Author Topic: Real time analysis or not ?  (Read 2904 times)

0 Members and 1 Guest are viewing this topic.

Offline Nerva

  • Newbie
  • *
  • Posts: 3
  • I'm a llama!
Real time analysis or not ?
« on: August 21, 2006, 06:08:20 PM »
Hello.

I am a french user. I have just installed Avast 4.7 Home Edition. Is it normal that when I open a directory in CD-ROM, the software does not detect a which corrupted file, except if I launch the analysis ?

Thank you.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11786
    • AVAST Software
Re: Real time analysis or not ?
« Reply #1 on: August 21, 2006, 07:08:19 PM »
What exactly should it detect?
By default, infected files are detected when started, not when you open the directory.

Offline Nerva

  • Newbie
  • *
  • Posts: 3
  • I'm a llama!
Re: Real time analysis or not ?
« Reply #2 on: August 21, 2006, 08:15:35 PM »
It detects the virus only if I scanne the directory. I put this question because in the french manual, it is written that the viruses are detected with the opening of a directory.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9359
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Real time analysis or not ?
« Reply #3 on: August 21, 2006, 08:24:16 PM »
Igor, last time i checked avast! worked like this. Only difference between Normal and High was that Normal scans only selected range of filetypes while High scans them all without exception. On Read and On Write...
I know that in older versions used to be that Normal only detected on execution... Though i'm not 100% on how it works for files on removable media like CD's...
Visit my webpage Angry Sheep Blog

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Real time analysis or not ?
« Reply #4 on: August 21, 2006, 09:14:13 PM »
RejZoR,

maybe I am misreading your comment.

Surely it would not be the expected case that if I open a directory that manages files with 60Gb of data that avast would then scan every file in that directory (whether I choose to read that file or not).  If this were true then our systems would never get anything done. 

So isn't the answer that scans occurs only for explicitly accessed files whether on removable media or not?

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11786
    • AVAST Software
Re: Real time analysis or not ?
« Reply #5 on: August 21, 2006, 09:40:33 PM »
Nerva, can you please quote the corresponding passage from the French manual? It doesn't sound completely right...

Rejzor, scanning on execution is the default setting, and scanning on read is not - neither in the Normal or High mode (and I'm not saying that pure opening a folder has to trigger file reads - it depends on the file manager, e.g. Windows Explorer extracting the icons from the exacutables).
The thing is that this until avast! 4.7.817, scanning on read and on execution actually wasn't distinguished on Windows XP, so many files were scanned there on reading even when this option wasn't selected. It was changed in 4.7.817 though - so now scanning on read should really be scanning on read - i.e. something you have to specifically enable in Standard Shield configuration if you want it.

Offline Nerva

  • Newbie
  • *
  • Posts: 3
  • I'm a llama!
Re: Real time analysis or not ?
« Reply #6 on: August 22, 2006, 11:29:20 AM »
Yes, here the passage.

Detection of viruses to the flight.
The software detects the files infected as of the opening of a directory container it. It analyzes without problem a zip file containing several viruses, a zip file infected in a zip file and a famous file.


In French in the text...

Détection de virus à la volée.
Le logiciel détecte les fichiers infectés dès l'ouverture d'un dossier les contenant. Il analyse sans problème une archive contenant plusieurs virus, une archive infectée dans une archive et une archive renommée.


http://www.clubic.com/article-37030-10-comparatif-antivirus-2006.html

Front, I used AVG. When I opened a file on CD-ROM (my anti-viruses test CD-ROM) and that there was an infected file, it detected it automatically. Perhaps that the philosophy of operation of Avast is different, but I would like to have explanations.

Thanks.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11786
    • AVAST Software
Re: Real time analysis or not ?
« Reply #7 on: August 22, 2006, 12:30:06 PM »
Ah, it's a text from some web review... not from avast! help file or web. (So, we can't guarantee it's correct.)

I'd put it this way:
avast! [resident protection] does not scan a directory when it's opened. That would slow down the system significantly, and there is not reason to do so (so, it cannot be enabled anyhow in avast!).

avast! can be configured to scan a file when it is:
1. started (executed) - that's the most important thing to do, and it actually should be quite sufficient
2. written to - that's the default setting for specific file types (executables). This makes it possible to detect an infected file as soon as it's created on the disk
3. read from - it is turned off by default. You can enabled this option, but it will slow down your system slightly. It may actually cause the following effect: you open a directory, using Windows Explorer - and Explorer reads specific parts of the files in folder to extract the icon and display it next to the file. In such a case, avast! detects this file access (reading) and scans the files - so you actually get the behavior you were asking about (the files in a directory are scanned as soon as the directory is opened) - but it's not because avast! would do it by itself, but rather because the file manager (Explorer) is accessing the files. As I said, however, this option is turned off by default and you have to enable it in Standard Shield configuration if you really want it.