Author Topic: Manually exiting Avast! without turning off self-protection module  (Read 14388 times)

0 Members and 1 Guest are viewing this topic.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Manually exiting Avast! without turning off self-protection module
« Reply #15 on: May 02, 2010, 06:42:34 PM »
I guess I'm an extraodinary man then.  I've never been infected since I put this computer together in 2000.

Well... you think so ;)

I'm not following you here.  I'm going to have Avast! either on or off, when it's off, I'd like it all off, when it's on I'd probably just be running the basic file access scanning (not the web scanning).

I'm saying that if you stop the resident protection, the self-defense is pointless (it's there to prevent killing the antivirus by an unknown malware - but if you stop the resident protection, the antivirus doesn't run anyway) - so if you want to "use" the antivirus this way, simply disable the self-defense as well... I don't see why you want to have the resident protection stopped and self-defense active.


As for why the consent dialog isn't there for killing AvastUi... I assume because there exists a common "interface" for stopping services (which the user can invoke from the Service manager, for example) - while killing a process is quite a special action. Besides, I don't know why you'd want to kill AvastUI anyway - if you don't want it running, remove the corresponding auto-start entry from registry.

beyondo

  • Guest
Re: Manually exiting Avast! without turning off self-protection module
« Reply #16 on: May 02, 2010, 06:57:05 PM »
I'm saying that if you stop the resident protection, the self-defense is pointless (it's there to prevent killing the antivirus by an unknown malware - but if you stop the resident protection, the antivirus doesn't run anyway) - so if you want to "use" the antivirus this way, simply disable the self-defense as well... I don't see why you want to have the resident protection stopped and self-defense active.
Ok, I see what you're saying.  The reason I want to be able to shut everything down without turning off
the self-defense is that it's another thing I'd have to re-enable when I want to use Avast!.  Right now,
I have the main service set to manual, not automatic, and the AvastUI removed from the auto-start list.
Thus, I boot windows and Avast! is not running.  I can launch the main service manually, and then
click on the icon to launch AvastUI.exe and I'm good to go--two steps.  If I had disabled the
self-protection, then I'd need to go into settings and re-enable it, another step to remember.

As for why the consent dialog isn't there for killing AvastUi... I assume because there exists a common "interface" for stopping services (which the user can invoke from the Service manager, for example) - while killing a process is quite a special action. Besides, I don't know why you'd want to kill AvastUI anyway - if you don't want it running, remove the corresponding auto-start entry from registry.
See the above.  The reason is that though I indeed have the machine configured so Avast! doesn't run
on boot, if I do run Avast! and then want to stop running it, I can't shut down the AvastUI process without
shutting off the self-defense module, which I then must re-enable since I want to use it when I use Avast.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Manually exiting Avast! without turning off self-protection module
« Reply #17 on: May 02, 2010, 07:06:25 PM »
What I'm trying to say is that those times when you're running with the resident protection disabled are such a "security hole" - that it doesn't matter if you have the self-defense enabled or not for the rest of the time.

Anyway, I don't think there's any plan to add the consent dialog even for killing of AvastUi process at the moment; quite a lot of work with zero benefit.

beyondo

  • Guest
Re: Manually exiting Avast! without turning off self-protection module
« Reply #18 on: May 02, 2010, 07:26:10 PM »
What I'm trying to say is that those times when you're running with the resident protection disabled are such a "security hole" - that it doesn't matter if you have the self-defense enabled or not for the rest of the time.
So you're saying that because I choose to disable the Avast! completely at times when I'm, say,
playing a local game on my PC and not even connected to the web, that all of sudden I'm so compromised
it doesn't matter whether I protect the virus program from being killed off by malware when I actually
have it running, say during a new program install?

Well, you're entitled to your opinion, of course, but I don't believe that statement.

Anyway, I don't think there's any plan to add the consent dialog even for killing of AvastUi process at the moment; quite a lot of work with zero benefit.
I described the positive (>0) benefit above when I described how I wanted to exit Avast! cleanly with as few
steps as possible.  Lacking that feature adds a step.  It's hard to believe it's a "lot of work" since it would seem
the same modal code that you already use for service shutdown could be used,  but I'll take your word for it.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Manually exiting Avast! without turning off self-protection module
« Reply #19 on: May 03, 2010, 01:04:21 AM »
Well, your IT dept. definitely needs a sanity check...  ::) :o

+1 ;D
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Dch48

  • Guest
Re: Manually exiting Avast! without turning off self-protection module
« Reply #20 on: May 03, 2010, 03:58:50 AM »
Well if you read the forums for MSE, people wwere having problems with the AV not being updated for days at a time and they were told that the definitions are only considered out of date when they are more than a week old and they shouldn't worry unless it goes past that without getting an update. So it isn't only that IT department that thinks that way.

