Beta2 results after update or clean install over current Avast (Thrive)

[cooby]

Note: I changed my system to Android 4, and notes about Beta2_2 start in Reply#10

Beta version 2.0.2560 on rooted Toshiba Thrive, android HC DaleNet-Thrive-HTK55D.31.5.0002-OOM_Rooted_ROM-v1.2
Instead of doing a clean install I updated over existing copy and rebooted to see if my tablet survives.
I also did a clean installation - see notes in my last EDIT below.

First, the bad news and questions:
1. Something is wrong with Privacy display (also mentioned in this thread http://forum.avast.com/index.php?topic=101692.0)
Categories look like they show correct counts, but initially, when I clicked permissions, every category had 2 apps in it - Opera and Browser. Then, after using few apps, they all show GoogleSearch, yet the counts remain the same. Perhaps clean install will do better when I try it.
2. App management display can't be sorted by title. It doesn't bother me one bit, but the arrow is on the button
3. Network meter. I gather it's to show me which apps use the network and how much. What is MiB unit? Do those that use more than zero shift to the top? It's not clear, since I used bothe browsers and they didn't come up, and few other ones.
4. Firewall will log something blocked for few minutes after being asked to do so - am I understanding correctly? Does it mean it'll log bad stuff, and if in the next few minutes you hit something bad again, it won't log it? Anyway, I installed eicar, ignored the alert, went to see that log and it says "you have no history yet". Boy, it's the only way I can think of to make history. Please explain. Maybe I have to resolve it first?
5. I assume "Scan on installation" includes scan on updates.
6. Suggestion - could we group applications in the firewall by allowed and denied, please.
7. Is Message shield about phones only? I've sent and received mail using the mail icon and the scanned=0. If yes, can you add it to the title, in fact if something is only for phones it would be good to know in descriptions.

Secondly, comments
- Updating the current version didn't break my Thrive.
- All my application firewall rules were preserved.
- This is definitely an improved product, thank you
- GUI is awsome. I love the menus on the left, nice use of the enormous screen space.
- App management display is awsome. Sorting of columns is great. Graphs look great and much more useful than what the builtin job shows.
- By the time I opened Avast, the Shield control log reported 3 scanned apps. As I write it it moved to 14 then 18, 19, and it shows few URL checks. Cool.
- Memory use varies, so far up to 19meg and CPU from 0% to 3%, to a 33%max spike  that I saw for a moment, probably as graphs were being made.
- I haven't yet switched to whitelisting to reverse the current settings. This will be useful - much less to click.
- When updating two applications, both showed avast message about scanning after the two system messages about updating-updated, and installing-installed. Let's hope it does it always. Also scanned files count went up, but since it - doesn't list the just installed/updated filenames, I can't be sure the count refers to the updates or, say, going into the market/play store or scan of something else. I'll turn of scan on execution later to be sure updating is scanned here.

It's nearly flawless, thank you!

EDIT: Re point 1, above - I just looked again into Privacy lists. At this point every category contains the same 16 applications and the counts are the same as when I started.
EDIT2 - I added question#7
EDIT3 - Two scanner issues: With eicar still unresolved, I scanned all apps for the first time. Resolved eicar now. The red bar to resolve remained. So I resolved again. This time the message said "Do you really want to:" but no app name, I said yes. Exited Avast. Reentered, red bar was gone - so we're ok. Now I tried to see the Log of scans. Got a system message "com.avast.android.mobilesecurity has stopped unexpectedly.
EDIT4 - Clean installation makes no difference, Privacy-point1 above, is not ok, Virus removal Edit3 above, needs reenter Avast but no FC this time. I need to understand the firewall logging to be able to try whitelisting.

THE END, no more for today. It was fun

[reinhardholzner]

Regarding network meter: MiB is Megabytes. Yes the items shift to the top - did you select the correct category (Wifi, ...)?
Regarding firewall: it will only log stuff you BLOCKED. So you need to set up blocks to test it.

[svehlak]

Hi, thanks for the response.

Ad 1/ Yes, it is - only on tablets, where we have still some kind of little support. On the phones it works well. It will be fixed ASAP.
Ad 2/ I do not understand. You can modify the order.
Ad 3/ MiB is mebibyte, regarding new IEC standards; the renew interval should about 2 minutes and the order is done from biggest to smallest use.
Ad 4/ Firewall is only logging attempts done by application, which has some flag set into firewall; f.e. if you block the browser from WiFi an try to reach some URLs, the log will be showing all IP addresses grouping by application which called it.
Ad 5/ Yes, it does.
Ad 6/ I can suggest it.
Ad 7/ This shield works only for SMS. In e-mail messages are nothing scanned, but any possible URLs or attachments are monitored by web shield or virus scanner on execution time.

Thank you very much for your feedback.

[cooby]

2/ Yes, I can, but not by title, for instance in descending order. Other columns work. Just remove the little arrow on the Title button so nitpickers won't get you
3/ Got it. Also, Network meter is fine
Can you comment also on my Edit#3 about scanners?

