Avast Shields Question

[firzen771]

what exactly does the IM Shield and P2P shield do, since wuldnt the Standard Shield accomplish the same task in the end since the standard shield scans all files right?

[Cudni]

sounds it specifically supports and protects those apps
http://www.avast.com/eng/avast-free-home-antivirus-antispyware.html#7
"..
Avast features a module for the protection of IM (Instant Messaging, "chat") programs, and a module for the protection of P2P (peer-to-peer) programs. The list of supported IM and P2P programs is extensive with more than 30 programs currently supported.
.."

[firzen771]

-{ Quote: "sounds it specifically supports and protects those apps
http://www.avast.com/eng/avast-free-home-antivirus-antispyware.html#7
"..
Avast features a module for the protection of IM (Instant Messaging, "chat") programs, and a module for the protection of P2P (peer-to-peer) programs. The list of supported IM and P2P programs is extensive with more than 30 programs currently supported.
.."" }-

ye that says that it will scan files from those specific programs, but in the end doesnt the standard guard do the exact same since the file is being downloaded to the same place, ur hard drive?

[Cudni]

with all other security progs you got running i don't think you need to be concerned either way

[firzen771]

-{ Quote: "with all other security progs you got running i don't think you need to be concerned either way" }-

i guess but im really wondering if these extra shields are even worth running or if its just wasted resources, anybody got more info on this?

[bollity]

this feature is useless.
they added it just to cheat beginners and say: avast is full of features.
but more experienced users know that avast need to completely redesigned.
and this is what is going to be in version 5. you will see a different avast.
but what interest me is will be there a better engine and better detection rates ?

[Saraceno]

Even if you argue avast uses old technology, it's still been continually delivering the goods, even more than other programs which are considered more advanced.

By default, the standard and network shield aren't scanning every file.

I just did a search on their forum, and the following comments appear:

-{ Quote: "Q: Anyway,i think if something is infected in mess,standard shield will catch it...by i still wonder...what is then, the point of IM shield?
" }-
-{ Quote: "A: The IM shield checks for all file operations by the .exe of the IM process and scans them (unlike the Standard Shield). So, it is doing its best to make sure that that no malware can touch your disk surface rather than trying to find it after it got there.

http://forum.avast.com/index.php?topic=45298.0" }-

-{ Quote: "Q: How effective is the p2p shield?" }-

-{ Quote: "A: Well, it scans the activity of P2P programs and the accuracy of detection will be the same of other parts of avast.
But you can add final scanning with ashQuick.exe into your P2P program (which is it?). http://forum.avast.com/index.php?topic=44585.0" }-

Regarding utorrent, the p2p shield for this is disabled by default:

-{ Quote: ""Well uTorrent is supported, though is disabled by default as the way it works, creating hundreds of small files and this forces avast to scan those this can have an adverse impact on system performance.

So you could enable it for uTorrent in the P2P shield, Customize and see how it gets on." http://forum.avast.com/index.php?topic=42379.0" }-

There's a lot of info on it at avast's forum. I think if you use the programs supported in the list, and hopefully I'm assuming right, you're getting similar protection to web shield, scanning of files during downloads, rather than after the file is downloaded.

[Saraceno]

The standard shield set to normal doesn't scan all files, but only the ones in the extension list.

210238

Set the shield to high, and all files is now enabled. Or alternatively, go to 'customize' and select 'all files'.

210239

If you're using sandboxie or DefenseWall, I'd just go with Network and Standard. You could go with these two, even without sandboxie or DW, but I'd add Web Shield and Standard shield to scan all files.

I'd enable IM shield if you're using msn messenger (and it's not sandboxed). But to save resources, you could just enable the shield before using the IM program. avast makes it pretty easy to terminate/start services.

[firzen771]

-{ Quote: "The standard shield set to normal doesn't scan all files, but only the ones in the extension list.

210238

Set the shield to high, and all files is now enabled. Or alternatively, go to 'customize' and select 'all files'.

