Avast 5 ashquick.exe

[PudgyOne]

When I use Flashget, I have it scan the downloaded file with Ashquick.exe

This worked great with Avast 4.8 I have it set for Avast 5 but I do not see it scan the downloaded file, anymore. It uses to show a popup window showing it scanning the file but not with Avast 5.

Am I looking at this wrong. I felt safer knowing that it was scanning the downloaded file, even though I did trust the downloaded file from file hippo.


Rick

[DavidR]

You will only see something if there is a detection, try downloading one of the eicar.zip test files using https in the eicar.org site, see below. Using https means the web shield won't get in the way and by using one of the eicar.zip files the file system shield won't scan it by default; so only ashQuick.exe called by flashget should be doing the scan.

http://www.eicar.org/anti_virus_test_file.htm

[PudgyOne]

DavidR,

I was allowed to download the eicarcom2.zip using Flashget and I had no detection that the file had a virus.

It's like Avast 5 ashquick.exe is not working.

I did try eicar com.zip and before the download, Avast warned.


Rick

[DavidR]

I think that the first one you tried is a double zipped option and I don't believe the ashQuick scan would go down into the second zip file.

[PudgyOne]

DavidR,

It scanned it and tole me threat detected but...

It left the file on my desktop. It did not put in the virus chest.

So I have a threat on my desktop, not really but it really could be one. I don't think it works as well as askquick in Avast 4.8


Rick

[DavidR]

I can't currently test it as I don't have a download manager installed that can call ashQuick.exe.

The main point is that you are at least aware of it, I don't know if this is just because it is a zip file, which is inert and not a direct threat or not. Archive (zip, rar, etc.) files are by their nature are inert, you need to extract the files and then you have to run them to be a threat. Long before that happens avast's File System Shield should have scanned them and before an executable is run that is scanned.

For other files which do present a higher risk the file system shield would also scan and alert to the infection for newly created (which a download would be) or modified files.

These files aren't viruses but a pre-defined format that all anti-virus applications recognise and it used to test the alert, e.g. the AV is working as it should in certain instances.

[PudgyOne]

DavidR,

It allowed me to download the file from the SSL server. When I extracted the files to the desktop, it moved them to the chest.

I do download some files from file hippo and major geeks that are program updates. Avast has, on occasion, found a virus/malware in the downloaded files. I just wish that Avast 5 showed the screen scanning the file, like Avast 4.8 did.

I really like the real time scanner Avast uses and tell others about this.

Thanks for helping me through this. Like I said, seeing this change confuses me more than it did when Avast 4.8 scanned each file for me.

Thanks again,


Rick

[DavidR]

You're welcome.

Yes it will, as on the SSL server the web shield won't scan and alert (that is why I said to use SSL) so you would never get to test the ashQuick.exe scan.

That is the purpose of the resident, on-access scanner to sweep up when you create a new file as in the extraction, avast will scan it before it is actually saved (creation/on-access).

The files that you download from file hippo are less likely to be multiple packed files but an executable installation file which will be scanned by the ashQuick.exe and quite probably by the web shield (Intelligent stream scanning) function also. So there would likely to be two bites at that cherry, before the fall back of the file system shield.

So with this multi level approach you are unlikely not to have a file scanned before you try to execute it.