Resident Protection: Am I Missing Something?

[Silver_Rain]

Hi, I'm new to avast!, so forgive me if this is a silly question/problem. I recently downloaded and installed avast! 4.8. It works quite well in its web protection, however, one thing has me worried.

I disabled all protection and then downloaded the EICAR test file (from their website). Now, I didn't expect avast! to stop me, since I disabled the protection; no problems there. However, I then re-enabled protection, and then proceeded to (1) extract the ZIP (which contained the test file) and (2) run the executable file inside. In both cases, avast! showed no alerts.

Now, I'm not sure if my configuration is wrong, but shouldn't avast! Resident Protection stop me from running the file? I read through the help files and browsed through these forums, but I couldn't find out how to make avast! block the file from executing in real-time; a manual scan detects the virus, but I'd rather not have to manually scan every file on my computer, especially ones that were created before the installation of avast!.

Alright, another issue: whenever I boot up my computer, I get the blue icon in the system tray, except it has a red slash through it. That is, resident protection is disabled. However, after about a minute, it turns on. Is there a way to speed up the startup? Maybe a registry tweak so that avast! starts immediately? 

[Lisandro]

(1) extract the ZIP (which contained the test file)

Depending of your settings... the default ones should alert you.

(2) run the executable file inside. In both cases, avast! showed no alerts.

It should alert you... unless you've changed settings deeply.

Alright, another issue: whenever I boot up my computer, I get the blue icon in the system tray, except it has a red slash through it. That is, resident protection is disabled. However, after about a minute, it turns on. Is there a way to speed up the startup? Maybe a registry tweak so that avast! starts immediately? 

avast protects you since from the beginning... the GUI (icon) answer is slower in some systems. If the red cross disappears, you've protected since from the beginning.

Which was your 'old' antivirus?

[Silver_Rain]

Hi Tech, thanks for your response. I figured out how to fix the avast! startup issue (I made a registry entry based on another forum member's post). So, that problem is solved: avast! shows blue at startup .

However, I also did a clean install (uninstalled, ran a few registry cleaners, then reinstalled). So I think that my settings should have reverted to default, correct? Well, avast! still did not alert me when I extracted and ran the EICAR test file. Furthermore, I made a new text file and entered in the test string, and then saved it. avast! did nothing. I'm not sure about the configuration thing; I set it to "high" on the simple user interface (I'm using Home Edition); so how come it does not pick this up? Technically, I'm toying with a virus file, but avast! Resident Protection is not doing anything  ... And I never changed the settings deeply; even if I did, a reinstall should've changed them to default. Perhaps you can try the procedure on your computer, and, if you get alerted, share you settings with me?

Thanks again, though.

[Lisandro]

However, I also did a clean install (uninstalled, ran a few registry cleaners, then reinstalled). So I think that my settings should have reverted to default, correct?

Yes.

Well, avast! still did not alert me when I extracted and ran the EICAR test file.

Which version? com, exe, txt?

I set it to "high" on the simple user interface (I'm using Home Edition)

If you click the 'Details' button you can check the Standard Shield configuration in more detail.

Which was your 'old' antivirus?

I can't even download the file...

[Silver_Rain]

Which version? com, exe, txt?

I downloaded the archived version (eicar_com.zip) and then extracted it. There was an executable file inside; I ran it, and avast! did not pick anything up. That was after pausing web protection. Yes, I realize that the web protection works well, and that ordinarily a download would be scanned. However, what I am concerned about is avast! system monintoring (real-time protection); for example, a virus on a flash drive gets plugged into my computer, and I run a file from it. Or if there is already an infected file on my computer. avast! does not seem to scan the file as I open it.

If you click the 'Details' button you can check the Standard Shield configuration in more detail.

I only see my two providers I have installed: Web Shield and Instant Messaging. I've customized them, and they work excellent.

Which was your 'old' antivirus?

I used McAfee.

[alanrf]

I only see my two providers I have installed: Web Shield and Instant Messaging. I've customized them, and they work excellent.

That means your browser scanning will be checked and your P2P activity will be checked ...

BUT ... your everyday file accesses, running of virus software, sending of all your personal information to the world is come one come all

Please consider a complete uninstall and reinstall of avast.  You must have the Standard Shield running for regular on access protection.

Before that you may wish to consider any "complete removal" offerings from McAfee.