210239

If you're using sandboxie or DefenseWall, I'd just go with Network and Standard. You could go with these two, even without sandboxie or DW, but I'd add Web Shield and Standard shield to scan all files.

I'd enable IM shield if you're using msn messenger (and it's not sandboxed). But to save resources, you could just enable the shield before using the IM program. avast makes it pretty easy to terminate/start services." }-

why are some of ur components grayed out?

[Saraceno]

Terminated them (and selected yes to persist the change after reboot).

Avast uses about 15MB ram with just the standard and network shield on. Web shield adds another 40MB when many tabs open, but with DefenseWall, switched web shield off.

If you're wanting minimal resources, I'd select just standard, network and web. If your browser is covered, just leave standard and network. :)

For those unsure, see below:

210240

210241

[firzen771]

-{ Quote: "Terminated them (and selected yes to persist the change after reboot).

Avast uses about 15MB ram with just the standard and network shield on. ;)" }-

how do u do that?

EDIT:

nvm figured it out...

[Saraceno]

Make sure you're viewing 'more details'. Then terminate services not required.

210242

210243

[Saraceno]

Starting these back up takes about 3 seconds for each service. For example, if I'm browing unsandboxed or in my instance, with the process 'trusted' (DefenseWall), I'll switch the web shield back on.

I think the web shield, although using a little more memory, is one of the best features to keep on. Someone like RejZor might explain the difference, but the network shield does seem to be scanning each URL you visit, similar to the web shield. See pictures in post above.

Just visited google, then lifehacker, and noticed all advertising etc is scanned:

210244
210245
210246

[Saraceno]

Here's some discussion about the difference between network and web shield:
http://forum.avast.com/index.php?topic=38421.0

-{ Quote: "Network Shield filters traffic coming from all applications (not only browsers), and on all ports. For performance reasons, though, it tries a bit harder in case of the well-known HTTP ports.

Network Shield works on both DNS and HTTP level, i.e., blocks domains on DNS level, but in no way it's limited to whole domains only. The plan is to actually only block malicious URLs unless they're 100% certain there's no useful stuff hosted on the domain (in which case they will block it altogether). It can also block by IP's.

Also, Network Shield is a protection against known Internet worms/attacks. It analyses all network traffic and scans it for malicious contents. It can be also taken as a lightweight firewall (or more precisely, an IDS (Intrusion Detection System).
Network Shield protects you from internet worms that spread themselves via various security holes in your system. Typicaly these kind of viruses don't infect files but instead they attack running processes on your PC (either Windows components or some server programs like SQL Server, IIS etc.). These kind of attacks are not easily catched by ordinary antivirus during file or mail scanning. It is not a duplicate work with Standard Shield.
Basically, it covers all Internet worms. Such as Win32.CodeRed, Win32.SQLSlammer, Win32.Blaster, in32.Welchia (Nachi) and Win32.Sasser.

WebShield scans only http traffic on redirected ports (generally, 80 only). It stops the connection to malware even before the file is saved to the computer." }-

And post by RejZoR on second page:

-{ Quote: "Web Shield serves a different purpose. While Network Shield is checking malicious packets (like Sasser or MSBlast generated TCP traffic) and checking of webpage addresses, Web Shield is scanning the actual transfered data. So anytime you view a webpage, pretty much entire content of that webpage is scanned by avast! even before it actually enters the browsers and also all downloaded files that come through HTTP protocol are also scanned. This way you can prevent known exploits from affecting possibly still vulnerable browser.
It also prevents known bad downloads (files) from even reaching your hard drive.
Thats why it's almost critical to run at least Standard Shield, Network Shield and Web Shield providers together (not just one or another alone), because only together they fully cover wider range of possible security holes to your system and provide maximum security.
All other providers are not exactly necessary but they also provide additional protection layer depending on what programs you are using (email clients, P2P software, IM etc)." }-

So overall, it's best to run, Standard, Network, and Web Shield. I'll switch Web Shield back on, although using slightly more memory, most people want to know when a site is malicious.

