5 questions/issues using Avast

Avast Free Antivirus / Premium Security
1

I’m using Avast 4.1 home edition, build 4.1.342 VPS file 0402-1 on Win9x dialup old Pentium

w/ 98Mb ram

  1. I’m comparing Avast to Mcafee Virus scan. Scanning my c drive with Mcafee it scans 23,132 files (rate = 453.57/min) & comparing to Avast most thorough scan + archive scanned 19242 files (rate = 545.1/min).

my issue is with the difference in total files scanned (3890 files less with Avast ). What would account for
this difference? Can I adjust anything which will get me closer to total files scan by Mcafee?

Under shield > customize > advanced I only have the default 8 areas not scanned - surely this does not account for the missing 3890 files which Mcaffe scans but Avast does not?

  1. see screen shot

I can’t get the Avast initial splash screen for simple user interface to go away for the next time. When I check the box saying don’t show this window next time, I get Internet Explorer script error, line 220 char 26 error = Object doesn’t support this property or method

need help here getting rid of the above

  1. I’m still contemplating whether resident protection is better/worse than what Mcafee offers which is download scan - if virus/trojan is sniffed while on the net, it is caught on the fly before it gets to your hard drive.

Seems like with resident, if I understand correctly, nothing is scannned till it has reached your hard drive.

just like to know if the above is correct interpretation of how resident works. if not what please explain

  1. I noticed a new program in regcleaner called Ace Compression Software - software name ActiveAce - I hope this is related to Avast somehow (maybe needed for treasure chest compression)

please confirm if Ace Compression Software is related to Avast

  1. thorough scan reports show about 6 files skipped for 1 reason or another (corrupted or password protected was the reason given. example:

\spybot - search & destroy 1.1 \spybot - search & destroy\recovery\alexarelated.zip\related.htm result: unable to scan archive is password protected

the above file related.htm was taken out by Spybot and backed up by Spybot

question why is this difficult for Avast to scan?

Mcaffee does not have a problem scanning.

2

  1. Enable Avast to scan ALL files and see if that makes up the difference. I’m pretty sure it will scan even more files then McAfee then.

  2. That screenshot looks like an IE error to me. Disable script checking in IE.

  3. Resident protection also protects when you insert a removable media (cd/floppy etc). I prefer safe above sorry. And so what if a infected file reaches your hd? Avast will remove it, unless you choose to say no when it askes you. No harm will be done if you say yes.

  4. In order for Avast to be able to scan archives it needs ofcourse at least parts of compression software like zip, arj, ace, etc. I’m not sure if this entry in the registry is add there by Avast but if you haven’t installed WinAce there is a good change it is.

This is how I see it. But I’m sure one of the members of the Avast team will repsond very soon and will make additions/corrections to what I have been telling you.

3
1) I'm comparing Avast to Mcafee Virus scan. Scanning my c drive with Mcafee it scans 23,132 files (rate = 453.57/min) & comparing to Avast most thorough scan + archive scanned 19242 files (rate = 545.1/min).

my issue is with the difference in total files scanned (3890 files less with Avast ). What would account for
this difference? Can I adjust anything which will get me closer to total files scan by Mcafee?

Under shield > customize > advanced I only have the default 8 areas not scanned - surely this does not account for the missing 3890 files which Mcaffe scans but Avast does not?


I’d guess that it indeed is a result of some filetypes or filename extensions that are not checked by Avast but are checked by McAfee. In general, the number of files, is sometimes misleading, because some antivirus programs count also files inside archives as seperate files while other do not. McAfee does not, so this is not the case here.

2) see screen shot

I can’t get the Avast initial splash screen for simple user interface to go away for the next time. When I check the box saying don’t show this window next time, I get Internet Explorer script error, line 220 char 26 error = Object doesn’t support this property or method


I guess that the result is the same regardless of whether you answer the question with yes or with no.
I know that the November security update of Internet Explorer caused some help/chm files not to function correctly under Win98. They just set a killbit over some risky ActiveX instead of fixing it - part of the phasing out of the support for Win98. I am not sure that this is the case here. I assume that the February update has the same problem (because it is cumulative). Perhaps reinstallation (uninstall/reboot/reinstall/reboot) of Avast will do the trick.

3) I'm still contemplating whether resident protection is better/worse than what Mcafee offers which is download scan - if virus/trojan is sniffed while on the net, it is caught on the fly before it gets to your hard drive.

Seems like with resident, if I understand correctly, nothing is scannned till it has reached your hard drive.

just like to know if the above is correct interpretation of how resident works. if not what please explain


Really, it doesn’t matter, as long as you can eliminate the virus before it is activated. It can be eliminated by a proxy service before it is kept as a file, it can be eliminated only when there is an effort to save it. Different antivirus companies use different strategies. The considerations of antivirus developers regarding the way their produict provide active protection, is enough complicated that discussing it on the level of which tools are used, is too simplistic.

5) thorough scan reports show about 6 files skipped for 1 reason or another (corrupted or password protected was the reason given. example:

\spybot - search & destroy 1.1 \spybot - search & destroy\recovery\alexarelated.zip\related.htm result: unable to scan archive is password protected

the above file related.htm was taken out by Spybot and backed up by Spybot

question why is this difficult for Avast to scan?
Mcaffee does not have a problem scanning.


I don’t know the exact answer, but I do know that the files in the recovery folder of SpybotS&D are in unencrypted ZIP files (the ZIP files are not encrypted and not password protected).

4
1) I'm comparing Avast to Mcafee Virus scan. Scanning my c drive with Mcafee it scans 23,132 files (rate = 453.57/min) & comparing to Avast most thorough scan + archive scanned 19242 files (rate = 545.1/min).

