I just formatted & reinstalled a friend's XP Home machine due to being too infected to fix.
It goes without saying, I installed Avast as part of my normal ritual.
In showing her how Avast's web shield module protects her, and would have prevented her last infection, I launched Opera and loaded a known infected website [JS Fake AV] that I use to show people how awesome Avast is.

Avast triggered as expected, however, the JS executed regardless behind the Avast warning.
I clicked the abort connection button and the damn script continued to run.
I can go to the same site with my machine and the JS never loads as Avast holds the connection and nukes it completely as soon as I click abort.
What could be wrong in her installation?