in Vista, Avast allows non-admin user to disable protection or change settings

[system]

@igor post:20

You’re mixing too many things together.
ashAvast.exe is not the main program interface (on contrary, actually), and I don’t even know what you mean by main program interface.

Perhaps I am not using correct terms, as I am new to this software. The Start menu shortcut that Avast’s installer created launches ashAvast.exe which display splash screen “avast! 4.8 home edition”, so one would naturally conclude that is the main interface. If it is not, then where is the main interface? Where is the interface that will allow access to all menus and functions?

@igor post:20

let’s say this is by desing (at least for avast! Home/Pro, i.e. desktop versions - the manged clients, used in network environments, work more like you expect).

If it is by design, it doesn’t seem to make much sense. It doesn’t make sense to require an elevation prompt before allowing an Administrator to access the program, but not require any prompt for a Standard user. Other security software has implemented this properly, so I think Avast just needs to fix this area.

Thank you for your reply.

[Lisandro]

@igor post:20

Which I don’t think can be that easily bypassed from a limited user account.

Yes, Igor. You’re right. I was thinking as being an administrator. Sorry.

[igor0]

@tuttle post:21

The Start menu shortcut that Avast’s installer created launches ashAvast.exe which display splash screen “avast! 4.8 home edition”, so one would naturally conclude that is the main interface. If it is not, then where is the main interface? Where is the interface that will allow access to all menus and functions?

ashAvast.exe is just the splash screen - after it performs the memory test, it launches the corresponding interface (ashSimpl.exe, ashSimp2.exe, or ashEnhcd.exe in the Professional version).
I’m not saying all the options are there, especially in the Home version - the resident protection options are accessible through the tray icon.

@igor post:20

It doesn’t make sense to require an elevation prompt before allowing an Administrator to access the program, but not require any prompt for a Standard user.

Actually, it makes sense to me.
The thing is that the ordinary user is not expected to know the administrator credentials - i.e. there’s no reason the request elevation here. Of course, the scanner will scan only the objects the current user has access to.
If the scanner is started under administrator account, however, it can access all files, all processes, etc. - but only if the token is elevated first; therefore the UAC prompt.

[system]

Allowing a standard user to disable protection is not good design.

[system]

@olddog post:14

tuttle,

As I understand it, this forum is primarily about Avast free Home Edition. I would equate the degree of control you are advocating to a business or commercial environment, not a home situation. Perhaps it might be an option one would look for in a paid for commercially licenced package, but surely within the home environment, basic education on how to safely use the computer is a better approach.

I can understand that many home users do not want to bother with good security, but people are trying to make it clear that it is dangerous for even home users to use administrator privileges by default. It is entirely possible to drive a car without insurance, but when an accident happens, you will then wish you had insurance. It is entirely possible to use a computer without ever making backups, but when an accident happens or a drive goes bad, you could easily learn too late that backups are a necessity. Even home users should make backups, not just commercial users. Limiting use of administrator privileges is something you might discover has value, but when you do, it might be too late.

[system]

Firstly, thank you Alwil for producing and allowing free usage of your excellent software.
Secondly, I am a disappointed that Standard User is allowed to Pause or Stop Providers… This is against Vista philosophy where non-Administrator Account should never be allowed to modify system behaviour. [Writing logs and database to c:\Program Files\Alwil Software\Avast4\DATA\ is also the wrong place.]
The basic assumption should always be that non-Administrator Users should be protected from themselves. I fully appreciate that allowing system changes (even with passwords) was OK for 95/98/2000/XP, but in Vista and 7 (and hopefully forever more), UAC is the standard.