud enabled improvements to knowledge of malware vs cloud enabled improvements to detection of malware once that knowledge is gained.
It does both.
If by that you only mean the more frequent, "streaming updates" would count as "improvements to detection of malware once that knowledge is gained." because they would narrow the window of vulnerability then we are on the same page. If you are (also) trying to communicate that it isn't just a matter of how large the window of vulnerability is, I'd welcome clarification. For example, as BTIsaac just questioned, if some malware signatures/descriptors are only distributed when the cloud features are enabled that is a very important detail.
For many professionals, the cloud related features are just too much of a security/privacy issue and *cannot* be enabled *ever*.
If file uploads is involved... maybe. But what more could be a privacy issue?
Yes, the uploading of information (whole files, piece of them, hashes of them, file names, URLs, hostnames, whatever) is the key concern I was referring to. However, as the OP touched upon (and I don't think this part was explicitly answered by anyone), a related concern would be pushed changes to the software program and/or its settings. The conceptual idea being, that pushed "malware definitions" can't really put the target machine at risk (the common belief, maybe true maybe not) whereas pushed changes to the program and/or settings could (and thus need to be tested or at least sanity checked somehow).
-
Cloud services are so buggy... They stop after u put ur laptop to sleep.. .. I am so pissed
-
Cloud services are so buggy... They stop after u put ur laptop to sleep.. .. I am so pissed
Please keep to the thread you already started>>http://forum.avast.com/index.php?topic=94078.0
-
On my Avast GUI,
It shows Streaming Updates Enabled
Connection Established
Last Update Received just has________________
Seems the cloud is connected. Since this afternoon, I got one definitions update between 4-5 I think, and the GUI seems to be checking every 4 hours like It always has. So I guess my question is:
If the cloud stuff is working and Avast says it is, what am I going to receive in the "Last Update Received" ____________?
Is it right that when I get the next "Your Virus Definitions Have Been Automatically Updated." pop-up that I should see some data in the last update received information?
Looking for the specific difference between the time interval updates and the cloud updates? (And similarities too.)
Jack
-
If I understand, for Avast to be efficient we shoud stop to run other anti-malware on our PC?
That's pretty much commojn sense for all anti-malware. Having more than one running causes all sorts of problems and not just with Avast.
-
Does that mean if I disable it, there are signatures I WON'T be receiving? I really hope I misunderstand because that would make no sense.
You'll receive all signatures later.
-
Cloud services are so buggy... They stop after u put ur laptop to sleep.. .. I am so pissed
??? Do you want the computer work when your computer is turned off (or sleeping)? ???
-
Some or many at the world level though. The probability of many computers on earth being infected during such a "vulnerability window" could be 100%. However, the probability of "the average computer" falling victim to that would be much lower I think. If we're talking about a cautious user or admin who disables automatic updates (the installs, not the notifications of availability) and is careful about what they install and from where and when, I think the probability would be much much much lower. I seriously wonder if it would even register as a threat worth worrying about.
avast! is doing exactly that: reducing the probability and increasing protection.
If by that you only mean the more frequent, "streaming updates" would count as "improvements to detection of malware once that knowledge is gained." because they would narrow the window of vulnerability then we are on the same page. If you are (also) trying to communicate that it isn't just a matter of how large the window of vulnerability is, I'd welcome clarification. For example, as BTIsaac just questioned, if some malware signatures/descriptors are only distributed when the cloud features are enabled that is a very important detail.
All the signatures will be released in the normal updates, just later than the streaming updates.
Yes, the uploading of information (whole files, piece of them, hashes of them, file names, URLs, hostnames, whatever) is the key concern I was referring to.
How they would manage or public this information is the key. ALL information is taken annonimously.
-
Cloud services are so buggy... They stop after u put ur laptop to sleep.. .. I am so pissed
I have already explained this in some other thread, possible even to you. The cloud connection will re-establish when you wake up the computer. It's physically impossible for avast! to be connected to anything if the system is shut down or sleeping, don't you think?
-
On my Avast GUI,
It shows Streaming Updates Enabled
Connection Established
Last Update Received just has________________
Seems the cloud is connected. Since this afternoon, I got one definitions update between 4-5 I think, and the GUI seems to be checking every 4 hours like It always has. So I guess my question is:
If the cloud stuff is working and Avast says it is, what am I going to receive in the "Last Update Received" ____________?
Is it right that when I get the next "Your Virus Definitions Have Been Automatically Updated." pop-up that I should see some data in the last update received information?
Looking for the specific difference between the time interval updates and the cloud updates? (And similarities too.)
Jack
Shortly after I turned on my machine this morning, I received the update 120225-0 applied at 7:58 AM EST US. I also have a 12022500_stream folder with a time of 8:01 AM EST US with a 19KB BIN file inside. Obviously, there was a streaming update shortly after the standard VPS update. "Last Update Received" ____________ is shown under Maintenance | Update in the AvastUI for the streaming update. I haven't restarted Windows yet this morning, but it will likely show the streaming update in the AVastUI then.
Edit:
I did a manual VPS update check around noon and then restarted Windows. After restart, "Last Update Received" reflected the last streaming update I'd received at 8:01 AM mentioned above.
-
If I understand, for Avast to be efficient we shoud stop to run other anti-malware on our PC ?
Not necessarily,many of us run Malwarebytes Pro alongside Avast,you just need to be sure that your other application and Avast do not conflict with each other, that is what exclusions are for.
-
Yes, the uploading of information (whole files, piece of them, hashes of them, file names, URLs, hostnames, whatever) is the key concern I was referring to.
How they would manage or public this information is the key. ALL information is taken annonimously.
One one hand I agree with you that how avast actually manages such information is key. On the other hand, I must be honest with myself and admit that I will never know enough about avast corporation, its employees, its relationships with government agencies, etc to be able to assess how they really handle the information they receive. Not even just once, let alone on an ongoing basis. That concept applies almost universally and to every single entity that develops the software I use (I'm not singling out avast at all). I have assisted in the investigation of security breaches and like events, and know that many are not appropriately reported. So I can't assume that I'll learn of something important even though I really do make an effort to keep up with such topics. Lastly, and as a fairly well rounded SW Engineer, I spent a great deal of time researching, discussing, and thinking through the myriad of ways in which information can be correlated with other information. I arrived at a conclusion and philosophy quite some time ago: that any packets (and the information contained within) that leave my network with one of my public IP Addresses are not anonymous in any meaningful reliable sense. So even if absolutely nothing was transmitted to avast servers except my (non-static, but still somewhat sticky) IP Address and the hash of a file, I would not consider that to be "anonymous". Theoretically speaking, avast server's might not even log/use the IP Address for anything but because I can never know if that is true I think it best not to assume it.
Some are in the binary "you either trust or don't trust XYZ" camp. I'd say I'm in the "it isn't about trusting, it's about eliminating where possible the need to trust" camp. By that I mean I endeavor to keep my software set to a minimum and also (not|un)install, block, limit, etc specific components and features that might transmit sensitive information so that I don't have to trust other parties to handle the information in accordance with my preferences.
-
I got my regular 4 hour interval update. However, cloud services although they are activated, still show no time that any cloud data has been received.
Jack
PS. I don't have Webrep installed and have a secure Wireless Network.