That would work if I wanted to know if the avast was working in general. However, that doesn't nesecarily show whether it's been suberted. Back when I used to be more in the know about this sort of thing, there was talk of virus's that would use a anti-virus in order to knock out all it's competitors, and even ignoring that, it's far more likely that the virus would just remove the signatures relating to it or just prevent it's files from being scanned/convincing the scanner (however forcefully) that it did not exist.
In my recent virus attack, for example, I ran a copy of combo fix, which to it's credit immediately diagnosed the problem, albet due to itself being subverted. But I was amazed to discover while looking through the process in the hope of fining where exactly the virus had saved itself/what processes it had been attached to it, I found a highly detailed script of what the virus wanted the program to say, over multiple reboots, ending in the death of the computer.
To be honest, given the inablity for any program to remove this virus (which according to combo fix, is a virut type, both scanning while logged on to that computer and accessing it through other operating systems, I'm inclined to think that sudden strange changes in programs are a much better indicators of the more serious malware out there than actual virus scans. Which is why in some way's process explorer has become vastly more useful since it became incredibly popular, as now the first sign of a virus is for the program to suddenly less than full functioning, Although it isn't the same on linux.
