v3: Does disabling Web access protection really work?

I have 3.0.694 on Win7, and had Web Access Protection as viewed in the main UI on Disabled.

I happened to be in Win7's Resource Monitor looking at networking, when I noticed consistent network activity on ekrn.exe corresponding to various Internet addresses and sites (I was using my browser actively at the time). Odd, since WAP was disabled.

So I drilled into NOD's Advanced tree and found that HTTP checking, a subsection of WAP, was enabled.

I read the help and the manual but still don't quite get the distinction between the two. More to the point, why is it when a feature is disabled at the top level (main UI or at the top of the WAP tree in advanced) that the entire feature isn't disabled?

Unchecking HTTP did the trick, but I only stumbled on this issue accidentally.

Side issue: when you uncheck HTTP and then go to Setup/Antivirus and antispyware in the main UI, WAP reports as "Malfunctioning" instead of Disabled. Setup in the main UI, which is directly adjacent, shows it correctly as Disabled.

 

In the main program window you can temporarily disable scanning, e.g. if you need to download something that you're certain is clean. Disabling HTTP checking in the advanced setup tree causes the downloaded data not to be routed through the internal proxy for scanning at all. This may resolve potential conflict with applications that don't work correctly with the http traffic routed through a proxy.

 

OK, but if WAP is enabled and the HTTP proxy is disabled, what exactly is WAP doing?

In my limited understanding of it, I expected that the proxy filter would be fundamental to WAP, but since you can enable/disable each independently of each other (in Advanced), that's apparently not the case.

 

Disabling HTTP checking in the advanced setup tree will cause web protection non-functional which is indicated in the protection status pane by the "i" icon next to "Antivirus and antispyware". In the Setup section - Antivirus and antispyware - Web access protection is shown as non-functional and cannot be enabled unless HTTP checking is turned on in the advanced setup tree.