About avast! - welcome

Welcome to avast! antivirus 7.0

Thank you for installing avast! antivirus 7.0, one of the best antivirus programs in its category. We hope that you will be satisfied with avast! and that you will enjoy using the program.

avast! is a package of applications that aim to protect your computer from a possible virus infection or other malware threat. If you use it correctly, and in combination with other programs such as data backup utilities, it will significantly reduce the risk of your computer being attacked or infected by a virus, and thus the risk of losing important or private data.

Based on the award-winning avast! antivirus engine, avast! antivirus 7.0 contains all of the features you would expect in a modern antivirus program. It incorporates anti-spyware technology certified by West Coast Labs' Checkmark process, as well as anti-rootkit and strong self-protection capabilities, but now provides even faster scanning with improved detection ability. It contains several real-time "Shields" which continuously monitor your email and internet connections and check the files on your computer whenever they are opened or closed.

avast! antivirus 7.0 includes an AutoSandbox so that suspicious applications can be run automatically in a safe, secure environment without the risk of any damage being caused to your system. It also includes the optional avast! WebRep feature, which provides you with information about the content and security of websites that you visit based on ratings provided by the avast! user community.

avast! Pro antivirus 7.0 offers a number of additional features, including the avast! SafeZone, which allows you to manage your sensitive transactions in a private, secure area, invisible to the rest of your system. avast! Internet Security 7.0 also comes with an antispam filter and built-in firewall.

Once installed, avast! runs silently in the background to protect your computer against all known forms of malware. You don't need to do anything else - just install and forget!

These help files have been created to help you understand how the program works as a whole, as well as describing the properties and functions of its component parts. We assume the user has knowledge of basic terms and the basic skills needed to use the Windows operating system. If you are not familiar with terms such as "folder", "file", or "window", or what it means to "activate a window" or "click a button", we recommend that you consult the appropriate user manual before proceeding.


Compare avast! editions

avast! antivirus 7.0

avast! antivirus 7.0 comprises three new products - avast! Free antivirus 7.0, avast! Pro antivirus 7.0 and avast! Internet Security 7.0. The key features of these three products are compared in the table below.

 | avast! Free antivirus 7.0 | avast! Pro antivirus 7.0 | avast! Internet Security 7.0
High performance antivirus engine | YES | YES | YES
Anti-rootkit protection | YES | YES | YES
Anti-spyware protection | YES | YES | YES
avast! WebRep | YES | YES | YES
avast! AutoSandbox | YES | YES | YES
avast! Sandbox | NO | YES | YES
avast! SafeZone | NO | YES | YES
Command line scanner | NO | YES | YES
Anti-spam filter | NO | NO | YES
Built-in firewall | NO | NO | YES

avast! Free antivirus 7.0 can be downloaded and used completely free of charge. avast! Pro antivirus 7.0 and avast! Internet Security 7.0 can be downloaded and used free of charge for a 30-day trial period, but at the end of the trial period it is necessary to purchase a license key to insert into the program. Detailed information on prices can be found on our web pages.

Copyright © 1988-2012 AVAST Software.
All Rights Reserved.


Registration

avast! Free antivirus can be downloaded and used completely free of charge, however, you will need to register your use of the program within 30 days if you wish to continue to use it after that time. This will ensure that you continue to receive virus definitions updates and therefore remain protected against the very latest threats.

The easiest way to register is to just open the Maintenance tab on the left side of the screen and then click on Registration. Here you will see your current registration status e.g. "not yet registered". To register click on Register Now.

A new window will open where you will need to enter a few basic details, then just click on "Register for free license" and your registration will be completed.

If you are using avast! on a computer that is not currently connected to the Internet, you can register on another computer by completing our online registration form. From the registration screen, simply click on "Registration form". After entering your registration details, an email containing your license key will be sent to the email address that you entered. When you receive the email, follow the instructions to copy the license key, then open the avast! registration screen and click on "Insert the license key". In the new window that opens make sure the full license key is entered and that it exactly matches the license key that was sent in the email.

You can now continue to use the program, and will continue to receive updates for a further 12 months to ensure you remain protected against the latest threats.

You will need to re-register each 12 months, but before then, you will see a message on the main summary screen informing you that your registration is due to expire. All you need to do is re-register and your protection will be renewed for another 12 months.


Subscription

avast! Pro antivirus and avast! Internet Security can be downloaded and used free of charge for a 30-day trial period. If you decide that you would like to continue using the program after the trial period, you will need to purchase a license which will need to be inserted into the program. This will ensure that you continue to receive updates to your virus definitions and remain protected against the very latest threats.

Licenses for avast! Pro antivirus and avast! Internet Security can be purchased for 1, 2, or 3 years and for 1, 3, 5, or 10 computers for use in your home or on your small home/office network. Licenses can be purchased via our website, www.avast.com.

After receiving your license file, you just need to double-click to open it and your license will be inserted into your program automatically. You can now continue to use your avast! antivirus for the duration of your license and you will continue to receive automatic updates to both the program and your virus definitions.

Alternatively, save the license file on your computer, open the avast! interface and click on the Maintenance tab. Next click on "Subscription" and then on "Insert license file". A new window will open where you can browse your computer to locate your license file. Once you have located it, double click on it and it will be automatically inserted into the program.

If you have purchased a multi-license to protect several computers, you will need to carry out the same process on each computer where avast! is installed e.g. by forwarding the email with the license key attachment to each user, or by saving the license file on a shared drive, USB stick etc.

If you have activated the Ongoing Protection Service (Auto-Renewal), your subscription will be renewed automatically before your current license expires. You will receive advance notification of your upcoming renewal and the renewed license will be valid from the date your current license expires, so you won't lose a single day of your subscription. You can cancel the auto-renewal at any time through the avast! Support page.


Technical Support

These help files have been written to help you better understand the program and how the program settings can be used to modify the various program features. If you experience any difficulties using the program, the information you can find here may help you to quickly solve the problem.

If you are unable to find the answer to a specific question here, you may find the answer in the avast! Support Center

  • In the Knowledgebase section, you can find the answers to some of the most frequently asked questions (FAQs)
  • Alternatively, you can take advantage of the avast! Support Forum. Here you can interact with other avast! users who may have experienced the same problem and may already have discovered the solution. You will need to register to use the forum, but this is a very quick and simple process. To register to use the forum, go to avast! forum - register

Finally, if you are still unable to solve your problem you can Submit a ticket to our technical support team. Again you will need to register to do this and when writing to us, please make sure to include as much information as possible.


User interface

The user interface enables you to check the current status of your protection, to adjust the program settings and to carry out a manual virus scan. Unless you want to perform any of these actions, you may never need to access the user interface at all as once the program is installed, the resident shields will be silently and continuously protecting you against threats from viruses and other malware.

When you open the user interface, you will see the colored status bar telling you the current status of your protection. "SECURED" means everything is up to date and running as it should be. "ATTENTION" means you are not fully protected, for example, if the program or your virus definitions are not up to date, or if one or more of your shields is currently turned off. "UNSECURED" means you are currently not protected at all, most likely because all of the shields have been turned off.

If you see the message "ATTENTION" or "UNSECURED", you can try to make your computer secure again by clicking the "FIX NOW" button.

