System Shield Sensitivty

[justinlee]

Having read a comment from another topic someone stated their system and internet speed slowed down after setting each shield sensitivity from normal to high.

I have always set mine to high and have never found problems in system speed or internet speed from doing this.

Is setting the shields to high overkill?

[CraigB]

Avast set's these shields like so for a reason, they have alot more knowledge about how these work than we ever will so I tend to leave well enough alone that being said the only shield I do increase sensitivity on is the webshield set to high.

[DavidR]

I too have always set Heuristic sensitivity to High for the File System Shield and Web Shield and use code emulation (not sure if that is a default or not), plus the web shield scanning for PUPs and no adverse effect at all.

[CraigB]

Code emulation is ticked on by default David, I also tick the pups on for web shield.

[justinlee]

Personally, I set ALL shields to high and tick PUPs for all shields. Avast set all heuristics to normal sensitivity, but the fact they allow you to change this to either low or high suggest that they want to give their users the preference. Don't see how setting to high would affect internet or system speed.

[waking]

Personally, I set ALL shields to high ...
Don't see how setting to high would affect internet or system speed.

Generally speaking, setting heuristic testing to high in any AV
can increase the possibility of getting false positives. Also,
the testing of an object - such as a Java script - will usually
take longer thus possibly slowing throughput.

In another top-rated AV product, if I set the heuristics to
Medium in the File AV component some .js files will cause the
CPU usage of that scanner to hit 99% for a considerable length
of time. Setting it to High can cause 99% cpu usage for many
seconds or a few minutes. This causes the browser to freeze for
an extended period of time when it encounters certain scripts
on some web pages until the heuristic testing is complete. With
the file AV heuristics set to Low in that AV product this delay
is avoided. So the level of heuristic testing can indeed impact
throughput speeds - at least in some AV products.

[schmidthouse]

I too have always set Heuristic sensitivity to High for the File System Shield and Web Shield and use code emulation (not sure if that is a default or not), plus the web shield scanning for PUPs and no adverse effect at all.

I also have had these shields set to high with scan PUPs in Web Shield on both my systems.

[DavidR]

@ waking
Never seen any of the points you mentioned when using avast, so perhaps not what some other AVs find or what may happen. I based my response on what I actually find in having used avast for almost nine years.

The major drawback when setting to High heuristic sensitivity is one of performance (FP instances generally being low), so with a half decent system performance isn't going to be an issue. But that is why avast don't set it to High heuristic sensitivity to ensure a good balance between performance and protection on an average system.

For those with recent systems (even three to four years old) and avast striving to keep resource use to a minimum, this shouldn't be an issue.

[justinlee]

DavidR, your answer makes sense.

I have contacted Avast technical support for a definitive answer and will post their response here once I receive.

As said, I have always set ALL shields to 'high' and have never found a problem with internet/system speed, but that being said if I set them all to 'normal' I may well notice an improvment in internet/system speed.

[justinlee]

As promised here is Avast's response. I would have liked a little more detail, but hey it answers the question...

"Normal sensitivity is usually the most suitable selection for all users. I would recommend you to choose this one."

[DavidR]

I didn't think that you would get any more detail as they would have to know a lot more about your system, your browsing habits and user experience to give a detailed answer. For the majority of avast users the default settings are the best balance between protection and performance.

Whilst I have all my shields at higher sensitivity (where they have that setting) I also have all shields set to Ask as the first action, I don't allow autonomous actions.

The higher any heuristic settings is the more likely the user is going to have to answer questions about software on their system or get an alert on a heuristic based detection. If they can't/don't have the knowledge to deal with that then it is possible they could be sending a utility/tool to the chest.

So it rather depends on if you consider yourself an experienced user capable of answering questions on what is installed on your system and you have a system capable of handling increased activity, then the choice is yours, to stick with defaults or to increase the sensitivity, etc.

[justinlee]

@DavidR - I hear what you're saying and I would consider myself more than capable of differentiating between a genuine threat and a false positive. To be honest with all my shields having been set to high since I started using Avast for the past few years it has been rare for me to get false positives, although it has happened here and there.

So, may I ask why you personally choose to have all your shields set to a higher sensitivity (where they have that setting)? For me it's peace of mind.

[DavidR]

Mine is more I want to know what is going on within my system and I also want control over what action is to be taken. That is why I have my shields set to ask as the first action and no action if the first fails (which it shouldn't).

In all of the time I have had my settings that way I have had very few hits where I get an alert window and I can't recall an FP. Though that distinction is becoming blurred when you have reputation based alerts in the behavior, web shields and autosandbox. Which based on the file being relatively new giving it a low reputation is something to treat with suspicion, can't really be considered an FP if it happens to be pinged, just caution.

[RejZoR]

I'm always using High settings for all the shields and scan tasks...

[true indian]

Mine is defaults apart from PUP scan is on in file shield and behaviour shield set to ask..nothing else changed