http://screencast-o-matic.com/screenshots/u/Lh/1469282182388-80353.png
Which one set of the analysis ???
http://screencast-o-matic.com/screenshots/u/Lh/1469282355016-93482.png
http://screencast-o-matic.com/screenshots/u/Lh/1469282381336-11368.png
Basically HIPS not needed to the analysis.I put it 3rd.
@ lukor has pointed out the factor:https://forum.avast.com/index.php?topic=187679.90 see Reply #95
@ Bob
I think that your setting of HIPs means it isn’t running.
If I remember correctly, in one of RejZoR’s posts he asked about this and got this answer (I could be wrong):
1 bar = is not running (not its lowest level), 2 bars = medium, 3 bars = High.
That said I can’t see the point of that 1 bar = off, when there is a check box for the HIPS option.
One bar doesn’t mean off (unless HIPS is disabled), but auto-decide.
I recall in a topic by RejZoR about using max (all 3 bars) it was causing lots of problems. I still recall the point being made about 1 bar essentially being off.
I have had this enabled and on 1 bar (on both systems) for some considerable time and I haven’t had a single interception by avast HIPs.
The real problem is there is no direct information on its function in the avast Help (?) even the web page only makes a list of what is in that section, no detailed explanation of its function or settings.
It’s the other way around, 3 bars means you get asked if a detection is made.
Well as I said I wish they would bloody document it. As that would be what I would want in the same way I have all avast Shields set to ASK as the first choice.
But RejZoR did post about issues when HIPS was set to 3 bars, which would seem strange if it is only going to ask what you want to do.
Agreed, but I doubt it’ll happen. (Avast HIPS is a dead end street - no documentation, no development.)
But apparently still working in the background. 
Heuristics on max setting is fine (though I don’t know if it makes any change to be honest). HIPS caused severe problems because there was a bug.
As for the screening dialog, it’s a part of CyberCapture. I just don’t understand what triggers the quick screening that sometimes happens and what triggers the full fledged CyberCapture screening. From what I’ve observed quick one appears for unknown unique files that are not a download (generated locally or transferred from USB drive).
The file in the screenshot was downloaded from the internet but not scrutinized by Avast till it was run.
As I said, I’m not sure why unknown files don’t always trigger CyberCapture, even if received as download. One would expect it would ALWAYS submit the file to CyberCapture. But sometimes, for whatever reason, it just doesn’t.
Anyone here from the Avast team to explain this function?