It’s hard to tell without looking further. If you want to have this properly analyzed, you can send me scan logs (reports) of McAfee and avast and I’ll try to find what’s missing… To enable generation of the report file in avast, just start the main avast application, go to the menu, Settings, and make appropriate changes on the Report page. In your case, it makes sense to turn on reporting for all kind of results, even OK files.

2) see screen shot I can't get the Avast initial splash screen for simple user interface to go away for the next time. When I check the box saying don't show this window next time, I get Internet Explorer script error, line 220 char 26 error = Object doesn't support this property or method

Ah, this again!. Simply put: bug in IE introduced by one of the security updates. Fortunatelly, a patch is available from MS website. See: http://forum.avast.com/index.php?board=2;action=display;threadid=862 for more info.

3) I'm still contemplating whether resident protection is better/worse than what Mcafee offers which is download scan - if virus/trojan is sniffed while on the net, it is caught on the fly before it gets to your hard drive.

Indeed there’re various approaches to on-access scanning… I can’t comment on the McAfee’s because I’m not very familiar with it but I’m deeply confident that the one avast uses works… 8) But in your scenario, I’d recommend moving the slider from Normal to High.

4) I noticed a new program in regcleaner called Ace Compression Software - software name ActiveAce - I hope this is related to Avast somehow (maybe needed for treasure chest compression)

Yep. We use the Unace2.dll module to decompress ACE files (ACE is a compression method pretty popular mainly in the warez community). We’ve also noticed that this reg-key gets created. AFAIK, it’s completely benign - i.e. you can delete it… It will be recreated next time you start avast, though… I guess you’ll have to learn to live with it :slight_smile: :slight_smile:

5) thorough scan reports show about 6 files skipped for 1 reason or another (corrupted or password protected was the reason given. example:

\spybot - search & destroy 1.1 \spybot - search & destroy\recovery\alexarelated.zip\related.htm result: unable to scan archive is password protected

the above file related.htm was taken out by Spybot and backed up by Spybot

There are AV programs (including McAfee) that don’t warn about password-protected archives. avast does and we think it’s correct.

Of course, I’m assuming the file is really password protected here - to check this, try to unpack it using your favorite tool, or send the file to my e-mail address and I’ll check it out…

Hope this helps,
Vlk

5

Vlk,

Thanks.

It's hard to tell without looking further. If you want to have this properly analyzed, you can send me scan logs (reports) of McAfee and avast and I'll try to find what's missing...

I will run the reports and see what is missing. Should be pretty easy to compare. I may have additional comments after the comp.

There are AV programs (including McAfee) that don't warn about password-protected archives. avast does and we think it's correct.

Of course, I’m assuming the file is really password protected here - to check this, try to unpack it using your favorite tool

The archive file I tested was password protected as you said. Good idea to warn on these however maybe the message should be that of a warning and not just saying unable to scan. This is the message I got:

result: unable to scan archive is password protected

I right clicked the file and Avast was able to scan <=== this was my concern.

6

Vlk, I suppose it was because the option ‘show results of the explorer extension’ but not… :cry: Does this files could be ‘really’ scanned?

7

I guess it’s because the ‘scan file’ feature of the results dialog ignores (doesn’t report) ‘soft errors’…

But I may be wrong.

8

Yeah, that’s make sense. I have already noticed that…

9

I found the missing files, they were starring me in the face in the exception report (files not scanned)

Two corrupted java lib files which Mcafee “says it can scan”, but which can’t be scanned by Avast
accounted for the huge difference.

I actually like the result given by Avast 'cause it points you to an issue (possible corrupt file which may need to be addressed).

3) I'm still contemplating whether resident protection is better/worse than what Mcafee offers which is download scan - if virus/trojan is sniffed while on the net, it is caught on the fly before it gets to your hard drive.

Seems like with resident, if I understand correctly, nothing is scannned till it has reached your hard drive.

just like to know if the above is correct interpretation of how resident works. if not what please explain

My conclusion is it probably doesn’t matter. I prefer the way Mcafee seemingly intercepts before it hits your hard drive, but also impressed with the way Avast handles.

demo: go to eicar.org and select the first eicar.com demo you will see Avast jump into action and pick this off seemingly before it hits your hard drive it’s so fast, but actually it is picked off in cache and then you get to cancel the save download. No trace of the eicar.com file if you Avast delete (permenant), and cancel the save download.

http://www.eicar.org/anti_virus_test_file.htm

5) thorough scan reports show about 6 files skipped for 1 reason or another (corrupted or password protected was the reason given. example:

\spybot - search & destroy 1.1 \spybot - search & destroy\recovery\alexarelated.zip\related.htm result: unable to scan archive is password protected

the above file related.htm was taken out by Spybot and backed up by Spybot

question why is this difficult for Avast to scan?

Mcafee does not have a problem scanning.

Not true that Mcafee does not have a problem scanning password protected archive. It may say it has scanned, but not sure how effective it is. As proof of this I copied the eicar string into a notepad text file and then saved it in an archive password protected zip file. I created a second zip archive using the same method but left this archive without a password.

Next I tested Mcafee:

Result Mcafee is able to id the eicar.com in the archive without the password, but could not when I scanned the password protected archive zip.

Bottom line is I like the honesty presented by Avast on this. Upfront id’d files it could not scan. Ideally user would further investigate the exception report and take appropriate action.

sorry for being so long winded, but thought I would bring these questions full circle based on my own experience in case someone has similar issues and searches forum archives. 8)