4/ Firewall and its logging work great for blocked applications.
I used several applications and both browsers (built in and Opera) - typing url, using saved history addresses, using bookmarks, and using links in gmail were all blocked and reported in the log. Really impressive.
Opera specific comment: The only thing that was not, and only one, was an attempt to enter a webpage from Speed dial in Opera. These are, I suppose, saved pages which Opera tried to display. New York Times speed dial result was a text only format. Once a webpage opened, I was able to navigate the site for a while before blocked, which probably, maybe, who knows, should not be allowed. Then again, I think Opera updates something because it only happened on the first Speed dial use. Subsequent attempts are blocked.
4a. There is one bug: After I clicked the button on the log screen to look at Monthly the button title changed to Delete All, I was not able to revert back to Today even after exit and reentered Avast. See also 4b below.
4b. And a feature I do not like at all: When I added a rule to block another application, the log got cleared without any warning or perhaps save it in some text file. The button still says Delete All.

Notifications and counts about scanning while manually updating applications works well.

[svehlak]

Ad 2/ Now I see, ok, we can change it, though.
Ad Edit#3/ There is some issue only on tablet, we will fix it somehow.
Opera has built in proxy and we are not very aware how it works, but for sure it is not running by TCP/IP layouts, so yes, may be opera turbo and speed dial will not be blocked at all.
Ad 4a/ what are you talking about, Firewall or network Meter?
Ad 4b/ bug, will be fixed

Thanks,

H.

[reinhardholzner]

i do not think we can fix 4b as the syslog gets wiped in such cases i think.

[svehlak]

I do not think so, I mentioned it works on some devices. Anyway, cooby, we will let you know.

[cooby]

Thank you both.

My responses:
Re Ad 4a: User error I clicked Today button in Network Meter and must have quickly switched to Firwall logs where it always, I think, says Delete all. Sorry about that.

Re Opera: Jan, ignore the whole issue. I almost wish I didn't mention it since it only happens on the first use of site using Speed Dial. Speed dial is glorified selection of favorites where the image contains previously saved http webpage. It is not Opera Turbo. In any case,  Opera sends requests to its own server where it's checked for XSS, certificates, and other junk and reconfigured for very fast web page delivery. All OT at  this point. Avast was properly blocking just as it does for the stock browser and that's all that really counts.

And six requests:
- Some sort of saving of configuration, with timestamp in filename, would be useful, especially at a time like this when doing all sorts of silly switching and testing
- EXIT from GUI button. It's a pain to have to click backarrow 4-5 times.
- Firewall log display - it's a summary, but would it be possible to include remote ports as well? And an option to save log.
- Allow to rename Custom rule. "New Rule 2" tells me nothing.
- Detailed instructions with examples of useful Custom firewall use. I tried something, but small scale so far. Looks like inbound not needed in this OS, so we make outbound rules. Is SMB (Samba) considered internet? Is wild card allowed on IP? Is range of IPs allowed? Is a list of ports allowed?
- The little arrow for "more" on the right hand side of screen is grey on grey. Very difficult to notice it's even there. Can you change color, or make it into "more >"

[reinhardholzner]

Allow to rename Custom rule. "New Rule 2" tells me nothing.

=> you can click on the rule, at the top of the screen you see the name and you can change it there

- Detailed instructions with examples of useful Custom firewall use. I tried something, but small scale so far. Looks like inbound not needed in this OS, so we make outbound rules. Is SMB (Samba) considered internet? Is wild card allowed on IP? Is range of IPs allowed? Is a list of ports allowed?

=> its quite simple. wild card, range or list is not allowed

[cooby]

Allow to rename Custom rule. "New Rule 2" tells me nothing.

=> you can click on the rule, at the top of the screen you see the name and you can change it there

Partly user error - I was trying to edit when the rule was ACTIVE. Keyboard wouldn't come up. Once made INACTIVE editing works.

- Detailed instructions ...

=> its quite simple. wild card, range or list is not allowed

OK.

[cooby]

Just a small update, though not from first hand experience. A friend has Thrive, now updated to Android v.4.0.4 (ICS), and apparently Avast beta2 is working just fine, indistinguisheable from our observations on Thrive under Android 3.2.1.

[svehlak]

It is good news, but still, can you please try it on your Thrive? Your report is very exhaustive and very helpful for us. Thanks.

