Author Topic: Questions about protection (I just noticed)  (Read 4553 times)

0 Members and 1 Guest are viewing this topic.

Offline lakrsrool

  • Advanced Poster
  • **
  • Posts: 712
  • Get the Picture !
Questions about protection (I just noticed)
« on: July 08, 2008, 03:43:06 PM »
I have just noticed some odd things going on with Avast.  I noticed that in IE6 the "Avast ball" WAS turning on a web site and in FF2 the same web site was NOT turning the ball so I decided to check this out. (I started wondering about this because FF2 was "locking" up for no reason just typing text and the Avast ball wasn't turning so I couldn't understand what was the problem with FF2 when I started wondering why the Avast ball wasn't turning under certain circumstances and I found what I describe below).

Questions:

1. Web Shield - nothing is getting scanned at all (count remains 0) when I open web pages.
A. I have "Enable web scanning" checked (enabled),
B. I have "scan all files" check (enabled) and
C. The web page is not on my "exceptions" list.

I wondered what is "turning the ball" when I open the web page in the case of IE6?

2. Standard Shield - "js" files are scanned but only in IE6 when I open the web page. The exact same web page in FF2 the "js" files are NOT scanned.
FF2 of course is a browser that uses tabs as opposed to IE6 which opens seperate windows for each web page. (Everything is checked (enabled), btw.

Question 1. Why is my Web Shield count always "0" and nothing is scanned at all? - 1) "Enable web scanning" is checked (enabled), 2) "scan all files" is check (enabled) and 3) the web page is not on my "exceptions" list.

Question 2. Why would the Standard Shield act differently and scan files ("js" in this case) in one browser but not do the same scan in the other browser? The same web page would have the same "js" files in either case. (Avast should certainly not scan just because a web page is in a "tab" versus a "window", because that is the only thing different going on between the two browsers.)

Kind of makes me wonder how protected I am really?

Avast 4.8.1201
WIN98SE


Thanks in advance.  :)
« Last Edit: July 09, 2008, 05:54:03 PM by lakrsrool »
Processor: i3 2.53 GHz 4 GIG RAM, OS: WIN 7, Connection: High Speed, Virus/Malware Protection: Avast-2015, SpywareBlaster, Windows Firewall & Defender. Email: Outlook 2010 w/ POP Peeper Email Notifiers.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: Questions about protection (I just noticed)
« Reply #1 on: July 08, 2008, 03:53:03 PM »
It is down to the way FF's browser cache works, the files don't have file extensions and I believe you have to have the Web Shield on High for these browser cache files scanned. I also have the Web Shield, Customize, Web Scanning set to Scan all files.

They are certainly scanned for me both in FF 2.0 & now FF 3.0.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline lakrsrool

  • Advanced Poster
  • **
  • Posts: 712
  • Get the Picture !
Re: Questions about protection (I just noticed)
« Reply #2 on: July 08, 2008, 04:26:33 PM »
Thanks David,

I have the Web Shield set to "HIGH" and opened two different web pages in IE6 and the scanned count remains "0".  Same thing in FF2.

There are two questions I have that involve 2 different things 1. Web Shield 2. Standard Shield:

Question 1. Is related to the above - Why Web Shield is "running" and I have all 1) "Enable web scanning" is checked (enabled), 2) "scan all files" is check (enabled) and 3) the web page is not on my "exceptions" list and the count remains "0" in either browser after many hours of using the Internet.

I have found now that after using the Internet yesterday for about 6 straight hours my Web Shield had a "0" count and all settings "enabled" as I said before. This was using FF2 yesterday.  Just trying IE6 an hour this morning I still have a "0" count in the Web Shield as well.  I don't know what else I could enable or set since all is "enabled" and set on "HIGH" for the Web Shield and the web pages are not in the "exceptions" list.

Question 2. Unrelated to the first question about the Web Shield: IE6 has the STANDARD Sheild Count going up all the time but it isn't doing the same thing with FF2 and all settings for Avast are of course the same.

So in the case of the STANDARD Shield you are saying that in your case the same exact web page will show "js" files being scanned in IE6 but this same web page in FF2 will NOT show "js" files being scanned?  (I didn't understand your explanation about FF caching files).

