a few questions about avast 7 sheilds/settings

[truefrogs]

i recently updated to avast 7, i didn't install the behavior sheild, remote assistance or avast gadget. but all other sheilds/modules were installed. i've also disabled auto sandbax and streaming updates.

i've recentely learnt that the script sheild is completely useless without the behavior sheild also running. which seems a very odd to me, why allow people to install the script sheild without the behavior sheild, if it relies on it?

so what exactly does the script sheild do, ie: is it a significant security risk to not use it?

am i wright in thinking that the script sheild never used to rely on the behavior sheild in avast 6?
it used to work on my avast 6 installation (without the behavior sheild) or atleast it appeared to anyway (it would count scans in IE9 and WMP???

i really don't want to install the behavior sheild, i've allways had fairly major stability problems caused by it, on a few different computers (vista x86, win7 x86 and win 7 x64)

also are there any other sheilds/features that depend on either the behavior or script sheilds?

and a couple of questions about streaming updates
does streaming updates use much bandwidth or resources?
how often does streaming updates check for updates?
does streaming updates increase the risk of false possitives?

finally i have auto definition updates on, but set to check every 960 minutes (16 hours) does this effect anything other than the main deffinition updates?
btw, i have program updates are set to manual.

i don't mean to sound like i'm having a dig at avast, i've been a very happy avast user for many years now, and other than the behavior sheild i've had no trouble with avast and can't see myself changing to another anti-malware provider anytime soon 

thanks in advance 

[truefrogs]

more info about my set up's, if it helps
3 computers, avast is set up the same on all 3, all installed without the behavior sheild, remote assistance and gadget.
all 3 are behind a D-Link dir655 (B1) which also has a basic hardware firewall built in.

Desktop 1: vista sp2 x86: avast 7 free, firefox 11, ABP (with malware domains blocklist and easy privacy) malwarebytes free, windows defender on, windows firewall on.

Desktop 2: windows 7 sp1 x64: avast 7 internet security, firefox 11, ABP (with malware domains/easy privacy) malwarebytes pro, windows defender on, windows firewall off.

Laptop: windows 7 sp1 x86: avast 7 free, firefox 11, ABP (with malware domains/easy privacy) malwarebytes free, windows defender on, windows firewall on.

all 3 computers are fully upto date in terms of windows updates, java, flash, adobe reader, silverlight, divx, quicktime.

really hope someone can help me with my original post?
thanks 

[norel]

I believe the Script Shield and Behavior Shield can run independent of one another. The presence of one will probably enhance the other, but I don't think they're both required for either one to work. The Behavior Shield is more of an umbrella shield that monitors your whole system for malware like behavior. The Script Shield focuses more directly on malicious scripts that try to execute themselves.

All malware is just malicious script. The difference in the shields is how they go about detecting and removing it. The way the Script Shield differs from the Web Shield, for example, is it scans the whole system for malicious scripts, not just web pages, so if one gets by the Web Shield, or you get it some other way, and it tries to execute later, like when you reboot, the Script Shield should spring into action. The Behavior Shield would probably detect it when it actually tries to make unathorized changes to the registry or something.

[truefrogs]

thanks for the reply norel

however my script sheild hasn't scanned a single thing since i updated to avast 7 (clean install)
according to these 2 posts the script shield does need the behavior sheild in order to work

... since I removed other components today (behavior shield, IM and p2p shields ...), the script shield stopped working

The script shield needs the behavior shield to work.

Which reminds me that script shield, which is installed according to the picture, depends on other shields, if I'm not mistaken.

You're right, the script shield needs the behavior shield to run.

also if the behavior sheild only prevent unathorized changes to the registry or even system files? does't user account control take care of this sort of thing anyway?

[norel]

Okay, I was wrong. I uninstalled my BS and sure enough the SS stopped working. But with the BS installed, I can disable it with "Stop permanently" and the SS still works. That might be an option if the BS is causing stability issues. If you stop the BS you'll get a warning on the tray icon, but you can tell Avast to stop monitoring the status of that shield in Settings>Staus Bar>Untick "Behavior Shield." I tend to agree that if the SS has to depend on the BS you shouldn't be able to install one without the other. It would simplify life a little.

I guess I don't really understand the SS like I thought I did. A quick test seems to indicate it's scanning exactly the same things as the Web Shield. I'm not really sure if it's doing anything above and beyond what the Web Shield and File Shield can do or not.

UAC should help a lot with malicious behavior. I don't know how it compares with Avast's behavior shield though. From my experience with UAC it's very aggressive and causes more problems than it fixes, so I don't use it.

I don't use streaming updates or automatic updates either so someone else will have to field those questions. Sorry, but it would appear I've been fairly useless.

[truefrogs]

lol you're not useless at all 

ok so i'll install the behavior sheild then disable it, thanks for the advice.

i also prefere manual updates, but on manual or ask, streaming updates doesn't work, i'm assuming that reputation services also don't work when set up this way. so i'm using auto definition updates to make sure the cloud services are available.

i used to keep UAC off but then i started getting paranoid about security lol, so now it's on. it's seriously annoying at first but you get used to it.

[truefrogs]

ok i've followed your advice norel and it appears to work
i'm now gonna restart the computer again to see if it still works after a reboot

cheers

[truefrogs]

ok i rebooted and it seems to be working fine 

just one problem with the behavior shield disabled i have to live with this

[truefrogs]

i tried enableing the behavior shield again to get rid of that annoying warning.
it seems you HAVE to have "monitor the system for unauthorized modifications" enabled, yet it's ok to disable the whole shield, which makes no sense at all, but thats how it is 

anyway is setting up behavior shield like how i've done in this attachment a good idea, but also with it set to allowed instead of auto, is it better than having the behavior shield disabled, i'm only talking in terms of how it effects all the other shields, or would that make those shields worse off, compared to having it disabled?

i don't really trust the behavior shield set to auto, it's caused me too much hassle in the past.


one last thing, does anyone know if streaming updates increase the chances of false positive, at least in theory anyway?

cheers 

[Asyn]

one last thing, does anyone know if streaming updates increase the chances of false positive, at least in theory anyway?

In fact it lowers the risk of FPs.

[igor]

Streaming updates allow for faster reactions - the risk of FPs isn't really affected.
Yes, a streaming update may deliver a FP, just like any update does - but on the other hand, it can be (and is) used to solve previous FPs faster, before the arrival of the regular update (i.e. there's a higher probability that you won't be accessing/scanning the FP file in between, even if you have it on your disk).

[truefrogs]

thanks for all the input norel, asyn and igor 

i've enabled streaming updates now, it's obviously a good thing to have.

cheers

[Asyn]

1. thanks for all the input norel, asyn and igor 

2. i've enabled streaming updates now, it's obviously a good thing to have.

1. You're welcome.
2. It sure is.