By clicking on the drop-down arrow below your protection status, you can see more details about your protection status:

  • Real-time shields - to be fully protected, the status should be "on". This means all of the real-time shields are active. If any of the real-time shields are not active, the status of the real-time shields will be displayed as "off".
  • Firewall (only in avast! Internet Security) - like the real-time shields, can either be "on" or "off".
  • Definitions auto update - if this is "on", your virus definitions will be updated automatically whenever a new update is available. This will ensure you always have the most up to date virus definition and that you are protected from the latest threats.
  • Virus definitions version - this tells you whether the virus definitions that are used to identify potential threats are currently up to date.
  • Program version - this tells you whether you are using the latest version of the program.
  • Expiration date - here you can see the date until which your current license is valid.

Down the left side of the window, you will see a number of navigation tabs, which can be used to access other parts of the program, to change the program settings, run a manual virus scan or update the program and virus definitions:

  • SUMMARY - contains current status information, access to avast! iNews for latest information, statistical and community information.
  • SCAN COMPUTER - enables you to run a manual virus scan, to schedule a boot-time scan and to view the scan results.
  • REAL-TIME SHIELDS - provides access to all the shield settings.
  • FIREWALL (avast! Internet Security only)- provides access to the firewall settings.
  • ADDITIONAL PROTECTION - contains the AutoSandbox, Browser protection and Site Blocking features. If you need help, you can use the Remote Assistance feature to enable another person to connect directly to your computer. Here in avast! Pro Antivirus, you can also find the SafeZone and Sandbox screens. In avast! Internet Security this is where you can also access the Antispam settings.
  • MAINTENANCE - to update your program or virus definitions or to access the virus chest.


Program settings - basic

Basic

This page contains the settings to adjust the appearance of avast! and whether or not other special scans are displayed in the user interface.

Appearance

  • Show avast! tray icon - the orange avast! a-ball will be displayed in your system tray (next to the clock) which indicates the status of avast!. Normally it indicates that avast! is running and all the real-time shields are active, but if it is greyed out, or has a line through it, one or more of the shields may not be active.
  • Animate the icon when scanning - whenever anything is being scanned (e.g. an email is sent/received, a file on your computer is opened, or a web page is downloaded) the a-ball icon will rotate to indicate scanning is in progress
  • Use special graphic effects - this will simply change the cosmetic appearance of some parts of the user interface

Special scans

As well as scanning your computer in real-time and allowing you to run manual scans, avast! also allows you to run a scan from Windows Explorer or to launch a scan automatically when your screen saver is activated.

If the box "Show special scans in avast! user interface" is checked, these scans will be added to the list of pre-defined scan on the Scan Now page. This will enable you to access the scan settings where you can set the various scan parameters.

Behavior

  • Automatically open the Scan Results when the scan is finished

Checking this box will result in any results being displayed automatically at the end of the scan without the need to manually open the Scan Results window.


Updates

An antivirus program is only as good as its database of virus definitions, which is why it is important to regularly update both the program and the virus definitions.


Update settings - general

Update settings

You can choose whether the program and virus definitions are updated automatically, or manually, or only on request following notification that an update is available.

On this screen, you can also specify the type of internet connection that you use i.e. whether you connect to the internet using a dial-up modem or whether your computer is permanently connected to the internet. This will optimize the way that avast! checks for new updates and make the update process more reliable.


Update settings - details

Details

On this screen, you can specify how the updates are carried out.

Update options.

  • Ask for reboot when needed - some updates require a system restart to take effect. If this box is checked, the restart will not be automatic. You will be asked whether you want to restart the system now, or later.
  • Show notification box after automatic update - If this is checked a small notification message will be displayed briefly above the system clock, following an automatic update.
  • Show notification box if an error occurs - If an error occurs during an automatic update, this will be reported in a notification message above the system clock.

Auto-update interval

Here you can set the frequency of automatic updates i.e. how often avast! checks to see if an update is available.


Update settings - proxy

Proxy settings

The settings on this page are important when avast! needs to access the internet, for example, when carrying out updates.

If you connect directly to the internet (i.e. not through a proxy), select "Direct connection (no proxy)". Note: dial-up connections do not use a proxy.

If you are not sure whether you use a proxy server, or which proxy server you use, select "auto detect" or ask your internet provider or network administrator.

If you connect to the internet through a proxy server and you know the proxy server details, select "Specify proxy server" and enter the proxy details:

  • Type - HTTP or SOCK4
  • Address - Enter the address of your proxy server
  • Port - Enter the port your proxy server uses
  • Authentication type - specify here whether the proxy server requires authentication and if so, the type of authentication
  • Username and password -should be entered if required for authentication

Finally, click on "Test connection" to test whether the internet connection (based on the entered settings) works.


Cloud Services

  • Streaming (real-time) updates

    By enabling streaming updates, you can make sure that new virus definitions are sent to you in real-time, rather than waiting for the next regular update. As your virus database will be continuously updated, this will give you even more protection against the very latest threats.

  • File Reputation

    If this option is enabled, avast! will check if a file is safe even before it is opened, by checking its database of known files. Whether the file is considered safe or not will be determined by how common the file is among other avast! users, and for how long the file has been in existence.


Popups

On this screen you can specify the length of time for which various popup messages are displayed on your screen.

You can also choose to view your monthly security reports. Every 30 days, a personalized security report is created so you can see how avast! has been working quietly behind the scenes to protect you from a variety of malware. You can see an individual report of the numbers of files and documents that have been scanned, as well as infected web pages and downloads that have been blocked. You can also see statistics about the number of avast! users around the world, information about infected websites and much more useful and interesting information.


Virus chest settings

Virus Chest

Here you can specify the maximum permitted size of the virus chest and thus the maximum amount of space it can take up on your computer. You can also specify the maximum size of any individual file that is sent to the virus chest.


Virus Alerts

avast! is able to send a warning message to other users whenever a virus is detected. This feature is especially useful for network administrators who will be immediately notified about a virus infection on any computer in their network so that they can react quickly.

To create an alert, first select how it should be sent from the list of available options:

  • Email (SMTP) - The alert will be sent as an email using SMTP protocol, but certain other settings need to be specified first - see below.
  • Email (MAPI) - The alert will be sent as an email using MAPI protocol, but the MAPI profile name and password must also be specified - see below.
  • Printers - The alert will be sent to the specified printer
  • Network Message (WinPopup) - The alert will be sent as a network message, but first it is necessary to enter the IP address or the network name of the person to whom the message should be sent.

SMTP Settings

Here the SMTP server details should be entered:

  • Server address - the address of the outgoing email server e.g. smtp.server.com or 192.168.1.25
  • Port - the default is 25
  • From address - the address of the sender

If the SMTP server requires authentication when logging on, you should also check the box "If the SMTP server requires authentication:" and enter the username and password.

MAPI Settings

Here you should enter the MAPI profile name and password to be used if alerts are to be sent as an email using MAPI protocol.


Program settings - exclusions

Exclusions

It is possible to exclude certain locations, or even single files, from scanning, which means they will not be checked for viruses during any scan. This may be useful for the following reasons:

  • To avoid false alarms - if the program reports a virus infection in a file and you are sure it is a false alarm, you can exclude the file from further scans and avoid further false alarms. However, please notify AVAST Software of the problem in order that it can be fixed.
  • To speed up processing - if you have a folder on your hard disk that contains images only, you can exclude it from scanning which will reduce the overall scanning time.

