Is 5.0 Behavior Shield really useful?

Since I disabled Behavior Shield on my .377 installation, I have had no blue screens. So I’m wondering if I’m really losing out much in protection? (I don’t intend to upgrade to the .393 build until it’s out of Beta)

I disabled it too and version 377 works much better??? :stuck_out_tongue: At least on my pc.

the behavior shield is really usefull to catch malware that is not detected by signature. every major AV has something like that, so avast is just catching up in this regard.

On my windows 7 64 bit OS the behavior shield don’t scanned still nothing on 1 week of use this is normal?

behavior shield doesn’t work for me either on win 7 x64. i’m actually glad of this since it seems to cause alot of problems. i won’t upgrade to .393 until it comes out of beta.

yes it’s normal and it’s gonna stay that way for a while from what I read. There are no ruleset for the BS on 64 bit OS. It’s complicated to make any (patchguard!) and 64 bit OS is more secure so it may be unneeded.

Just to clarify, avast! uses heuristics as well as signatures in its various modules.
Turning off the Behavior Shield does not affect that.

I am running Avast with all its Shields up. And so far so good (thank God). It does serve a purpose. While 64 bit OSes may be more secure now, I just cannot let my guard down as we all know what is secure today is not by tomorrow. So the Behavior Shield does add that layer of protection. Besides, it doesn’t consume that much of resources (when my PC is idle the CPU is just at 0%. And when surfing and I know avast is actively scanning, it barely jumps up to 15% (average of 5-10%). So I guess there is nothing wrong with it running either), at least in my PC.

I am currently using Windows 7 Ultimate 64 bit.

I don’t think heuristic is the same with behavior blocking. anyway, not exactly the same. I found a description about the two:

“In vastly simplified terms, heuristics inspects the CODE of a file and tries to guess what that code does, and/or checks it for similarities with already known malware to detect new variants. A behavior blocker monitors the ACTIONS performed by a program in real-time like a HIPS does, and steps in when it detects potentially malicious behavior. There is a grey area between the two, as some AVs’ heuristics are somewhat behavior-blocker-like (using emulation).”

would be nice to have someone from the Alwil team to step in and explain that for us.

Don’t hold your breath. No company or forum mod has responded to either of my two topics today.

For me the behavior shield is currently more or less placebo.
I got a testfile yesterday that was not detected by avast.
But it was found by threatfire (stopped by behavior) and also by immunet protect (stopped by common intelligence of all supported av-products by immunet).
(Hash match in the cloud).

This is really sad from avast…
See analysis: http://goo.gl/Ub6o

Of course I sent the file to the avast virus lab. But it leaves a bitter taste, especially for the behavior blocker that is supposed to be the new killer feature…