Wouldn't the same web page have the same "js" files if after all again it IS the same web page in both cases?

Thanks again in advance.  :)

Edit:  At this point I am of the conclusion that it may be the case that the Web Sheild does not work for WIN98SE in v4.8.1201?

As far as the Web Shield is concerned my conclusion is based on the fact that the Web Shield Count worked before I upgraded from v.4.7 to 4.8 a couple of weeks ago (all my settings are the same as before) and I am just now noticing that it isn't working after the upgrade apparently. - ARE THERE USERS THAT HAVE WIN98SE w/ v.4.8.1201 that have the Web Shield count going up?
« Last Edit: July 08, 2008, 05:13:26 PM by lakrsrool »
Processor: i3 2.53 GHz 4 GIG RAM, OS: WIN 7, Connection: High Speed, Virus/Malware Protection: Avast-2015, SpywareBlaster, Windows Firewall & Defender. Email: Outlook 2010 w/ POP Peeper Email Notifiers.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Questions about protection (I just noticed)
« Reply #3 on: July 08, 2008, 04:52:15 PM »
lakrsrool, did you set the proxy into WebShield and your browsers?
WebShield does work in Windows 98SE...
The best things in life are free.

Offline lakrsrool

  • Advanced Poster
  • **
  • Posts: 712
  • Get the Picture !
Re: Questions about protection (I just noticed)
« Reply #4 on: July 08, 2008, 05:08:54 PM »
Thanks Tech,

I haven't changed anything since upgrading from v4.7 to the current v4.8.

I don't know what you mean by setting the "proxy into WebShield and your browsers". - can you explain in more detail?

I happy to learn that 98SE does work with WebShield... but I have no idea why now that isn't working?
Processor: i3 2.53 GHz 4 GIG RAM, OS: WIN 7, Connection: High Speed, Virus/Malware Protection: Avast-2015, SpywareBlaster, Windows Firewall & Defender. Email: Outlook 2010 w/ POP Peeper Email Notifiers.

Offline Rednose

  • Pirate Party Member
  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 3739
  • Bits of Freedom : https://www.bof.nl
    • Nederlandstalig Avast! forum
Re: Questions about protection (I just noticed)
« Reply #5 on: July 08, 2008, 05:30:37 PM »
Heya m8 :)

This will help you : http://www.avast.com/eng/faq-home-webshield.html

Greetz, Red.
OS: Win 10 / iOS 17 / Debian 12 / Tails 5
Real Time: Avast Premium Security
On Demand: Malwarebytes
VPN: NordVPN ( NordLynx ) with Threat Protection ( Lite )

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Questions about protection (I just noticed)
« Reply #6 on: July 08, 2008, 05:31:48 PM »
I don't know what you mean by setting the "proxy into WebShield and your browsers". - can you explain in more detail?
You have to manually configure browser to access Internet using avast! WebShield if you have Windows 98\Me. For 2k\XP\Vista it's automatic and transparent.

To manually configure your browser see the following tutorials:

For IE and permanent connection users:
http://www.avast.com/files/tutorials/ws_ieproxy.htm

For IE and dial-up users:
http://www.avast.com/files/tutorials/ws_ieproxy_dialup.htm

For Firefox users:
http://www.avast.com/files/tutorials/ws_ffproxy.htm
The best things in life are free.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: Questions about protection (I just noticed)
« Reply #7 on: July 08, 2008, 05:33:17 PM »
Nothing has essentially changed in the Web Shield that would make it not work with win98. If you set the browser to use it and or it previously worked, it still should.

So I can't understand why it doesn't now, but more so why it is inconsistent one day working the next not. That just isn't right it would either work or not, so there has to be something else going on, what that is is the issue.

I don't use IE period so I can't say what might or might not be the case of .js files, but your original post was that FF wasn't scanning,

The reason the Standard Shield gets involved in scanning .js files (as they have to be saved to the browser cache) is because the Web Shield didn't and a newly created/modified file would get scanned by the standard shield.

You only need to look at the different browser caches, Temp Internet Files for IE and you will see the files are stored with their file types. If you look at the firefox browser cache you will see two differences, a) the file name is different to the original and b) there is no file type. That effects what will be scanned and why the Scan all files is important for FF.

