Author Topic: different shields: which are the "smart" ones?  (Read 3304 times)

0 Members and 1 Guest are viewing this topic.

Theblob

  • Guest
different shields: which are the "smart" ones?
« on: April 19, 2013, 04:27:01 PM »
so theres file shield, web shield, this shield & that shield  ;D

so I just wanna know, which of these shields are really useful ie. use heuristics or some other "smart" feature (as oppose to just checking with database of known stuff)

I know file shield does obvously, but what of the other ones?

I ask this cause I just wanna keep these shields on, and turn off the other less useful shields (those that ain't "smart") to save more ram since I got limited ram
« Last Edit: April 19, 2013, 05:35:04 PM by Theblob »

Offline Para-Noid

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6700
  • Trust only what you test yourself!
Re: different shields: which are the "smart" ones?
« Reply #1 on: April 19, 2013, 04:53:00 PM »
Each shield is important on account of what they protect. Personally I do not install P2P nor the IM shields as I never download torrents and never use instant messaging. For more information please consult the areas highlighted in the screenshot under the "support" tab on the GUI.  :)
Dell Inspiron, Win10x64--HP Envy Win10x64--Both systems Avast Free v17.9.2322, Comodo Firewall v8.2 w/D+, MalwareBytes v3.0, OpenDNS, Super Anti-Spyware, Spyware Blaster, MCShield, Unchecky, Vivaldi Browser and, various browser security tools.

"Look before you leap!" Use online scanners before you click on any link.

Theblob

  • Guest
Re: different shields: which are the "smart" ones?
« Reply #2 on: April 19, 2013, 05:00:46 PM »
yeah I already check the manual before I made this topic but dont give any relevent info about heuristics or AI on different shields :/

ok I'll make the question simpler: which of them shields *by itself* can detect ZERO-DAY threats?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89061
  • No support PMs thanks
Re: different shields: which are the "smart" ones?
« Reply #3 on: April 19, 2013, 05:03:20 PM »
Again I refer you back to for first topic (where all of these similar questions should have been) as this just causes duplication for those trying to help. http://forum.avast.com/index.php?topic=121741.0
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Para-Noid

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6700
  • Trust only what you test yourself!
Re: different shields: which are the "smart" ones?
« Reply #4 on: April 19, 2013, 05:09:13 PM »
Each of them is there for specific reasons. And each uses the latest protection available.

I have one question...how important do you think your personal security is worth?  ???

If you want to remove or make changes to your avast install, just remember each shield you remove makes you less secure.
Control Panel>Uninstall>double click "avast">click "change">reboot
Dell Inspiron, Win10x64--HP Envy Win10x64--Both systems Avast Free v17.9.2322, Comodo Firewall v8.2 w/D+, MalwareBytes v3.0, OpenDNS, Super Anti-Spyware, Spyware Blaster, MCShield, Unchecky, Vivaldi Browser and, various browser security tools.

"Look before you leap!" Use online scanners before you click on any link.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: different shields: which are the "smart" ones?
« Reply #5 on: April 19, 2013, 05:19:21 PM »
Your question doesn't have any answer (well, except for P2P shield and IM shield - those are basically targeted versions of the FileSystem Shield making it possible to use different/higher sensitivity for specific folders or processes).
The shields call the code inside of virus definitions to deal with the detection (i.e. the shields themselves are just data suppliers) - and the virus definitions evolve constantly. So, if the Network Shield doesn't contain heuristic now, it may have it tomorrow.

Also, relying purely on heuristics is stupid - heuristics is slow/expensive. So the correct approach is to use a quick database lookup for known malware/sites/whatever, and only what passes through that sieve, send it to the "heuristics" (whatever the exact meaning might be). That's what the detections are prepared for - so as was already said, if you disable those "stupid" shields (if we assume there are some "stupid" and "clever" ones), you will decrease your protection significantly, as the "smart" shields assume the "stupid" ones are there, they are not meant to catch everything possible.

Theblob

  • Guest
Re: different shields: which are the "smart" ones?
« Reply #6 on: April 19, 2013, 05:34:45 PM »
Your question doesn't have any answer (well, except for P2P shield and IM shield - those are basically targeted versions of the FileSystem Shield making it possible to use different/higher sensitivity for specific folders or processes).
The shields call the code inside of virus definitions to deal with the detection (i.e. the shields themselves are just data suppliers) - and the virus definitions evolve constantly. So, if the Network Shield doesn't contain heuristic now, it may have it tomorrow.

Also, relying purely on heuristics is stupid - heuristics is slow/expensive. So the correct approach is to use a quick database lookup for known malware/sites/whatever, and only what passes through that sieve, send it to the "heuristics" (whatever the exact meaning might be). That's what the detections are prepared for - so as was already said, if you disable those "stupid" shields (if we assume there are some "stupid" and "clever" ones), you will decrease your protection significantly, as the "smart" shields assume the "stupid" ones are there, they are not meant to catch everything possible.
yeah I know but I guess what I ment to say, I'm looking for something like a strong HIPS (like Comodo) but which makes the decisions for me (unlike Comodo) so I dont get a popup everytime

like, something which analyze everything a program is trying to do (access keyboard, write to disk, inject into another app, modify registry & all that) and which put all these things together & decide if its a bad app or not. like a HIPS but with some kinda AI



besides most threats are suppose to be zero-day at least thats what it said on AV-checking site (VB100 if memory serves)

I mean what if they change just 1 letter on website name, then network shield wont pick it up? (cause it only check known urls)
or what if they change just 1 byte inside website content, then network shield still wont pick it up? (cause it cant detect variants of known threats!!)
« Last Edit: April 19, 2013, 05:45:07 PM by Theblob »

Offline Para-Noid

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6700
  • Trust only what you test yourself!
Re: different shields: which are the "smart" ones?
« Reply #7 on: April 19, 2013, 05:46:03 PM »
Layered protection is the best advice.
1) Anti-virus
2) Firewall with HIPS
Dell Inspiron, Win10x64--HP Envy Win10x64--Both systems Avast Free v17.9.2322, Comodo Firewall v8.2 w/D+, MalwareBytes v3.0, OpenDNS, Super Anti-Spyware, Spyware Blaster, MCShield, Unchecky, Vivaldi Browser and, various browser security tools.

"Look before you leap!" Use online scanners before you click on any link.