Keep in mind that any exclusions specified here apply to all on-demand scans (manual and scheduled). If you want to exclude files only from a specific manual or scheduled scan, use the Exclusions page in the scan settings. To exclude files only from being scanned by any of the real-time shields, use the Exclusions page in the real-time shield expert settings.

To exclude a location or file, first click the box where it says <enter path> and then either type the location or file to be excluded, or alternatively, click the "Browse" button, check the box next to the location or file to be excluded, then click "ok".

If you want to exclude a folder, including all of its sub-folders, it is necessary to add "\*" to the end of the folder name e.g. C:\Windows\*.

To remove a location or a file from the exclusions list, click on it once to select it, then click the "delete" button.


Password

On this screen you can specify a password which the user will be prompted to enter when trying to run avast!, or when trying to access certain parts of the program.

To set a password, first check the box "Protect avast! with a password" then enter the password in the boxes provided.

You can then specify which areas will be protected by the password:

  • General program access - the password will be required to open the user interface.
  • Program settings - the settings that are accessed by clicking on "Settings" in the top-right corner of the user interface.
  • Protection control - this concerns the ability to turn on or off the real-time protection.
  • Protection settings - the settings relating to the real-time protection.
  • Scan control - the controls used to run, pause, resume or stop a scan.
  • Scan settings - the settings that determine the various scan parameters.
  • Update control - the program controls used to update the program, the scanning engine and virus definitions.
  • Virus chest control - the controls used to work with files in the virus chest.


Silent mode

Silent/Gaming Mode

At various times while your computer is running, messages may be displayed on your screen e.g. when the virus definitions have been updated, when an incoming email is being scanned etc. This can result in full-screen applications (e.g. games) being interrupted as Windows switches from full-screen mode to normal mode when the message appears.

On this screen you can specify that messages will never be displayed (Silent mode), or will not be displayed if a full-screen application is running.


Status Bar

This is the colored part of the screen which shows the current level of your protection. If you have all the real-time shields running and the latest versions of the program and virus definitions, this part of the screen will appear as a green bar and the status will be displayed as "Secured".

In the status bar settings, you can specify which components are used to determine your protection status. If any component is unchecked, it will not be monitored. This means that if that component is subsequently de-activated, it will not affect the protection status displayed. Only those items that are checked can influence the protection status.


Program settings - language

Language

The currently available languages will be displayed on this screen. To see all of the available languages, click on the arrow. If the required language is shown, click on it to select it and then click "ok". The next time you restart the program, the language will be changed. If the required language is not shown, click "Install additional languages" then check the box next to the language you require. Click "Next" and the new language will be installed. When complete, click "Finish". Finally you need to select the new language as described above.


Maintenance

On this screen you can specify how long the scan logs are kept before they are deleted and also the maximum size of the scan logs. This ensures that the space on your harddisk is optimized by limiting the size of the logs and removing logs which are no longer needed.

If the box "Enable debug logging" is checked, a special log file will be created if an error occurs while the program is running. If the error persists, this log can then be sent to avast! technical support and may help to identify the cause of the error.

Import/Export

Allows you to export your avast! settings to another location. From there they can be re-imported later, for example, if you need to uninstall and reinstall avast, or if you replace your PC and need to install avast! again.

CreditAlert settings

avast! CreditAlert is designed to continuously monitor your credit status based on information that you provide, to detect any possible signs of identity theft.

After you have registered, avast! will actively monitor the information maintained by all three credit bureaux, and also scans thousands of public and private databases on your behalf, looking for any possible signs of identity theft.

You can register for this free service by clicking the "Register" button and you will then receive automatic notification if any change is detected. If you do not want to receive the automatic notifications, just un-check the box "Enable displaying the alerts".

If you have already registered for the CreditAlert service, but you have reinstalled avast! on another computer, you can reactivate your CreditAlert service by clicking on "Reactivate" and entering a few basic details. Note that the details entered must be exactly the same as the details you provided when you first registered for the service.


Sounds

On this screen, you can turn on or off the various sounds and voice messages that are generated by avast! in relation to certain events.

By default, only the basic sounds are turned on, however by checking the box "Use voiceover sounds (when available)" a voice message can be generated, for example, when a potentially harmful file is detected or when the virus definitions have been updated.


Community

By checking the box on this page, you can participate in the avast! community and share information of a technical nature on a need-to-know basis. This does not concern personal information of any sort and is strictly security-related information concerning, for example, malware that avast! has detected while running on your computer, actions that have been blocked etc. This information will be used by avast! to improve its detection ability and technical support for the benefit of the whole avast! community. By participating in the avast! community, you will also have access to all the community information and statistics about the latest malware attacks.

The first of the two check-boxes at the bottom of the screen can be used to de-activate the Market tab and the "Like avast!" button in the navigation panel.

The second checkbox can be used to remove links to social networking sites such as Twitter, etc.


Troubleshooting

Changing the settings on this page may help to resolve certain specific problems. However, these settings should not be changed without good reason. If in doubt, please contact AVAST Software first.

  • Enable rootkit scan on system startup - Normally avast! scans for rootkits whenever the operating system is restarted. Uncheck this box if you do not want this scan to be carried out whenever your system is restarted.
  • Enable raw disk access during avast! boot-time scan - During a boot-time scan, avast! uses a special method to access the raw data on the hard disk, to check for any viruses that may be hidden there.
  • Skip checking of digital signatures of infected files - to prevent false positive alerts, avast! checks files for digital signatures. If a file is detected as suspicious, but also contains a valid digital signature of a trusted authority, it is likely to be a false positive. In this case the file will not be reported as suspicious. If this box is checked, all suspicious files will be reported, including those with valid digital signatures.
  • Enable avast! self-defense module - Some viruses deliberately target antivirus software and try to switch it off by deleting or modifying critical files. avast! contains self-defense features that prevent such attacks by blocking the operation. Uncheck this box to turn off the self-defense, thus enabling such files to be deleted.
  • Load avast! services only after loading other system services - The avast! service is normally loaded quite early in the boot process. Sometimes this can cause problems when loading other system services e.g. the system may appear to "freeze" temporarily after starting. Checking this box will delay the loading of avast! services until after the other system services are loaded.
  • Do not use Chrome as avast! default browser

Restore factory defaults

By clicking "Reset now", you can restore your avast! settings to the original default settings. You can restore all of your program settings, including the default scan settings, or you can restore just the shield settings. Note that restoring the settings cannot be undone, however once the setting are restored, you can adjust them as required.

Redirect Settings

These settings allow you to specify which ports are used for your email and web communication, if the standard ports are not used. This is important to ensure that your emails and web browsing are monitored by avast!, regardless of which ports are used.

For the web, avast! normally expects all communication to take place through port 80 and everything else is ignored. If you use a proxy server to access the internet and you want the communications between the proxy server and your computer to be scanned, you should enter the port which is used to connect to the proxy server. You should only enter the ports for HTTP traffic, not for ICQ, DC++ etc. For mail, the default ports are the standard port numbers for the four basic email protocols. If you use a different port (or ports), they should be entered here. Multiple port numbers should be separated by commas.

