Author Topic: crash  (Read 5883 times)

0 Members and 1 Guest are viewing this topic.

hetzer

  • Guest
crash
« on: November 17, 2003, 11:05:31 PM »
any attempt to change settings using avast "On Access Protection Control" causes a crash, error report request and the cessation of the antivirus protection. Or at least both avast icons dissappear from the taskbar!

Can anyone suggest what is wrong and what I can do to sort this out!
I am loath to completey uninstall as I had a bit of a hasstle getting the mail scanner to work with all my mail clients:- Mozilla Mail client, and Pegasus my main mail client and also Outlook Excess for any guestr users!!
« Last Edit: November 18, 2003, 03:49:46 AM by hetzer »

Offline .: Mac :.

  • Avast √úberevangelist
  • Ultra Poster
  • *****
  • Posts: 5093
Re:crash
« Reply #1 on: November 18, 2003, 03:40:49 AM »
by default the setting are good enough to protect you. But try unloading the in acess scanner first. Some of the others will have more helpful tips. What are you trying to change?  ???
"People who are really serious about software should make their own hardware." - Alan Kay

hetzer

  • Guest
Re:crash
« Reply #2 on: November 18, 2003, 03:47:37 AM »
Its the blocker, Its rather intrusive but am I risking things dispensing with blocking altogether?

The crashing seems to have been resolved by running chkdsk on all HDD volumes and a couple of reboots!

Thanks for your prompt reply.
Hetzer

hetzer

  • Guest
Re:crash
« Reply #3 on: November 20, 2003, 01:09:00 PM »
Does everyone put up with the blockers constant intrusions or do they just switch it off!
Setting it to "allow" is surely the same as not having it at all!
Or am I missing something?

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11660
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:crash
« Reply #4 on: November 20, 2003, 01:19:52 PM »
The 'Behavior Blocker' (part of the Standard Shield) is really kinda outdated thing (turned OFF by default). It's more or less a reminder from the good ol'e days of DOS when such utilities were pretty popular. To make it real usable, we'd have to enahance it a bit, e.g. by making it rule-based (individual rules for individual programs etc.). BTW some of the top-notch personal firewalls do have this feature.

As it really doesn't use our virus database/know-how (in fact it's a pretty dumb thing that just relies on file extensions), we're considering removing this feature from future versions altogether....

Hope this explains it a bit,
Vlk
If at first you don't succeed, then skydiving's not for you.

hetzer

  • Guest
Re:crash
« Reply #5 on: November 20, 2003, 07:13:44 PM »
Cool!
Thanks for the prompt reply.
I shall switch it off then as I am already somewhat plagued by Blackice's "Application Protection".
V. nice piece of software BTW! I was using AntiVir until it went strange on me (It or XP or both), but yours has Antivir beat on features and also performance if certain tests are to be believed!
The only feature about Antivir which I found reassuring was the high frequency of database updates. This could be entirely placebo effect of course!
Keep up the good work!
 :)

Hornus Continuum

  • Guest
Re:crash
« Reply #6 on: November 22, 2003, 11:53:55 AM »
Vlk,

I urge the Alwil team to retain the Behavior Blocker feature in future releases.  (I specifically chose the word 'feature,' because I consider it to be that, not a throwback.)  Since writing to, renaming, and deleting files are all common characteristics of malware, BB provides some protection.  Essentially, it is heuristics for on-access protection and one more layer of defense against new threats and moldy oldies that aren't recognized.

Using the blocker with the default extension list shouldn't impose an undue burden on the majority of users.  Application and Web developers may be good exceptions, but for most of us there're few legitimate reasons for the monitored operations to be performed, and the frequency of those few is relatively low.  Those who are annoyed by the alerts can trim the extension list or disable BB altogether.

Again, please don't eliminate this feature.  Some of us truly appreciate it.  By the way, adding a rules capability would make Behavior Blocker rock, just like the rest of avast!.   8)

Regards,
Hornus
« Last Edit: November 22, 2003, 12:00:08 PM by Hornus Continuum »

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11820
    • AVAST Software
Re:crash
« Reply #7 on: November 22, 2003, 01:45:47 PM »
Even though writing to exe files is suspicious - there's a problem: many "ordinary" applications open executable files for writing even though they don't have to. Try to select an .exe file and display it's properties - the behavior blocker will come up with a warning, since some Microsoft OLE library opens the file both for reading and writing (only to read its version info!). (The example may concern specific OS versions only). So, there are too many false alarms this way... (I think even avast! opens one of its libraries such that it gives a warning).
So, the rules would really be needed to make the feature useful...

Hornus Continuum

  • Guest
Re:crash
« Reply #8 on: November 22, 2003, 02:55:26 PM »
Igor,

You make a good point, and granted most of the alerts that I see are caused by software using the wrong file access specifier.  I realize that these alerts can be alarming to newbies, but it doesn't take long to recognize them along with the normal legitimate alerts like Recycler's requests to update its file store.  However it doesn't happen often enough, to me at least, to be a nuisance.  When I'm doing something like checking the properties of a lot of files, triggering an alert, it's easy enough to temporarily change BB's settings.

I consider it at worst to be a very minor inconvenience that is well worth it to get the extra protection afforded.  Just because I'm paranoid doesn't mean they're not out to get me.   :P

Of course, I'd love to see rules sets incorporated into BB, but if my choices are limited to having BB the way it is or not having it at all, I vote for the latter.

Regards,
Hornus

Shutterbug

  • Guest
Re:crash
« Reply #9 on: November 22, 2003, 08:44:27 PM »
Quote
I'd love to see rules sets incorporated into BB, but if my choices are limited to having BB the way it is or not having it at all, I vote for the latter

Considering your earlier post advocating BB, did you mean to say "the former"?

I'll put my vote in with keeping BB also.  And I'm both a programmer and web designer!  My take is that people who have no use for it aren't likely to see the errors often or at all, and those who will see the errors often enough will also have enough knowledge to come to this forum and do what they need to disable it if need be.  Of course, those rules truly would be nice.   ;D