If you encounter any errors in this please advise here and we will do our best to assist further.   

[igor]

What operating system do you use?

[Silver_Rain]

BUT ... your everyday file accesses, running of virus software, sending of all your personal information to the world is come one come all

Please consider a complete uninstall and reinstall of avast.  You must have the Standard Shield running for regular on access protection.

Before that you may wish to consider any "complete removal" offerings from McAfee.

Yes, I made sure I did a complete removal of McAfee before installing avast!, And I already did a re-install of avast! already. So you're telling me that there is something wrong with my installation? After a reboot, I still only see my two providers, and the tray icon says there are 2 provider(s) total, 2 running. Just as a reminder, avast! detects the virus if I do a manual (Explorer extension) scan. However, when I extract and then run the virus, avast! does nothing. So I'm looking for a way to make avast! alert me that I'm trying to run a virus, rather than having to scan everything I wish to run.

What operating system do you use?

I use Windows XP Home Edition, Service Pack 3.

[DavidR]

In the Home version there are 7 providers and after installation 6 are usually running, so there is most certainly something wrong with your installation.

Probably worth a quick check:
McAfee has an uninstall tool that you could run to ensure any possible remnants are removed.
http://download.mcafee.com/products/licensed/cust_support_patches/VSCleanupTool.exe
2007 version - http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

It would probably be best to do a clean reinstall.
Download the latest version of avast (if you didn't save it) http://www.avast.com/eng/download-avast-home.html and save it to your HDD, somewhere you can find it again. Use that when you reinstall.

Download the avast! Uninstall Utility, find it here and save it to your HDD.

Now uninstall (see below), reboot, run the uninstall utility, reboot, install the latest version, reboot.

It may be necessary to disable the avast! Self-Defence module (Program Settings, Troubleshooting section) if you are unable to uninstall using the Add Remove Programs before running the Uninstall Utility. Or, boot into safe-mode and start aswClear.exe from there.

[Silver_Rain]

In the Home version there are 7 providers and after installation 6 are usually running, so there is most certainly something wrong with your installation.

Probably worth a quick check:
McAfee has an uninstall tool that you could run to ensure any possible remnants are removed.
http://download.mcafee.com/products/licensed/cust_support_patches/VSCleanupTool.exe
2007 version - http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

It would probably be best to do a clean reinstall.
Download the latest version of avast (if you didn't save it) http://www.avast.com/eng/download-avast-home.html and save it to your HDD, somewhere you can find it again. Use that when you reinstall.

Download the avast! Uninstall Utility, find it here and save it to your HDD.

Now uninstall (see below), reboot, run the uninstall utility, reboot, install the latest version, reboot.

It may be necessary to disable the avast! Self-Defence module (Program Settings, Troubleshooting section) if you are unable to uninstall using the Add Remove Programs before running the Uninstall Utility. Or, boot into safe-mode and start aswClear.exe from there.

Thanks for your reply, DavidR. However, I did a custom installation of avast!, so that is why I only have 2 providers. What I wanted was Instant Messaging Protection and Web Protection; I don't use a P2P program, Microsoft mail, or The Bat!, and I don't wish to have the Internet Mail component installed. I got the IM and Web Protection, but not the actual real-time blocking virus blocking defense. So, would I still need to do another re-install ?

[igor]

Well, you didn't install the relevant part of the resident protection, yet expect it to be active
Without the Standard Shield provider, you can write infected files to disk, even execute them - and you won't get any warnings, because it's exactly the Standard Shield provider taking care of blocking those operations.

[Silver_Rain]

Well, you didn't install the relevant part of the resident protection, yet expect it to be active
Without the Standard Shield provider, you can write infected files to disk, even execute them - and you won't get any warnings, because it's exactly the Standard Shield provider taking care of blocking those operations.

LOL! Well, that solved the problem! Yes, I installed the Standard Shield and gave a reboot, then tried to run the EICAR file again. Sure enough, avast! alerted me. I'll tell you what happened: while installing, I thought that "Standard Shield" meant the shield for The Bat!, as it was right under The Bat! checkbox. So, since I don't use The Bat!, I didn't install it.

Well, other than the fact that I feel quite silly at the moment, the problem is solved. Thanks guys for your help: like I said, I was a newbie to avast! . A moderator can close this topic now.