Avira Heuristic Level

I am about to reformat and install Avira personal and wanted some opinions on what level I should set the heuristics on and Extended threat categories.

 

I see no reason not to use all threat categories.

The risk of false positives is higher with high heuristics, but personally, I haven't really noticed. They are very rare for me, and I use high heuristics. At the least, I think high on Webguard is a good idea. A false positive there will not mean having to deal with the worry that one of the files on your drive is infected.

 

Same here for me. Max. settings and have had very few false positives also.

 

Max heuristics and every threat caegory except for applications, games, and unusual runtime compression tools

 

Ive always used highest level heuristics with no problems, and also secure startup.

 

I used Avira for like a month a long time ago (2009-2010) and i always had it at HIGH heuristics, for me FP's were very very rare

 

leave everything as is, but set heuristics to high

 

• Secure startup (it takes only 2-3 seconds on every boot and gives higher level of security) ;
• High Heuristic (AV-C recommended!© ) ;
• All extended threat categories except:

• Double-extension files (I've enabled showing all extensions, so i don't need it. If I will see image.jpg.exe someday, then i will not execute it, and since i don't know how exactly it's implemented in Avira, I'd rather have to trust my senses then unknown technology [and possible False Positives]) ;
• Games (I like games, don't delete them, pl0x!!!111) ;
• Unusual runtime compression (if something is packed with UPX it doesn't necessary have to mean it's smth bad, right?).

​

It's nearly 3 AM here, please forgive me my grammar (and other) mistakes, related to this post.

 

High heuristics are not AV-C recommended as far as I know. It was a request of Avira to be tested with heuristics set at high for testing purposes.

 

quoting av-c (pg 5 of the latest on-demand test from august 2010 & the proactive test from nov 2010):

 

I always use highest heuristics and so far not a single product has overdone it. As far as well known vendors are concerned.

 

But when the vendor (in this case Avira) recommends a different level as default, what would be the reason for the average member of the public to change it. I'm not arguing but rather just trying to understand better,

 

I stand corrected as far as AV-C is concerned.

 

Because the one who even manages to find this setting will probably know what to do in an event of FP anyway.

 

in the case of avira, you're prompted to select the heuristic level that you're going to use during the installation. it also includes some boilerplate stuff about false detections, etc.

 

Has anyone noticed a resource hit running the high heuristics? This is usually my motivation to leave it at default, but now you guys have me thinking of setting it to high. I suppose I'll just have to try it and see.

 

I may get around to changing the heuristic level one day. But I've never encountered a FP or been infected with the default (medium) in place. Also I believe Avira may know their product a little better than AV-C.

 

It is AVIRA who told to AV-C to use high heuristics, although they know that same settings are applied also for FP testing and performance testing. This means that they know the tradeoffs and that they are probably small enough (FP rate and performance impact is minimal comapred to medium heuristic, but highest heuristic detect more) to get tested with highest heuristics. Due that, we recommend user to "consider" changing the settings and hope that the vendors will change their default settings to provide highest heuristic by default.

 

I was hoping you would chime in. Thanks.

 

Ok. I'll give it a shot.

 

My advice is to set the heuristics at 'high detection' level, and leave the 'extended threat' categories at its default values.

 

I've always had heuristic on high, and occasionally with version 9 I used to get some FPs (nothing serious though). With version 10 I had none since its inception.

I wonder if there is any interaction between heuristic and ProActiv.

 

mine are set to high, no issues.

 

I decided to select everything except games and unusual runtime compression which isn't default (wasn't sure about that one) prior to reading your post. I think I'll leave it like that for the time being and see how it goes. Any comments about unusual run time compression setting will be appreciated but not necessarily implimented.

 

Heuristics set at high, all threat categories checked with no issues or false positives so far.