[cooby]

Ok, Jan, here you go. With every passing hour on Avast, this is getting sillier and longer and longer, considering how many features Avast has ... so I better stop. Hope you don't fall asleep.
The person who told me it works tests more thoroughly than I ever could

My current system changed since the first post.
Avast Beta2 version is now v2.0.2709.
Android 4.0.4, ICS, on Toshiba Thrive, rooted ROM from
http://www.thriveforums.org/forum/dalepl/13661-rom-dalenet-imm76d-01-000072314-deodexed-stock-rooted-rom-us-ics-4-0-4-a.html

Review of items mentioned in the first post and answered, earlier, in subsequent posts:
1.  No issues. All lists look ok to me. I downloaded, updated, deleted, added applicatons and see no issues. But there is a possiblity of something wrong, please see http://forum.avast.com/index.php?topic=101692.0
I really like the views/details per application when I click the nearly invisible(!!!) ">".
2.  All columns can be sorted now on the apps list.
3.  Network meter numbers for Month and Today do differ so it's probably fine.
3a.  I don't understand some groupings - grouped by vendor? Seems to be so since Dolphin is with 2 apps (I just installed it yesterday) up top, and Ghost Commander has its group of 2 at the bottom of the list, and MX player also is in a group of 2.
3b.  This part of GUI is not very easy to use. Is there a way to SEARCH? If I was serious wanting to know about a specific app, how do you get to it quickly?
4.  Firewall - No flaws, works as advertised, but see requests in new point below and one bug.
4a.  was my error
4b.  Not fixed. The firewall log does clear after adding an app rule or custom, and after change of custom rule. I kind of understand why since timestamp not displayed, but it would be good to be able to retain the log for review
5.  is ok
6.  Looks like the idea to group allow/deny apps didn't make it to Beta2-2
7.  is ok, understood
Edit3  issue of display after resolving - fixed

From the previous Six Requests section (post#7). I wish I numbered them, so will now to make answering simpler.
9.  Save configuration - not done or I haven't found it.
10.  Exit button - not done
11.  Firewall log display - No change,  still need to see the remote port in the log, at least when it's not to ports 80 or 443. Also, shouldn't firewall log display timestamp?
12.  Custom rule naming - works fine
13.  Need instructions and need more firewall custom rules features, such as IP range or CDIR and domain options in addition to IP. I do see the answer from reinhardholzner, boo! hoo! Or maybe a new way where we can list where updates are allowed to come from. All this can get messy.
14.  Invisible arrow on the right to details - Not changed. It is important that the arrow be more visible Half the time I don't know if detail view is there or not.

New feature requests:
15.  At least notify of an application aggressively pushing ads and make a text file with the domain names. This is in reference to
the discussion in another post:
http://forum.avast.com/index.php?topic=103243.0
I suppose it might be rough, since many legitimate, free, apps have few ads, but as discussed in this thread, competition clearly did see a distinction and never alerted about other apps.
16.  We need exclusions for scanning a large SD card. At least to exclude home pictures and movies and legit mp3 files, perhaps even nandroid backups.
17.  I don't suppose there's a way to request a rescan of one application - perhaps something like it could be added to the Apps menu item? Similar to scan from the context menu in Windows.

Small BUG:
18.  Firewall custom rule allows entry of several IPs, but then says "IP address is invalid" - in that case the text box should not be allowed to expand, IMO. That said, a rule to deny routerIP:80 or avastIP:80 did just that, with unsurprising result

Just general observations:
- I like that the firewall shows me only WiFi Icon and not the ones that are inapplicable to the Thrive. Don't know what would happen if I had Bluetooth or some other tethering.
- The avast icon in notification is now aligned, a lot of people were upset about this one.
- Scans of updating etc continue working fine, count in the virus scanner log continues not increasing when update an app.
- Avast updates come in fine.
- Scan of internal and external SD card work fine.
- CPU Wakelock continues to work fine
- Battery use - no impact in 25 hours as reported in Settings. Screen, browsers and OS are the only ones of significance.
- Works fine with Kindle books, browsers, snoping root things, wifi monitors, filesharing, hosts file, screenshot, Titanium Baskup, youtube videos, newspapers, posting on forums ... just no interference that I can see with my applications.
- In 2 days of use, I see avast using 0, 1, at most 2% cpu (higher right after scan), 15-21meg Memory.
- Expected slight drop in speedtest.net result for both down and up: 4.8/1.9 - I pay for 5/2 (optical).  Sometimes it's 5.2/2.3, go figure.
- No system issues of waking up, not waking up, or loosing WiFi (yet!)

Untested, mostly due to my settings:
Since Thrive only has WiFi mode, 3G and Roaming aren't for me.
Like in Windows, nothing updates automatically, all after review of Google suggestions.
I do not have PIN protection checked.
PUP detection is checked, but I haven't hit any yet, so just trust it'll do the job.
I do not schedule scans here, or in Windows, so untested.
I am not connected to any avast account.
I do not have Permissions denied, so cannot comment on an earlier observation, and discussion ,of discrepancy here:
http://forum.avast.com/index.php?topic=102091.0

Can't play with Phone-related items:
I do not have SMS so can't check if Message shield counts are ok.
I do not have AntiTheft section installed, others have to comment on that entire section including removal.
But one Thrive user reports, I think, that has AntiTheft installed on this tablet - so should we or should we not install?
http://www.thriveforums.org/forum/toshiba-thrive-apps/13166-avast-mobile-beta2-out-6.html

[svehlak]

Thank you very much, some of the proposals will be considered to the next program update. Now is AMS 2.0 public on the Play, so in case of any other issues please report to the non-beta forum.