  • Ignored addresses - here you can enter server addresses or ports that you want to exclude from scanning.
  • Ignore local communication - if this is checked, avast! will not scan communication between applications running on your computer. Unchecking this box will result in local communications being scanned, which may slow down your computer slightly.


Real-time shields

The real-time shields are the most important part of the program, as they are working continuously to prevent your computer from becoming infected. They monitor all your computer's activity, checking all programs and files in real-time - i.e. at the moment a program is started or whenever a file is opened or closed.

Normally, the real-time shields start working automatically whenever your computer is started. The presence of the orange avast! icon in the bottom-right corner of your computer screen tells you that the real-time shields are working. Any of the shields can be turned off at any time, but this is not normally recommended as it may reduce the level of your protection. If any of the shields is turned off, you will see a warning message whenever you open the user interface telling you that your computer is not fully protected (if one or more shields are turned off) or "Unsecured" (if all the shields are turned off).

avast! antivirus 7.0 contains the following real-time shields:

  • File system shield - checks any programs at the moment they are started and other files at the moment they are opened or closed. If anything suspicious is detected, the file system shield will prevent the program from being started or the file from being opened to prevent any damage being caused to your computer and data.

  • Mail shield - checks incoming and outgoing email messages and will stop any messages containing a possible virus infection from being accepted or sent.

  • Web shield - protects your computer from viruses while using the internet (browsing, downloading files etc). It will detect and block known or potential threats coming from the web e.g. hacked web pages infected with (potential or actual) malicious scripts. If a virus is detected while downloading a file from the internet, the download will be stopped to prevent the infection from reaching your computer.

  • P2P shield - checks files downloaded using common peer-to-peer (file sharing) programs.

  • IM shield - checks files downloaded by instant messaging or "chat" programs.

  • Network shield - monitors all network activity and blocks any threats that are detected on the network. It also blocks access to known malicious websites based on the avast! database of infected URLs.

  • Script shield - detects malicious scripts and prevents them from being run. The script shield will detect and block not only malicious scripts coming from the web (remote threats) but also scripts coming from other sources, such as web pages saved to disk or in the browser cache etc (local threats).
    Unlike the web shield, the script shield can also detect and block malicious scripts that come from HTTPS (encrypted) connections.

  • Behavior shield - monitors all activity on your computer and detects and blocks any unusual activity that might indicate the presence of malware. It does this by continuously monitoring your computer's entry points using special sensors to identify anything suspicious.


Real-time shield settings

The settings for any of the real-time shields can be changed at any time by opening the user interface, clicking the "real-time shields" tab and selecting the appropriate shield. Here you will see the "Main settings".

In the graph at the bottom of each screen, you can see the shield's recent activity - the amount of incoming and outgoing data which has been scanned by the shield. To see a more detailed view, click on "Show traffic history". On the Statistics screen, you can view the data for any of the real-time shields over the period selected. To change the scale of any part of the graph, click on the vertical line and drag it to the right. To return to the previous view, just click on "Show all" and the previous view will be restored.

By clicking on "Expert settings" you will gain access to the more detailed shield settings.

To completely turn off a particular shield, click on "Stop" and from the drop-down menu, select for how long you want the shield to remain turned off.

To restart a shield that has been stopped, just click "Start".

To stop all of the shields at the same time, just right-click the orange avast! icon in the system tray, click "avast! shields control" and select the period for which they should be stopped.


File system shield - main settings

File system shield settings

Main Settings

  • Scan documents when opening - check this box if you want all documents to be scanned at the moment they are opened
  • Scan files when writing - if this box is checked, all files will be scanned at the moment they are created or modified and written to your hard disk


Scan when executing

Here you can specify the types of file that should be scanned at the moment they are run or "executed". It is recommended that all of these boxes are checked.

Checking the boxes "scan programs when executing" and "scan scripts when executing" will ensure that all programs and scripts will be scanned at the moment they are run to ensure they are clean and will not cause any damage to your computer or your data.

If the box "Scan libraries (DLLs) when loading" is checked, all DLL files will be scanned when they are loaded. This may result in some applications starting more slowly, but will significantly increase the security of your system.


Scan when opening

If the box "Scan documents when opening" is checked, Microsoft Office documents and other OLE files will be checked at the moment they are opened. To determine which documents and files to check, avast! will check their actual content, not just the file extension.

You can also specify files that should be scanned based on their extension.

To scan files with a specific extension, check the relevant box and type the extension in the box provided. You can use the wildcard "?" for example, if you want all .htm and .html files to be scanned when opening them, you can enter both extensions, or just use the wildcard "ht?". Note however, that this would result in all files with extensions that begin with "ht" being scanned e.g. files with the extension .htt.

Alternatively, you can specify that all files should be scanned, however this could slow your system down quite significantly while the scan is in progress.


Scan when writing

Here you can specify the file types that will be scanned at the moment they are saved. You can specify that all files should be scanned ("Scan all files") or just those with particular extensions:

  • Scan files with default extensions - only those files with extensions that are considered potentially dangerous (e.g. ".exe") will be scanned
  • Scan files with custom extensions - here you can specify the file types that should be scanned based on their extension. You can use the wildcard "?"; for example, if you want all .htm and .html files to be scanned, you can enter both extensions, or just use the wildcard "ht?". Note however, that this would result in all files with extensions that begin with "ht" being scanned e.g. files with the extension .htt.


Scan when attaching

Here you can specify whether removable media should be scanned when they are connected to your computer to detect potential "auto-run" programs that may try to launch when the device is connected.

You can also specify that the boot sectors of floppy disks should be scanned to detect potential boot sector viruses.


File system shield - exclusions

Exclusions

Here you can enter or modify any locations that should not be scanned by the file system shield. Note however, that exclusions specified here will only apply to the File System Shield and not to any other scans.

Certain files are excluded by default at the moment of reading and writing. You can also specify other file types that should be excluded at the moment of reading (R), writing (W), or executing (X), by clicking on "enter path" and either typing the path to be excluded, or clicking the browse button to select it.

To exclude files from being scanned by any part of avast!, including manual and scheduled scans, it is necessary to specify the files or areas to be excluded in the general program settings.


File system shield - advanced

Advanced

On this page, you can potentially reduce scanning time by specifying certain types of files that should not be scanned.

Do not scan verified system DLLs - if this box is checked, system library files will not be scanned.

Use transient caching - if transient caching is used, a file that has been scanned, and in which no infection was detected, will not be scanned again the next time it is accessed. However, this is only valid until the next virus definitions update, as the file may contain an infection that was not previously detected but which may be detected based on the new virus definitions. Also, information that the file is clean will only be stored in the computer's operating (temporary) memory. This means that when the system is restarted the information will be lost, therefore the file will also be scanned again the next time it is accessed after a system restart. This box is checked by default; if you want files to be scanned every time they are accessed, this box should be unchecked.

Use persistent caching - if persistent caching is used and a file is verified as clean, this information will be stored in the permanent memory. This means it will not be lost after a system restart and it is also not affected by virus definition updates. Verified clean files are files which are guaranteed not to contain any virus infection e.g. some operating system files, files signed by trusted publishers, or other files covered by the avast! whitelist. This box is checked by default; if you want all files to be scanned regardless of their trust status, this box should be unchecked.


