Yes, real time is enabled & said it stopped the infection both times, yet on the regular scan, found them again (& after being cleared from the computer, not just quarantined).... I am aware the boot scan does not prevent an infection, it helps clean anything before windows can fully start & prevent a virus from being detected or cleared. I have been using AVAST for many years & have been using computers since card readers & phone cradle modem Basic / COBOL days. When AVAST does detected on a full scan, it "recommends" a boot scan. When that is scheduled, it asks to download a 40meg file.... that is what I was questioning in the first place. Both times AVAST "caught" the infection from the NYS site, it was a redirect virus. I have since unloaded & reloaded AVAST, as well as preformed a system restore to before the request to download the 40meg file started. When I "test" scheduled a boot time scan, it has returned to asking to do that 40meg download. When checking for actual AVAST program updates, it says I am up to date (& auto updates are on) I am also now having issues with AVAST & the latest version of Firefox. (PLEASE don't tell me to use Chrome... I will NOT... I've used it, don't like it) I am still using Win-7 as an OS.... & no, won't go to 10. In fact, I really would love to go back to XP. I dislike 8 & 10 so much that my next build will probably go to Linux.