[firzen771]

im running Network Shield + Script Blocking + Standard Shield + Web Shield. but i turn web shield off usually because i dont like the browsing slow downs. all the other shields, ive chosen to uninstall.

[RejZoR]

avast! Web Shield never really slowed down browsing for me or anyone who i know. But there might be problems on already crippled systems where its just a matter of time when they fail in one or another way.
In fact avast!'s Web Shield is from my experience the fastest HTTP scanner from the day it was introduced. It just works great. Unlike solutions found in NOD32, Kaspersky and BitDefender that were contantly failing and slowing down the browsing.

[mevcit]

-{ Quote: "ye that says that it will scan files from those specific programs, but in the end doesnt the standard guard do the exact same since the file is being downloaded to the same place, ur hard drive?" }-
In the home version, all the shields but standard shield are set to scan all arhive types by default. In the standard shield, only 4 of the 27 archive types in the list are selected (like droppers, self extractors...) (you can see these settings in the pro version). If you select the all 27 archive types for standard shield, then your pc may slow down significantly. So with im shield, p2p shield, web shield, some important open doors are controlled with maximum security without slowing down your pc. And btw, p2p and im shields work with standard shield; so they are also depended on standard shield settings. You can see my post about p2p shield on avast! forum here:
-{ Quote: "1) All shields were at normal level, I downloaded two malicious files with mp3 and zip format by FrostWire, and avast didn't detect them.
2) Then I set the level of p2p shield to high, again it didn't detect them as i expected.
3) After that I set the level of standard shield to high (that is, the setting named "All files" under the tab named "Scanner (Advanced)" was selected), i downloaded the same files and avast detected them. The detection of the mp3 file is normal, but how could it detect the file with zip format? Because in archive settings of the standard shield "ZIP archive" wasn't selected. Besides, when downloading a malicious zip archive by an internet browser, standard shield doesn't detect it (when web shield is paused), and i know this is normal since "ZIP archive" isn't selected.
4) I paused p2p shield and then downloaded the same files. This time, avast detected only the mp3 file. When i continued p2p shield, both of the files were detected, and as you know the all archive types are selected in the p2p shield settings. So can we say that p2p and standard shield work together when downloading a file from a p2p application?" }-
http://forum.avast.com/index.php?topic=42331.msg354891#msg354891

Web shield and network shield work as standalone. Since i don't use email shields of avast i don't have much info about them.

[ellison64]

-{ Quote: "avast! Web Shield never really slowed down browsing for me or anyone who i know. But there might be problems on already crippled systems where its just a matter of time when they fail in one or another way.
In fact avast!'s Web Shield is from my experience the fastest HTTP scanner from the day it was introduced. It just works great. Unlike solutions found in NOD32, Kaspersky and BitDefender that were contantly failing and slowing down the browsing." }-

I agree ,ive never had any slowdowns with the webshield.I even use admuncher with the webshield and there is no significant slowdown.I guess it may depend on the broadband or dial up that folks use.
ellison

[Someone]

-{ Quote: "Here's some discussion about the difference between network and web shield:
http://forum.avast.com/index.php?topic=38421.0



And post by RejZoR on second page:



So overall, it's best to run, Standard, Network, and Web Shield. I'll switch Web Shield back on, although using slightly more memory, most people want to know when a site is malicious." }-
Would the network shield ("Basically, it covers all Internet worms. Such as Win32.CodeRed, Win32.SQLSlammer, Win32.Blaster, in32.Welchia (Nachi) and Win32.Sasser.") overlap in function with a firewall?

[firzen771]

-{ Quote: "Would the network shield ("Basically, it covers all Internet worms. Such as Win32.CodeRed, Win32.SQLSlammer, Win32.Blaster, in32.Welchia (Nachi) and Win32.Sasser.") overlap in function with a firewall?" }-

no. its basically an IDS just like what NIS and many other suites have has. u can still run a FW with it

[Someone]

-{ Quote: "no. its basically an IDS just like what NIS and many other suites have has. u can still run a FW with it" }-
Cool, thanks for the answer.