The problem is the inconsistency, you are reporting as if it worked pre 4.8.1201 then it should still work
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline lakrsrool

  • Advanced Poster
  • **
  • Posts: 712
  • Get the Picture !
Re: Questions about protection (I just noticed)
« Reply #8 on: July 08, 2008, 06:58:35 PM »
Thanks Rednose and Tech  :).... Okay all is well with the WebShield in both browsers now... I have no idea how IE6 lost it's setting to the "Manual proxy configuration" but I clearly did have it set at one time because I know I had checked all of Avast out when I first installed it.  And since I have been using the same IE6 browser you would think the setting would remain as it was.

Btw, the FF instructions are only a video and are apparently for an older version of FF. The settings are now in Advanced>Network>Settings instead of General>Connection Settings, infact there is no "General" tab anymore at all.  ;)


DavidR,

As far your saying "why it is inconsistent one day working the next not" this is not really the case... In the case of the WebShield neither browser was working at all (because of "proxy" settings) but in the case of the StandardShield it was a matter of one browser (IE) scanning ("js" files) and the other (FF) not.

You have explained why that is the case below:
Quote
You only need to look at the different browser caches, Temp Internet Files for IE and you will see the files are stored with their file types. If you look at the firefox browser cache you will see two differences, a) the file name is different to the original and b) there is no file type. That effects what will be scanned and why the Scan all files is important for FF.

As far as your explanation: I'm not sure what you mean by "scan all files" as set since that is in the Web Shield (I do have it set that however) as far as the Standard Shield which is the "Shield" that is not scanning in FF but is in IE I have everything checked to scan that can be as far as I can see.  But it still does not scan those "js" files on the same web page that IE does scan them.

Since files in FF are not getting scanned that are getting scanned in IE this would lead me to believe that IE is safer in this specific example anyway. If as you say FF treats files differently and because of this they ARE NOT scanned and they ARE scanned in IE then it would make me wonder about a "security gap" in FF that doesn't exist in IE as far as Avast scanning for bad files is concerned...  ???

As far as what you posted here:
Quote
The problem is the inconsistency, you are reporting as if it worked pre 4.8.1201 then it should still work
Getting back to the WebShield FF didn't work because I have installed it in the past 2 months and didn't set the "proxy" setting.  But in the case of IE I did have it set because I know the WebSheld was working at one time.  Whether this changed when I upgraded to Avast 4.8 or not I don't know.  All I know that it was working and for some reason the IE "proxy" setting was changed at some point and can't really say if it changed when I upgraded to Avast 4.8 or not.

As to the StandardShield that related to the above comments you have made and my follow up questions regarding FF and if it is as safe as IE in the particular case since FF is not scanning files on the same web page that IE is scanning files.

I have one other comment DavidR since you mentioned you do not use IE.  I use forums all the time on the Internet and I have found for some reason FF2 has problems with Internet text boxes. If I am typing a lot of text my computer will "lock" up now and then but usually I can wait and start typing again but sometimes it will stay "locked" and I have to reboot.  I notice a lot of harddrive activity at the time.  None of this seems to happen with IE.

I also have problems with editing text boxes which I think has to do with wordwrap maybe because I know FF2 does not wordwrap (FF3 is supposed to but some users say it doesn't either).  What happens is that emoticons placed on the board do not insert where the curser is placed but instead are only inserted at the end of the text in the text box also any other "special" editing causes the text box to scroll to the top after inserting which does not happen in either case on IE6 for me.  Just an observation (FF support tells me that is the way it is and has been a "known issue").  ;D  Btw, you must have noticed this using forums like this using FF as well, right?  ???

Oh btw, I just now realized that I'm not having these same problems with this board so now that leads me to believe it may very well be a compatibility issue between the specific board and FF2 and perhaps not an issue specifically related to FF after all. (for this forum the emoticons insert where the cursor is and editing (like underline above) doesn't scroll the text box to the top like in some other forum(s)), that's good to know... I was using IE when I first posted this and thought I'd switch to FF to see if the problem persisted w/ this forum, surprise it doesn't  ;)  FF still "locks" up sometimes though on text box typing like I said.  :(

Thanks again everyone for all the help (Web Shield scan count already at 44 wahoo).