Actions

On this screen, you can specify the action that should be taken automatically whenever a virus, potentially unwanted program (PUP), or suspicious file is detected.

The default action is "Move to Chest". If this is left as the selected action, any suspicious files will be automatically moved to the virus chest.

Alternatively, you can select a different action, which avast! will attempt to carry out automatically - Repair, Delete, No Action, or Ask.

If "Ask" is selected, you will be asked to confirm what action to take at the moment the virus, potentially unwanted program, or suspicious file is detected.

You can also specify alternate actions, from the same list of options, which should be taken if the preferred actions cannot be completed.

Options:

At the bottom of the screen, under the heading "Options", there are two checkboxes:

  • Show a notification window when action is taken. If this box is checked, you will see a message on the screen telling you when the specified action has been taken.
  • If necessary, perform the selected action at the next system restart. If this box is checked and the action could not be completed, avast! will attempt to carry out the action again the next time the computer is restarted. This could happen, for example where a file was in use and could not be deleted or moved.

Finally there are additional options for dealing with infected archives:

By default, if an infected file is discovered in an archive file, avast! will attempt to remove it.

You can further specify that if the infected file cannot be removed, avast! should remove the archive (the parent archive) within which the infected file is located.

Alternatively, you can specify that whenever an infected file is detected inside an archive, the entire archive should always be removed.


Packers

On this page, you can specify which types of archive file are checked when scanning. Certain file types are scanned by default but you can also specify other types that should be scanned by checking the appropriate box.

By clicking once on any of the default file types in the list, you can see a description of that particular type of file at the bottom of the page.

If you want all archive files to be scanned, check the box "All packers", however, this may significantly increase the scanning time.


Sensitivity

On this screen, you can adjust the basic sensitivity, which determines how thoroughly files are scanned, and also the heuristic sensitivity.

As well as the standard process of scanning for known malware infections, avast! also performs a heuristic analysis to identify potential, but as yet unknown malware. This is done by looking for certain characteristics that may be a sign of a potential infection. By clicking on the orange bars, you can adjust the level of heuristics sensitivity to Low, Normal or High, or you can turn it off completely. Increasing the sensitivity, increases the chances are of detecting a virus but also the likelihood of "false positives".

If you find that a large number of clean files are detected by avast! as suspicious ("false positives"), it is possible that the heuristic sensitivity is set too high. Reducing the heuristic sensitivity should result in fewer files being reported as suspicious, however this also reduces the chances of a real virus being detected.

  • Use code emulation - if this box is checked and avast! detects some suspicious code in a file, it will attempt to run the code in a virtual environment to determine how it behaves. If potential malicious behavior is detected, it will be reported as a virus. Running the code in this virtual environment means that if the code is malicious it will not be able to cause damage to your computer.
  • Test whole files (may be very slow for big files) - checking this box will result in scanned files being tested fully, not just those parts of a file which are normally affected by viruses. Most viruses are normally found either at the beginning of a file, or at the end. Checking this box will therefore result in a more thorough scan, but will also slow the scan down.
  • Scan for potentially unwanted programs (PUPs) - you can also scan for programs which you may have downloaded unknowingly, typically programs that are used for advertising, or collecting information about your computer or internet use.

By checking the box "Follow links during scan" you can ensure that the targets of any file system links are also scanned for potentially harmful content. If this box is checked, the content of any folder to which you would be redirected from a folder which is being scanned, will also be scanned.


Report file

On this page you can create a report of the scan results. You can specify whether you want the report to be created as a plain text file, or in XML format.

If you want to create a new report after each scan, and you don't want to keep a record of previous scan results, select "overwrite". A new report will then be created after each scan and will replace any previous report.

If you want to keep the previous scan results, select "Append" and the results of the new scan will be added to the end of the previous report.

Finally, you can specify what will be reported:

  • Infected items - files that potentially contain a virus or other malware infection.
  • Hard errors - these arise when the program detects something that would not normally be expected and generally require further investigation.
  • Soft errors - these are less serious than hard errors and usually concern files that could not be scanned, for example, because they were open and being used by another application.
  • OK items - these are files that were scanned where nothing suspicious was detected. If all local drives are scanned, checking this box could produce a very long report. It is recommended to check this box only if you intend to carry out a limited scan and only if you really want all clean files to be reported as well as any problematic files.
  • Skipped items - these are files that were not scanned as a result of the scan settings, for example, if it was specified that only files with specific extension should be scanned or if certain files were specifically excluded from the scan.

The reports are usually stored in the following location:

For a computer running Windows 2000/XP - C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report

For a computer running Windows Vista or Windows 7 - C:\ProgramData\AVAST Software\Avast\report

To view a report after running a manual scan, click on "Show Report File", which can be found on the Scan Now screen when the scan is completed.

To view a report created by one of the real-time shields, go to the main screen for the particular shield then click on the "Shield Traffic" bar. Then click on "Show Report File" at the bottom of the screen.


Mail shield - basic

Basic settings

Here you can specify which type of messages are scanned i.e. messages that are received (inbound), messages that are sent (outbound), or both.


Mail shield - main settings

Main settings

Here you can specify which type of messages are scanned - i.e. messages that are received (inbound), messages that are sent (outbound), and newsgroup messages (NNTP).


Mail shield - behavior

Behavior

Here you can specify how messages are marked to indicate whether they are clean, infected or simply suspicious. You can also control what other actions are carried out while a scan is being performed.

  • Insert note into clean message (incoming)
  • Insert note into infected message (incoming)
  • Insert note into clean message (outgoing)
  • Mark in subject of mail containing a virus: ***VIRUS***
  • Mark in subject of suspicious mail: ***SUSPICIOUS***

MS Outlook only

  • Show splash screen - if this box is checked, the avast! splash screen will be displayed briefly whenever MS Outlook is launched, to confirm that the Mail Shield is running.
  • Scan attachment when attaching - here you can specify that attachments should be scanned at the time they are attached, rather than when they are sent.
  • Scan archived messages when opening - by default messages that have been archived are not scanned. By checking this box, you can ensure that even archive messages are scanned, however, you can also specify that this will only apply to unread messages, by checking the "unread messages only" box.


Mail shield - heuristics

Mail Heuristics

As well as the standard heuristic analysis, the Mail Shield carries out additional heuristic checks to identify potential, but as yet unknown malware such as mass-mailing worms. This is done by looking for certain characteristics that may be sign of a potential infection:

  • Check white-spaces sequence in name of attachment - some viruses add a number of spaces (or other non-displayable "white" characters) to the end of a file extension, followed by a second real extension, which would normally be recognized as a potentially dangerous extension. However, due to the length of the file name, the person receiving the email might not see the second extension and may open the attachment, believing it to be safe. The heuristic analysis uncovers this trick by looking for white-space sequences in the name of the attachment. The default number of whitespaces is 20 and if the number of white-spaces exceeds this number, a warning will be displayed
  • Attachment check - if this box is checked, an analysis of the attachment will be performed based its name and extension and, optionally, its content.
  • If "name/extension only" is selected, a warning will be displayed, for example, if the attachment has a simple executable extension (EXE, COM, BAT etc). However, not all such files are dangerous and this might result in a higher number of false positive alerts - i.e. clean files identified as potentially suspicious.
  • If "Content type and name/extension" is selected, the program will additionally check that the content actually corresponds to the file type e.g. a file ending .jpg actually does contain a picture and is not a renamed COM file.
  • Local iframe/Remote iframe - Some viruses can exploit bugs in some mail programs that make it possible to start the virus simply be viewing the message in the preview pane. avast! checks whether the HTML code of the message contains a tag which enables it to do this and if such a tag is detected, a warning message is displayed.


