newbie with Avast Autosandbox

[Dch48]

Installed HDD Health. There are entries in the Behavior Shield log which allowed it's actions but there was no sandbox alert and there still is no sandbox log file. The Behavior Shield is set to auto-decide and the sandbox to ask.

[bluenite]

well, tried this HDD Health, worked properly with Autosandbox. And that log file was made based on this decision.
I found another detail in it: I opened Anvir Task Manager before first one and Avast registered this activity without asking...
How he knows to do it as needed to prompt?
Peter

28.2.2011 15:18:47   Autosandbox candidate: C:\TOOLS\ANVIR TASK MANAGER FREE\ANVIR.EXE
   [Source: ]
   [Opened by: C:\Tools\AnVir Task Manager Free\AnVir.exe]
    --> Result: Not sandboxing (because the file is trusted).

28.2.2011 15:24:22   Autosandbox candidate: C:\Program Files\HDD Health\hddhealth.exe
   [Source: ]
   [Opened by: C:\Documents and Settings\Administrator\Plocha\hddh.exe]
    --> Result: Sandboxing (based on user's decision).

[blinkybill]

Hi,

In Windows 7 32bit my autoSandbox log is in Local Disk (C:)>ProgramData>Awil Software>Avast5>log.



cheers
blinky

[DavidR]

That is because you did an update from avast 5.x to avast 6.0 as it would have been a massive task to change the program folder name and all associated registry entries.

Those who did a clean install of avast 6.0 will have a new Avast Software folder instead of Alwil Software and a sub-folder of Avast instead of avast5.

[bluenite]

of course clean install: to a new directory. Do not mix together, never with the old one. So I do now, but the result is the same.
I am interested in assessing how the program is suspect for Autosandbox?

[Lisandro]

I am interested in assessing how the program is suspect for Autosandbox?

Analysis (behavior, heuristics, etc.) done by the file shield.
Rules are added in the virus definitions, i.e., could be updated frequently.

[DavidR]

of course clean install: to a new directory. Do not mix together, never with the old one. So I do now, but the result is the same.
<snip>

Not sure if you think my post was directed to you. My comment was directed to the poster immediately above my post (blinkybill), or I would have quoted the post I was commenting on, as I have in this one.