Avast not defaulting to scan on creation?

[gelliss]

I've been testing various AV programs lately and thought Avast looked pretty nice.  I notice it hasn't tested highly on some reviews and I was testing it myself with eicar file downloads.  I was able to download eicar.com renamed to testfile.com and even run it without a single peep from Avast.  I was ready to trash the program.  

Looking in the options, I happened to notice on the Standard Shield "Customize" options that the option to scan files on creationg or modification was unchecked.  Why would they make that the default?  With that checked, Avast notified me even before the file downloaded to my desktop.  It made me wonder how many people might think Avast is scanning new files and protecting them when it's not.  

If it makes any difference, this was on a clean installation of Windows XP with SP2 slipstreamed in to it.  SP2 detects Avast but i'm still mystified why they wouldn't default to scanning all files on creation.

[Lisandro]

I'm still mystified why they wouldn't default to scanning all files on creation.

Well, it's a matter of taste...
avast! will caght the file as soon it's opened or executed.
If you want more security, just check to scan the file on creation (you will use more system resources with this, more secure less free resources...).

Next version of avast, as I heard, could have new levels of security:  High - Very High - Customize, solving the doubt you're talking... The user is not 'un-protected'...

[gelliss]

You missed one thing I mentioned in my post.  Avast DID let me run the eicar test file and never gave any warning at all.  A Command window opened and that was it.  If it had been an actual virus, Avast would have been useless in this case.

I was testing this to see how far Avast would let me go.  I downloaded the eicar test which used the name testfile.com.  I think.  either that or testfile.exe.  I kept expecting Avast to stop it or issue a warning but it let me run the file without a peep.

I was ready to trash the program as worthless since the test page mentioned if I didn't get any warning the AV wasn't doing it's job.  That's when I  found that option to scan on creation/modify.  As soon as I checked that and downloaded the test file again, Avast immediately popped up a warning.  I really think that should be the default for most users.

[Eddy]

If you use the eicar test, rename it to .com and try to run it, Avast picks it up like a beauty. My guess is you did something wrong. What vps are you using and what version of Avast? And as it is with almost all applications, installing is one thing, configuring it to your needs is another.

Please note that any(?) av application uses on-access scanning. So altering a file will not trigger a alert, but scanning does. As well as trying to open/run a file.

[gelliss]

I dont know what I could be doing wrong.  This is the free/home version of Avast, latest build as downloaded from their site yesterday.  4.1.418  I left everything at defaults except for adding one of the simple skins on the Avast page.

I just tried this test again with the exact same result.  The eicar test files are here:  http://www.eicar.org/anti_virus_test_file.htm
If I use the default options on the Standard Shield tab, Avast doesn't go off at all even when I download and run the file.   A Command box opens for an instant.

If I check the option on the Scanner(advanced) tab to scan on create/modify, then Avast's alarms go off.

One thing I noticed on that scanner(advanced) tab where the checkbox is to scan on open the list of extensions is blank.  I assumed it was using a default list.  Should exe, com and others be added to that?

One further oddity.  with the same option for scanning on create unchecked, Avast DOES go off if I download the zip file with the eicar.com test file inside.  It goes off if I try to unzip the file.  But there's no warning at all when running the eicar.com file itself.  Or is Avast actually doing something to block the eicar.com when I run it and just isn't notifying me?

[bilemke]

@gelliss

May I ask what version of Windows you are running? Does it happen to be XP SP2?

[gelliss]

Yes, It's Windows XP with SP2 installed.  Avast seems to default with that unchcked if at the "normal" security setting.  If you set it on high it's checked or you can do it manually with the custom.   Think SP2 could be causing something else?  Seems to work fine otherwise.

[bilemke]

That check box isnt normally needed to catch the eicar test. I tried it.. I bet I know what your problem is.. Check my last post in thread http://forum.avast.com/index.php?board=2;action=display;threadid=6110;start=30

It is on page 3 I just posted minutes ago again.

[Eddy]

I posted a reaction on this board somewhere about sp2. It is starting to look very much like ME. Promising alot and turning out to be very buggy.  

[bilemke]

@Eddy

The SP2 improvements are very welcome and long overdue by me. MS did say some things would go wrong, I suppose we are seeing an example here.. I am very interested to see this problem fixed with the Avast setup as it could be very dangerous and annoying at the same time.

[norxh]

I tried the test file using 4.1.418 VPS 0433-2.

On XP SP1 and SP2, Avast detects the eicar file on launch wether I name it com or exe and it properly warns me.

To tell if it is actually being blocked, open a command prompt and cd to the directory where you saved eicar, then type eicar and run it. If its actually running it will print "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!".

The shot below is a clean slipstreamed install. The only app installed is avast.

[bilemke]

@norxh

Correct you are.. Indeed it does keep it from running..

Without aswMonVD.dll in the registry correctly Avast just fails to notify you that it noticed it.

To know it is really stopping it is good, but bug is still present. It detects the virus, but doesnt notify you.. It is related to the issue I pointed to in the thread above.

[gelliss]

Thanks to all who helped track this down.  Bilemke, I added your key from the other thread and that was it.  Avast now gives the warning as it should.  This was also a slipstream install of XP-sp2.

I've been testing various AV programs with XP-2 lately.  I was an MS beta tester for it but frankly there are still some bugs and I'm afraid vendors will have to update their program files in some cases.  For instance bitdefender is also recognized by SP2 as is Avast.  The bug with that one is I lost the ability to right click and open folders on anything on the startmenu/programs list.    I reported that one to bitdefender.

[norxh]

@norxh

Correct you are.. Indeed it does keep it from running..

Without aswMonVD.dll in the registry correctly Avast just fails to notify you that it noticed it.

To know it is really stopping it is good, but bug is still present. It detects the virus, but doesnt notify you.. It is related to the issue I pointed to in the thread above.

The setup I did was a clean slipstreamed install of sp2 and avast. Avast correctly created said registry entry without any intervention by myself. All I did was run avast installer and notifications, right click scans, installers, everything mentioned in the thread worked as expected.

[bilemke]

The setup I did was a clean slipstreamed install of sp2 and avast. Avast correctly created said registry entry without any intervention by myself. All I did was run avast installer and notifications, right click scans, installers, everything mentioned in the thread worked as expected.

As did I, on over 8 machines now.. XP Home or Pro.. fails every time to produce the key.. When I say frest install, I mean it... The first thing (no drivers, programs etc at all before hand) I install is Avast.