Mail shield - SSL accounts

SSL Accounts

On this screen you can enter details of how your Mail Clients communicate with the Mail Server, including, where encryption is required, the type of encryption that is used.

In order for mail to be scanned by the Mail Shield, it is necessary that encryption is turned off in your Mail Client.

If encryption is required, the information on this screen will then be used to establish a secure connection between the Mail Shield and the Mail Server. This will enable all incoming and outgoing mail to be scanned by the Mail Shield. Unencrypted connections do not need to be listed.

Outgoing Mail

The outgoing unencrypted email will first be scanned by the Mail Shield. If the type of encryption is specified on this page, a secure connection will be established and the mail will be sent encrypted to the Mail Server (if the type of encryption has been specified as "None", the mail will be sent unencrypted). If nothing is specified on this page for a particular mail account, the Mail Shield will check whether the Mail Server supports encryption. If it does, a new rule will be created automatically and the mail will be encrypted and sent to the Mail Server.

Incoming Mail

As the secure connection is established between the Mail Shield and the Mail Server, incoming mail can be unencrypted when it is received by the Mail Shield and scanned before it is delivered to the Mail Client.

If encryption is not turned off in the Mail Client, the Mail Shield will be unable to scan the content of either incoming or outgoing mail. This means that although the connection will be secure, the mail cannot be scanned by avast! and is therefore unprotected. In this case a warning message will be displayed (by default) informing you that a message has been received via an unprotected SSL connection.

If you do not want to receive this warning, uncheck the box at the bottom of page "Automatically detect and warn about unprotected SSL connection".


Web shield - basic settings

Basic settings

  • Scan Web (HTTP) traffic - this checkbox turns on/off the web scanning feature (URL blocking is not affected). This is always on by default, but if you do not want or need your web browsing activity to be scanned, you can turn it off here.


Web shield - main settings

Main settings

  • Enable Web scanning - this box is checked by default. By unchecking this box, you can turn off the web scanning feature without affecting the URL blocking, which will remain active.
  • Use intelligent stream scanning - this is also checked by default. When checked, files that are downloaded are scanned in real-time i.e. during the actual download process. The packets of data are scanned as soon as they arrive - and the next ones are downloaded only when the previous packets have been verified to be infection-free. If this feature is disabled, by unchecking the box, the whole file will be downloaded to a temporary folder first and then scanned.


Web shield - web scanning

Web scanning

On this page you can specify which files should be scanned when they are downloaded from the internet. You can specify that all files should be scanned, or just those with particular extensions. For this feature to be active, the "Enable web scanning" box should be checked on the Main Settings page.

You can also enter the MIME types of files that should be scanned. In both cases, wildcards can be used.


Web shield - exclusions

Exclusions

On this page you can specify URLs and MIME types that should not be scanned by the Web Shield. This can be useful when downloading a large number of files from a single, trusted source.

URLs to exclude - Use the "Add" button to enter the URL addresses that should be ignored. If you want to exclude only a single page, you need to enter the full address e.g. you would need to enter the full address http://www.yahoo.com/index.html if you want to exclude the page index.html. However, if you enter http://www.yahoo.com/* no pages starting with http://yahoo.com will be scanned. If you want to exclude a particular file type from being scanned, e.g. files with a ".txt" extension, enter *.txt.

MIME types to exclude - Here you can specify any MIME types/sub-types that should not be scanned.


Web shield - actions

Actions

On this screen, you can specify the action that should be taken automatically whenever a virus, potentially unwanted program (PUP), or suspicious file is detected.

The default action is "Abort connection", which means the connection will be automatically terminated as soon as one of these potential threats is detected. Alternatively, if you change the action to "Ask", a message will appear if a potential threat is detected asking whether you want to terminate the connection.

If the check box at the bottom of the page is left checked, you will see a message on the screen telling you that the specified action has been taken.


P2P shield - main settings

P2P shield settings

There are no basic settings for this shield. Use the Expert Settings to specify which P2P programs should be monitored by avast!.


P2P shield - programs

Programs

On this screen you can select which P2P program(s) should be monitored.


IM shield - main settings

IM shield settings

There are no basic settings for this shield. Use the Expert Settings to specify which IM programs should be monitored by avast!.


IM shield - programs

Programs

Here you can specify which IM programs should be monitored.


Network shield - main settings

Network shield settings

On this screen you can select whether or not warning messages should be displayed when potentially harmful network traffic, or a potentially infected URL is detected.


Script shield - main settings

Script shield settings

There are no basic settings for this shield.


Script shield - main settings

Here you can use the check-boxes to select which browsers will be protected by the Script Shield.

If any browser is unchecked, the Script Shield will be turned off for that browser only.


Script shield - exclusions

Here you can enter specific URLs that should not be scanned. Just check the box and then enter the URL address which you want to exclude.


Behavior shield main settings

Behavior shield settings

There are no basic settings for this shield.


Behavior shield expert settings

Main settings:

Here you can specify what type of activity is monitored and what action should be taken if such activity is detected. The default action is "Auto-decide", which means avast! will decide whether or not it should be allowed based on a range of criteria, however by clicking on the drop-down arrow, you can ensure that such activity is always "Allowed", or always "Blocked", or that you are "Asked" what action to take in each case. If the action is changed to "Ask" you will see a message whenever such activity is detected and you will need to confirm whether or not it should be allowed.

Trusted processes:

On this screen, you can define what processes (programs, files etc.) are trusted and should always be allowed to continue. Some programs may behave in a way that avast! considers suspicious, but if they are defined as "trusted", their actions will automatically be allowed.

To add a trusted process, click on the "browse" button to locate it on your computer, then click "Add". To remove a trusted process, click on it once to highlight it, then click the "delete" button.


How to run a pre-defined scan

Running a pre-defined scan

avast! antivirus 7.0 comes with a number of pre-defined scans installed by default.

Quick scan - this will just perform a quick scan of your computer's system volume (usually the C:\ drive on your computer). By default, only files with "dangerous" extensions are scanned, e.g. files with extensions such as "exe", "com", "bat" etc. Only those parts of the file at the beginning and at the end, where infections are normally found, are tested.

Full System Scan - This performs a more detailed scan of all your computer's hard disks and by default, all files are scanned according to their content, in other words, avast! looks inside every file to determine what type of file it is and whether it should be scanned. The whole file is tested, not just those parts of the file at the beginning or at the end where infections are normally found.

Removable Media Scan - this will scan any removable media that is attached to your computer e.g. USB flash drives, external hard drives etc. It will scan the media to detect potential "auto-run" programs that may try to launch when the device is connected.

Select folder to scan - this option enables you to scan just a specific folder or multiple folders.

To run one of the pre-defined scans now, just click "Start".

