Author Topic: What exactly does behavior shield block?  (Read 3679 times)

0 Members and 1 Guest are viewing this topic.

rdeng

  • Guest
What exactly does behavior shield block?
« on: January 23, 2010, 03:00:47 AM »
Behavior shield shows malware detected but I never get an alert saying that malware was block. Also does behavior shield only work on computer start up? It never seems to show any activity after computer boots. 

norel

  • Guest
Re: What exactly does behavior shield block?
« Reply #1 on: January 23, 2010, 04:02:10 AM »
Check this thread out. Not a lot, but the best I could find.

Offline cska133

  • Sr. Member
  • ****
  • Posts: 313
Re: What exactly does behavior shield block?
« Reply #2 on: January 23, 2010, 04:21:06 AM »
Quote
it refers to a set of rules that do exist currently only for 32 bit systems

oh not again >:(
And it is said that version 5 is fully compatible on .... 32/64Bit >:( But not yet.
And when?

Offline Bluesman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 926
  • Amiga Power!
Re: What exactly does behavior shield block?
« Reply #3 on: January 23, 2010, 02:37:00 PM »
"The blues are the roots, everything else is the fruits" -Willie Dixon

Hermite15

  • Guest
Re: What exactly does behavior shield block?
« Reply #4 on: January 23, 2010, 03:13:30 PM »
And when?

When it's ready

it's not just when it's ready. There seem to be issues to interfere with Windows patchguard on 64 bit OS yes, but the other thing is also that 64 bit Windows doesn't need so much protection, it's by nature immune to most rootkits (currently), at least from what I read in an MS article, and it's been also mentioned and acknowledged by some avast devs. So a behavior shield might be just useless on 64 bit OS  ;) Sounds in fact like it's the same feature (kernel protection) that prevents both third party security software from interfering and rootkits from attacking  ;D

see here:
http://blogs.technet.com/mmpc/archive/2010/01/07/some-observations-on-rootkits.aspx



Quote
An unspoiled landscape

As Joe pointed out in his recent post on the 64-bit malware landscape, running 64-bit Windows offers even more protection for customers. For the rootkit space, the difference between 64-bit and 32-bit is even more pronounced

Quote
In fact, it's likely that an even smaller percentage of the reported rootkit threats from 64-bit computers were actually able to successfully become active and hide anything. Enforced driver signing and features such as Kernel Patch Protection make 64-bit Windows a much more hostile environment for rootkits.

Quote
# Keep real-time protection enabled
while running up-to-date antimalware software is essential, it does little good if you turn off the real-time protection feature. If you lower your defenses and a rootkit does get through, finding and removing it can be a tricky endeavor. Keep your defenses up and you're much less likely to have headaches down the road.
# Run 64-bit Windows
for the time being, it appears that currently, users running 64 bit Windows are less likely to be compromised by rootkits. While the threat landscape is constantly evolving, for now you can breathe a lot easier if you're running 64-bit Windows. If you have a choice, go with 64-bit

adding: unfortunately, as you know, most 32 bits apps can run on 64 bit windows, and that comes at a price:

Quote
There are still many threats that can affect 64-bit Windows, unfortunately. One other feature of 64-bit Windows is WOW64 – which is an acronym for Windows On Windows 64. WOW64 emulates a 32-bit Windows environment to allow software to run on the 64-bit operating system, which is great for compatibility with applications that haven’t ported to 64-bit yet, but also allows malicious code to grab a foothold. Even though these threats may run, since they’re running in the 32-bit emulated Windows environment they can do less to your computer, and don’t see 64-bit processes at all. For the same reason, 64-bit Windows needs 64-bit antimalware software like Microsoft Security Essentials to protect the whole computer
http://blogs.technet.com/mmpc/archive/2009/11/16/whats-another-32bits-to-malware.aspx
so there will be issues protecting the system in this added 32 bit environment as patchguard is still there.
« Last Edit: January 23, 2010, 03:23:54 PM by Logos »