Avast Rootkit Scanning

[Jack421]

Do you think the screen saver scans better for rootkits or does the boot time scan?

[doktornotor]

Definitely the latter. Also, http://public.avast.com/~gmerek/aswMBR.htm

[DavidR]

Definitely the latter. Also, http://public.avast.com/~gmerek/aswMBR.htm

Not necessarily as the screensaver scan is fully customisable and can be set to also do a full anti-rootkit scan amongst other things (see image). Not to mention you can run it in normal windows mode, plus you can configure other areas.

However, anti-rootkit scanning is done automatically 8 minutes after boot and is also incorporated into the Quick (super quick rootkit scan)and Full System scan (quick rootkit scan), so they are covered. Or you can create a custom scan and have a Full rootkit scan incorporated into it. So there really should be no need to run a boot-time scan just to get a rootkit scan done.

[doktornotor]

Not necessarily as the screensaver scan is fully customisable and can be set to also do a full anti-rootkit scan amongst other things (see image). Not to mention you can run it in normal windows mode, plus you can configure other areas.

That is the main reason it cannot be as effective as boot time scan. By the time you have Windows fully running, you cannot really trust what the system says about itself when it comes to rootkits.

[Lisandro]

Do you think the screen saver scans better for rootkits or does the boot time scan?

Boot time scanning

[DavidR]

Not necessarily as the screensaver scan is fully customisable and can be set to also do a full anti-rootkit scan amongst other things (see image). Not to mention you can run it in normal windows mode, plus you can configure other areas.

That is the main reason it cannot be as effective as boot time scan. By the time you have Windows fully running, you cannot really trust what the system says about itself when it comes to rootkits.

Again not necessarily, I have often wondered about the ability to detect rootkits on a boot-time scan, given that some of them may not yet be active. Why else would avast run its default rootkit scan 8 minutes after boot

One of the ways of detecting rootkits is to compare what is actually running against what the Windows API reports as running, so this particular method may not be available, depending on just what has loaded in windows at the time the boot-time scan kicks in.

So this really isn't clear cut.