Alternatively, you can schedule the scan to be run on a regular basis, or just once at a later time and date - see the "Scheduling" page in the section "Scan settings".

The other "Settings" screens can also be used to further customize the scans, or by clicking on "Create custom scan" you can create a new scan with all the required settings.


Context menu scan

Windows Explorer Scan

This is simply the facility to scan an individual file without opening the main program interface or without running a scan from the command-line.

To scan an individual file, just right-click the file to open the context menu and select the option "Scan <filename>".

To add this scan to the list of pre-defined scans on the Scan Now page, go to the program "Settings" and check the box "Show special scans in avast! user interface". You will then be able to access and adjust the scan parameters as required.


Screen saver

With avast! installed, it is possible to run a scan even when your computer is not being used and your screen-saver is running. A small window is displayed inside the screen-saver which informs you about the scanning progress, i.e. about the number of scanned files etc.

If you want avast! to scan your computer when the screen-saver is running, you need to locate the screen-saver option in your computer's control panel and then select "avast! antivirus".

To add this scan to the list of pre-defined scans on the Scan Now page, go to the program "Settings" and check the box "Show special scans in avast! user interface". You will then be able to access and adjust the scan parameters as required.


How to create a custom scan

Creating a custom scan

By clicking on the "Create Custom Scan" button, you can define a completely new scan with its own scan parameters.

By default, the area to be scanned is set as "All harddisks". To select a new area to be scanned, just open the drop-down menu and select the additional area to be scanned. To remove an area, click on it once and then click "delete". You can also specify how avast! should recognize potentially suspicious files that should be scanned, either by checking the file extension or by checking the actual content.

If "content" is selected, avast! will look inside every file to determine what type of file it is and whether it should be scanned.

If "name extension" is selected, then by default, only files with extensions such as "exe", "com", "bat" etc. will be scanned. You can add other file extensions by clicking on "select additional areas" and typing the required file extension in the box. Then click OK. To remove a file extension, click on it once and then click "delete".

On this page, you can also access other settings, for example, if you want to schedule a regular scan or a scan to run just once at a particular time, if you want to exclude specific folders or files from being scanned, or if you want to define what action should be taken in the event that a virus is detected - see the section "Scan Settings".


Boot-time scan

It is possible to schedule a scan to be carried out automatically when the system restarts i.e. when it "boots", before the operating system is active. This is useful if you suspect that a virus may have been installed on your computer, as it will enable the virus to be detected before it is activated and before it can do any damage to your computer.

In the "Settings", as well as scanning the boot-sector, you can also specify other areas to be scanned automatically when the system restarts.

You can adjust the heuristic sensitivity by clicking on the orange bars to change the sensitivity to Low, Normal or High, or you can turn it off completely. The heuristic analysis comprises a large number of tests based on typical virus content or behavior and the sensitivity level will determine how many tests would have to be failed for a file to be considered as infected. The higher the sensitivity, the higher the "pass mark", therefore the higher the chance that a file will fail the heuristic test and will be reported as a potential virus.

By default, the program automatically scans for potentially unwanted programs and also scans inside archive files, but either of these features can be turned off by unchecking the relevant checkbox.

You can also specify what action should be taken if a threat is detected. avast! can automatically attempt to repair the file, move it to the virus chest, or delete it. Alternatively, you can specify that you should be asked what action to take for each detected threat, or you can specify that no action should be taken.

Finally, click on "Schedule Now" and the scan will start automatically as soon as the system is restarted.


Processing the scan results

If a virus or other malware is detected, you will see the "Virus Found" message in the bottom half of the scan window. Here you can find other summary information about the scan such as number of files tested, number of infected files etc. Click on "Show Results" to see information about the virus and where it was detected.

On the "Scan Results" screen, you can also specify what further action to take, if none was taken automatically based on the scan settings - see the detailed scan settings section.

Click on the "v" icon in the column "Action to take" to reveal the list of options - Repair, Move to Chest, Delete, Do Nothing. The recommended action is "Move to Chest".

To apply the same action to all files, select the required action from the list at the bottom of the screen. You can change the action for any specific file by selecting the required action from the list in that particular row.

Once you have specified what action to take for each file, click "Apply" to carry out the selected actions.

The action taken will then be shown in the "result" column.

If you do not want to do anything at this stage, just select "Do nothing" and close the screen. You can return to this screen later by clicking on "Scan Logs", then selecting the particular scan by clicking on it once, and then clicking on "View results".

Special cases:

Sometimes the "Results" column shows you that a file could not be scanned e.g. a password-protected file, or a corrupted archive file, or it may show that something suspicious was detected in a memory file. This does not necessarily mean the file is infected.

  • Archive file is password protected - Some programs use password-protected archives to store their data (the password is hardcoded in the program) so such files may be reported even if you did not set the password yourself. avast! tells you that it wasn't able to extract the content of the archive, however the "wrapper" file was scanned.

  • Archive file is corrupted - A file may be corrupted, for example if the internet connection was terminated during a download, or it may be a special type of archive that avast! cannot open. Again, this means that the content could not be scanned but the "wrapper" file itself was scanned.

  • Memory detections - If the scan results show a detection in "Process X, memory block Y, Block size Z" it means that a virus signature was not found in a file on disk, but rather in the memory. This may suggest that there is something suspicious in the system memory so it is recommended to run a boot-time scan to check the system before the virus can activate. However, such memory detections can also be caused by running other security programs. avast! may have simply detected the virus signatures used by the other program. In that case, nothing would be detected on disk or during the boot-time scan. The reported "Process ID" should be followed by the name of the process file, which should help identify the specific application.


Scan Logs

In this section, you can find a list of all scans that have been run and the scan results. Highlight any scan in the list and click on "View results" to see more information about what was detected and where.

In the result column, you can see what action, if any, has been taken.

If no action has been taken, click on the "v" icon in the column "Action to take" to reveal the list of options - Repair, Move to Chest, Delete, Do Nothing. The recommended action is "Move to Chest".

To apply the same action to all files, select the required action from the list at the bottom of the screen. You can change the action for any specific file by selecting the required action from the list in that particular row.

Once you have specified what action to take for each file, click "Apply" to carry out the selected actions.

The action taken will then be shown in the "result" column.

If you do not want to do anything at this stage, just select "Do nothing" and close the screen.


Scan settings - actions

Actions

On this screen, you can specify the action that should be taken automatically whenever a virus, potentially unwanted program (PUP), or suspicious file is detected.

To see the available options, you first need to check the box "Automatically apply actions during scan..."

The default action is "No action" and if this is left unchanged, any suspicious files will be reported at the end of the scan and you will have the opportunity then to deal with them individually - e.g. to delete them, move them to the virus chest, or to do nothing.

Alternatively, you can select an action which avast! will attempt to carry out automatically - Repair, Move to Chest, or Delete.

If any action is selected, you can then specify an alternative action to be taken if the first action fails.

Options:

  • If necessary, perform the selected action at the next system restart. If this box is checked and the action could not be completed, avast! will attempt to carry out the action again the next time the computer is restarted. This could happen, for example where a file was in use and could not be deleted or moved.

Finally there are additional options for dealing with infected archives:

By default, if an infected file is discovered in an archive file, avast! will attempt to remove it.

