How Much Additional Protection Is Afforded By Checking Executables?

[NoelC]

That sounds a bit silly, but let me explain...

Knowing that Avast! checks all files as they are written to the disk, and that a regular scan finds no problems, then it could be said that the data on the disk is relatively safe, no?

How much additional risk is taken on by disabling the checking of executables (or DLLs) run from the disk, since they will have had to be written to the disk as files at some time in the past?

The reason for asking is that the time to check executables does cut into the ultimate speed of computer operations.  It's likely not much - since I believe Avast! keeps tabs on what it's already checked.

Just curious.

-Noel

[Para-Noid]

By unchecking the DLL's you won't gain that much time wise.
The best way to cut scan times is by using the persistent cache.
Another way is to uncheck the "follow links" during scans.
Instead use the "scan in order stored on disk" option.

As far as the risk factor anytime you fail to scan "any" executable you run the risk
of something really bad happening.

edit: Anytime after you run a scan and access an executable it will be scanned again.
        Not just by the file shield but since it will no longer be in the persistent cache it will be scanned again
        the next time you run a "regular" scan.

[propheticus]

Default not all files are scanned. Big files might be skipped or only partially scanned. Some virusses are detected by name or extension and not the content of the file. If all files would be scanned entirely (content) a scan would take ages.
Furthermore, not all packers are extracted/executed while scanning. If a virus was inside a large 7zip file that got skipped while doing a full system scan it would remain undetected when 'scan when executing'  was off. Remote shares or non-default extensions are not scanned in the default full system scan. When a program calls remote sources to execute or renames a .123 extension file (that has not been scanned) to .exe or .bat and executes this, this would otherwise slip the net.

So in my opinion scanning when executing is best left on.

[NoelC]

Thanks.  It's loopholes like "save file as .123 then rename to .exe" that I was looking to hear about.

For what it's worth, comparing software builds with shields on/off, where a lot of executables from Visual Studio are run (compiles, etc.), not too terribly much time is used by Avast!  One example Solution Build run was 25.26 seconds with Shields enabled, 21.87 seconds with them disabled.

The time was well over 30 seconds with Microsoft's Win 8.1 Windows Defender default solution.

-Noel