« Last Edit: July 08, 2008, 07:48:07 PM by lakrsrool »
Processor: i3 2.53 GHz 4 GIG RAM, OS: WIN 7, Connection: High Speed, Virus/Malware Protection: Avast-2015, SpywareBlaster, Windows Firewall & Defender. Email: Outlook 2010 w/ POP Peeper Email Notifiers.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88897
  • No support PMs thanks
Re: Questions about protection (I just noticed)
« Reply #9 on: July 08, 2008, 07:43:03 PM »
That wasn't clear that the web shield never worked with FF before 4.8.1201, as my reading of this lead me to believe.
Quote from: lakrsrool
Edit:  At this point I am of the conclusion that it may be the case that the Web Sheild does not work for WIN98SE in v4.8.1201?

As far as the Web Shield is concerned my conclusion is based on the fact that the Web Shield Count worked before I upgraded from v.4.7 to 4.8 a couple of weeks ago (all my settings are the same as before) and I am just now noticing that it isn't working after the upgrade apparently.

Or I would most certainly suggested the manual setting of FF to use the web shield proxy and hopefully we could have arrived ate where you are now with the web shield working sooner.

The Standard Shield isn't scanning the FF or IE http traffic through the web shield proxy, but when the downloaded file is saved to your browsers cache. At that point it becomes a newly created file and the standard shield (depending on its settings and the file type) would scan it. As I said before, the file type element is different in the FF cache (no file type) so that would have an impact on what would or wouldn't be scanned as the standard shield wouldn't see a file called xxxx.js but a seemingly random file name and no file type.

See image example of a lmall part of my ff cache, not the file names and no extension, I wouldn't have a clue if this was a .js, .htm, .jpg, etc. So it would be equally hard for anything other than firefox to decipher what this file was much less execute a malicious file that was downloaded.

Part of the fact that the firefox cache doesn't retain the original file name nor does it have a file extension would make it harder for malware to be run from within the cache, making it more rather than less secure. Enable NoScript add on and scripts don't go anywhere much get run, unless you specifically authorise the use of scripts for that site or page, as far as I'm aware there is no such add-on available for IE another plus.

I have to say I never experienced any problems on the forums I visited when I had FF 2.0 and certainly no problem on this forum, especially with the example of the emoticons, they went where the was at the time I selected them (however for the more common emoticons, it is quicker to type them).

FF 3.0 is better on wordwrap (unfortunately you can't use that with win98), but again I don't recall it being a problem, certainly to the point of using a different browser for that forum.

I guess I have been lucky I haven't had any serious deal breakers with any version of firefox or it wouldn't have been my default browser for the last couple of years.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline lakrsrool

  • Advanced Poster
  • **
  • Posts: 712
  • Get the Picture !
Re: Questions about protection (I just noticed)
« Reply #10 on: July 09, 2008, 05:37:21 PM »
Interesting now my alternate dial-up provider (ISP) will not work.  After setting the SAME "proxy server setting" to BOTH my primary and alternate dial-up Internet Providers (ISP's) in both the IE6 and FF2 browsers yesterday my primary ISP (the one I usually use) was working fine as posted above (I had not tried my alternate ISP until now) but I NOW find that my alternate ISP will not work with the same "proxy server setting" that IS working with the other ISP.

IE6: gives me the white page message that web servers cannot be found.
FF2: gives me a message that says my "connection was reset".


If I "uncheck" the "proxy server setting" (which DOES WORK with one of my dial-up providers but does NOT WORK with this particular dial-up provider) then there is no problem with EITHER browser using this other ISP.

But of course in this case I am not getting Web Shield protection.

Is there any reason that ONE DIAL-UP ISP would NOT WORK with the same "proxy server setting" while another DIAL-UP ISP DOES WORK with the same "proxy server setting"?
« Last Edit: July 09, 2008, 05:49:44 PM by lakrsrool »
Processor: i3 2.53 GHz 4 GIG RAM, OS: WIN 7, Connection: High Speed, Virus/Malware Protection: Avast-2015, SpywareBlaster, Windows Firewall & Defender. Email: Outlook 2010 w/ POP Peeper Email Notifiers.