For your raised two cases:
1. The script is not in the Virus db yet. -> Start thinking heuristicly
2. You have the resident shield disabled. -> Define how encryption/decryption works and the data flow of all components
After this round of questions and answers, I feel like I must be at the bottom if a popularity contest is held now. Hopefully, at the end truth will forgive our ignorance. NO! MY IGNORANCE.
1. Start thinking and reading again. There is NO heuristics. Only the mail and outlook scanners have it.
2. The resident dont decrypt nothing, the data flow the same way if you dont have antivirus in your PC, but it will NOT scanned for malware,
As lukor said think and use your proclaimed knowledge.
According to this 2009 report -
http://www.anti-malware-test.com/?q=node/77, Avast! proactive component was praised for the satisfactory heuristic test result, and it never mentioned about Avast heuristic function only found in mail and outlook scanners.
>>
Products in the dark orange (80-100%) and light orange (60-80%) zones demonstrated excellent and good detection levels of new viruses (aged from 1 to 5 weeks, see methodology).
The majority of them (Avira Antivir Premium, Sophos Anti-Virus, Dr.Web, Kaspersky, Eset Nod32, BitDefender Antivirus, AVG Anti-Virus, Avast Professional Edition and Norton Anti-Virus) attained that level based on the contribution of their proactive component.
<<
Here is a recently discussed topic: "What happened to Avast in the latest AV-Comparatives Pro-active Test"
http://forum.avast.com/index.php?topic=45663.0with the reference of av-comparatives Proactive Test (May 2009):
http://www.av-comparatives.org/comparativesreviews/main-testsIn av-comparatives tests, the 2009/5 result showed 42% overall heuristic detection rate, garnered a 2% increase comparing to 2008/11 report. I am not even sure if this 42% has ruled out common signatures based detections.
I know Avast used to be heuristic but only limited on mail analysis as shown in this thread:
"AVAST RESIDENT SCANNER is using Heuristic analysis?"
http://forum.avast.com/index.php?topic=37044.0But, has Avast just started employing more heuristic analysis?
See this thread: "PnkBstrB.exe malware infection heuristic method used"
http://forum.avast.com/index.php?topic=43076.0and this: "Heuristic scanner detects TrustedInstaller.exe as suspicious"
http://forum.avast.com/index.php?topic=39310.0Where is heuristic component located? In the Resident Shield, Web Shield, or Script Blocker? Or, is it a separate component shared by others?