Hermite15

  • Guest
Re: Manually exiting Avast! without turning off self-protection module
« Reply #21 on: May 03, 2010, 11:20:40 AM »
Well if you read the forums for MSE, people wwere having problems with the AV not being updated for days at a time and they were told that the definitions are only considered out of date when they are more than a week old and they shouldn't worry unless it goes past that without getting an update. So it isn't only that IT department that thinks that way.

yeah that's also what I was thinking of when reading the thread here yesterday. But the OP is talking about 30 days without updating, not a week. I've been posting and complaining in that TechNet thread about MSE (first version only, it's been fixed now) not updating automatically and regularly during the first weeks (months actually) following the official release. But I got to admit that nobody is indeed very likely to have his system attacked by the latest threat on the web. And updating AVs twice a day is also overkill, not mentioning those (like bitdefender) updating every hour ;D this is ridiculous, and often just done for the hype ::)

PapaSmurf

  • Guest
Re: Manually exiting Avast! without turning off self-protection module
« Reply #22 on: May 03, 2010, 12:40:40 PM »
Well, your IT dept. definitely needs a sanity check...  ::) :o

Not really, this is common. Most large IT's worry more about stopping threats at the server level. They just do not allow problems to enter the company. The individual scanners are more or less a secondary defensive response in the event that something may be missed at the server level.

However, to use avast in the sort of on/off method being discussed can be done with care. The operator would need to manually check for updates prior to any new installations, do the install, and then just to be safe, scan the install directory after install.
As far as the ui and protection module, this may be something the operator has to put up with. I know it is
not what you want to hear, but I do not think a "universal" kill switch will be added for the simple reason that as stated before, avast was not designed to be an "on demand" type of scanner. But it is
MUCH better than the system cows, (Norton, McAfee), at least you CAN kill the services in avast.
Just another opinion....happy computing :)

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Manually exiting Avast! without turning off self-protection module
« Reply #23 on: May 03, 2010, 12:50:51 PM »
I described the positive (>0) benefit above when I described how I wanted to exit Avast! cleanly with as few
steps as possible.  Lacking that feature adds a step.

What I meant is that it would save some work for you... and maybe a few other people - but tens of millions of other users don't need it. I believe the time can be spent in a more efficient way, i.e. on something most users would benefit from.

It's hard to believe it's a "lot of work" since it would seem
the same modal code that you already use for service shutdown could be used,  but I'll take your word for it.

I didn't mean the UI window itself (though yes, a new text would be needed, and translating it into almost 30 languages takes quite some time) - but rather the kernel mode code. Killing a process is a different action than stopping a service (where a "nice" interface for stop-request exists) - so a communication from the kernel driver into the user mode would have to be implemented, the consent dialog would be shown - and then the information has to go back into kernel and trigger an action.
Actually, I'm not completely sure if this could be done at all - because the filtering (causing the later "access denied") isn't done when the kill is requested, but earlier, when the process is opened - so in the end, you might see this warning screen pretty often, even when nobody is trying to kill the process, but just to show some info about it.

Dch48

  • Guest
Re: Manually exiting Avast! without turning off self-protection module
« Reply #24 on: May 03, 2010, 05:53:12 PM »
Well if you read the forums for MSE, people wwere having problems with the AV not being updated for days at a time and they were told that the definitions are only considered out of date when they are more than a week old and they shouldn't worry unless it goes past that without getting an update. So it isn't only that IT department that thinks that way.

yeah that's also what I was thinking of when reading the thread here yesterday. But the OP is talking about 30 days without updating, not a week. I've been posting and complaining in that TechNet thread about MSE (first version only, it's been fixed now) not updating automatically and regularly during the first weeks (months actually) following the official release. But I got to admit that nobody is indeed very likely to have his system attacked by the latest threat on the web. And updating AVs twice a day is also overkill, not mentioning those (like bitdefender) updating every hour ;D this is ridiculous, and often just done for the hype ::)
I'm getting 2 updates per day with Avast!5 Free, is that overkill?  lol  ;D

(Also--Norton is not a system cow, especially since the 2009 version. It is extremely lightweight and has no noticeable effect on performance. It never did for me and I used the AV from 2000-2005 and NIS from 2005-2009. I never had any issues of any kind, not even with uninstalling the various versions.)

Hermite15

  • Guest
Re: Manually exiting Avast! without turning off self-protection module
« Reply #25 on: May 03, 2010, 07:19:52 PM »
Quote
I'm getting 2 updates per day with Avast!5 Free, is that overkill?
definitely yes
« Last Edit: May 03, 2010, 07:21:23 PM by Logos »