[Guide] avast! Proactive Protection

[ardvark]

Hi DavidR...

Ah, I see...got a little ahead of myself. Pardon my brusqueness earlier, just that I don't post here to hear my head rattle. I have questions at times and like to help out others when I can too.

Thanks

[emy80]

Hello! I did the customization but at start up Avast! gave me a warning with the same window you showed. It asked me to allow or block the writing of a file called ebd.chk by process wuaulct.exe.
Why? the file was in a microsoft windows folder. now i'm really tired of getting this warning. Is it a virus Avast didn't detected before? What should I do?

[TedNelly]

Just a blooper trying to do too many things at once my apologies

[TedNelly]

Here is a link to a site that should help answer some of your questions?
Wuauclt.exe is a process managing automatic updates for Windows
Hope it helps

http://help.lockergnome.com/index.php?showtopic=30026

Sorry I post the wrong URL the first time oops

[emy80]

Here is a link to a site that should help answer some of your questions?
Wuauclt.exe is a process managing automatic updates for Windows
Hope it helps

http://help.lockergnome.com/index.php?showtopic=30026

Sorry I post the wrong URL the first time oops

No problem! I googled for it and find out what exactly it is. So I wasn't overly concerend. but those warnings were aggravating. I couldn't rememeber the default settings so I jsut uninstalled and installed Avast again.
I think I'll not mess with it in the future.

[TedNelly]

no worries emy80  you just had to untick Standard Shield/Customise/Blocker/
Blocked Operations/Untick Open file for writing   

[RejZoR]

Hello! I did the customization but at start up Avast! gave me a warning with the same window you showed. It asked me to allow or block the writing of a file called ebd.chk by process wuaulct.exe.
Why? the file was in a microsoft windows folder. now i'm really tired of getting this warning. Is it a virus Avast didn't detected before? What should I do?

Thats impossible. If you followed the guide you shouldn't get that message. CHK extension is not even on the list!

[ocp]

I think the problem is that he didn't uncheck default extension set. As I understand it must be unchecked otherwise you get a lot more warnings.

[RejZoR]

Yes, but people obviously don't read. I even used images for that matter...



Now select Blocker tab.

Set all settings the same as shown on screenshot above, except field under number 2. This will come in next few lines...

This is what i wrote in the guide on first page...

[emy80]

Hello! I did the customization but at start up Avast! gave me a warning with the same window you showed. It asked me to allow or block the writing of a file called ebd.chk by process wuaulct.exe.
Why? the file was in a microsoft windows folder. now i'm really tired of getting this warning. Is it a virus Avast didn't detected before? What should I do?

Thats impossible. If you followed the guide you shouldn't get that message. CHK extension is not even on the list!

Well....there is a CH? in the default extension. My guess is that changing the Bloker action triggered that thing. I did an on-line scan with Trend Micro disabling the Standard Shield and the Web Shield.
First thing I got was a error message of Microsoft. I took a screenshot. Then the scan resulted clean. I just uninstalled and installed Avast again. i have the automatic update enabled so maybe that's why. The wuaulct.exe was running under a svchost.exe process pertaining the Updates. I checked it with Process Explorer.
I don't know why. I just decided to leave the default settings.

[edit] I'm really sorry. i guess I really didn't unchecked the default setting. I'm realy sorry for this. I wasn't saying that your guide is bad. i just guess, since i'm not an expert it's better if i leave the default setting, so i'll know for sure I haven't damaged the program. I'm sorry.

[greenhatch]

It's nice and clear now. To us noobs, it looked like the 'additional' extensions still needed the tick in the box to activate blocking. I now understand the tick is not needed. I certainly appreciate your help RejZoR and I trust this thread will be 'stickied'.

[ocp]

Noticed one small problem.
"Default extension set" will check itself if you run Avast! Antivirus. So eveytime you use it (which is not often - im talking about main antivirus, not on-access protection or explorer extension), you have to uncheck it.

[RejZoR]

Good, so we found a bug.

[greenhatch]

I just tried a quick scan but it didn't change my blocker settings (Default unticked, additional per RejZoR info post).

Oh and I found out what caused the blocker write alert in my Trillian yesterday: MSN message box icon!

[Vlk]

Guys (RejZoR:) I appreciate your effort, but OTOH, I'm *reluctant* to making this thread sticky, for one simple reason - I *don't* think the settings RejZoR suggested are suitable for regular users...

Especially RE blocker - I would strongly recommend AGAINST turning it on, unless you know EXACTLY what you're doing... Blocking a (legitimate) file from being written can have very bad subsequences.


Cheers
Vlk