You can further specify that if the infected file cannot be removed, avast! should remove the archive (the parent archive) within which the infected file is located.

Alternatively, you can specify that whenever an infected file is detected inside an archive, the entire archive should always be removed.


Scan settings - performance

Performance

Priority:

Here you can adjust the priority of the scan when system resources are also needed by other applications. By clicking on the orange bars, you can adjust the level of priority to Low, Normal or High. The higher the priority, the less time the scan will take if other applications are running at the same time.

Persistent cache:

On this screen, you can configure the persistent cache settings. avast! can store information about files that are verified as clean (e.g. they contain a valid digital signature), and this information can then be used to speed up future scans. This information is stored in the "persistent cache".

  • Speed up scanning by using the persistent cache. If this is checked, avast! will check the persistent cache for information about files which have been verified as clean and these files will not be scanned again.

  • Store data about scanned files in the persistent cache. If this box is checked, information about any new verified clean files detected by avast! during the scan will be added to the persistent cache. This will slow down the current scan, but may increase the speed of future scans, if the first checkbox is checked.


Scan settings - exclusions

Exclusions

Here you can enter or modify any locations that should not be scanned. Note however, that exclusions specified here will not apply to any other manual or scheduled scans, or to the real-time shields.

To exclude a location or file, first click the box where it says <enter path> and then either type the location or file to be excluded, or alternatively, click the "Browse" button, check the box next to the location or file to be excluded, then click "ok".

If you want to exclude a folder, including all of its sub-folders, it is necessary to add "\*" to the end of the folder name e.g. C:\Windows\*.

To remove a location or a file from the exclusions list, click on it once to select it, then click the "delete" button.


Scan settings - scheduling

Scheduling

On this page you can schedule a scan to run once, automatically on a given day and at a given time, or you can schedule it to run regularly on a daily, weekly or monthly basis.

Here, there are also various options to delay or pause the scan if the computer is running on batteries, to wake up the system before the scan starts (if it's in sleep mode), and to shut down the system after the scan is completed.


Virus Chest

The virus chest can be thought of as a folder on your hard disk with special properties, that make it a safe, isolated place for storing potentially harmful files. You can work with the files in the virus chest, with some security restrictions.

The main feature of the virus chest is complete isolation from the rest of the operating system. No outside process, such as a virus, can access the files inside the chest and as files inside the chest cannot be run, there is no danger in storing files there.

As a result of its unique properties, the virus chest is effectively a "quarantine" area which can therefore be used for various purposes:

  • Storing viruses - if avast! finds a virus and you decide not to delete it for some reason, you will be offered the option of moving it to the virus chest. With the virus in the chest, you can be sure that it will not be run, accidentally or otherwise.
  • Storing suspicious files - the chest is useful for storing suspicious files for later analysis.
  • Storing copies of other files which need to be kept separate from the rest of the system.


Working with the chest files

The files in the virus chest fall into one of two categories:

  • infected or suspicious files - files moved to the virus chest by avast! in accordance with the scan settings or as instructed by the user
  • user files - files transferred to the chest by the user.

If you select a file by clicking once on it, you can see the options available by right-clicking your mouse which will open the list of options:

  • Delete - this will delete the file irreversibly i.e. it will not just be moved to the recycle bin.
  • Restore - this will move the file from the virus chest back to its original location.
  • Extract - this will copy the file to the selected folder.
  • Scan - this will rescan the file for known viruses.
  • Submit to virus lab - this option enables you to send a file to the avast! virus lab, for example, if you believe it was incorrectly identified as infected. Please add as much additional information as possible, including the name of the file/program, version number, and the reason why you believe the file or program should not have been detected.
  • Properties - by clicking this, you can see more information about the file and you can also add a comment to give more detail.
  • Add - this enables you to browse your system and select other files to be added to the chest.
  • Refresh all files - refreshes the list of files in the chest, for example where a new file has been moved to the chest, but the viewable list of chest files has not yet been updated.

Note - files in the virus chest cannot be run. If you double-click a file, by accident or otherwise, you will not run it. Instead, the file properties will be displayed. This is a simple safety feature to prevent infected files being run accidentally and potentially causing damage to your computer.


avast! antispam filter

avast! Internet Security includes a fully integrated antispam filter to detect unwanted email.

Spam delivered to your mailbox can result in your mailbox quickly becoming full, as a result which, legitimate emails may not be received. It can also unnecessarily increase the load on the email server, internet connection, local networks etc.

The avast! antispam filter analyses all incoming email based on various criteria to determine whether it is legitimate. This analysis is based partly on a "blacklist" containing the addresses of senders from whom emails should always be marked as spam, and a "whitelist" which contains the addresses of known and trusted senders. These lists can be found in the antispam settings.

For emails from senders that are not on either list, a content analysis is also carried out based on the specified scan sensitivity to identify email that should be treated as spam.

If an email is received and the sender's address matches an entry on both the blacklist and the whitelist, email addresses will take priority over domain names. For example, if the domain "host.net" is blocked, but the specific address "joe@host.net" is approved, the email will be delivered normally.

In the antispam settings you can also specify how spam emails should be marked. This can then be used to create a new rule in your email client, for example to automatically move the marked emails to another folder. The antispam filter is effective for messages delivered to email accounts installed on your computer such as Microsoft Outlook, Outlook Express etc but not for web based email accounts such as Yahoo, Gmail etc which usually have their own antispam options.


Antispam - basic

Antispam basic settings

On the main page, it is possible to set the scan sensitivity as Low, Medium or High. avast! will perform a heuristic analysis of all incoming mail to identify potential spam - the heuristic analysis comprises a large number of tests based on typical spam content or behavior and the sensitivity level will determine how many tests would have to be failed for a message to be considered spam. The higher the sensitivity, the higher the "pass mark", therefore the higher the number of emails that will fail the heuristic test and will be treated as spam.

If you find that a lot of "clean" messages are being sent to your spam folder, this may be resolved by reducing the heuristic sensitivity.


Antispam - main settings

Main Settings

On this page you can adjust the scan sensitivity settings and also specify additional actions to be taken automatically:

  • Mark in subject field of spam messages - you can also specify on this page that a message should be inserted into the subject field of any messages that are recognized by avast! as spam. If the box is checked, the message "***SPAM***" will be inserted in the subject field. To change the message, click on "Expert settings" and type the desired message in the box provided.
  • Add recipients of outbound emails to whitelist automatically - by default, addresses to which you send emails are automatically added to the whitelist so that subsequent replies will not be treated as spam. This box is therefore always checked by default.
  • Retrieve new rules? - Here you can specify how often avast! checks for updates to the rules that are used to identify potential spam. Although the default is every 5 minutes, it doesn't mean there will actually be an update every 5 minutes. Usually updates are much less frequent, but by checking regularly, you can make sure you will always have the most up to date rules for identifying potential spam.
  • Enable LiveFeed - If this box is checked, avast! will check all incoming emails against an online database of global spam messages before carrying out the heuristic and other checks. The majority of spam messages are detected this way so it is recommended to leave this box checked. The amount of data transferred is very small, however if you need to minimize the amount of data transferred, this can be unchecked, although this will result in a lower spam detection rate.

If you are using MS Outlook as your email client, you can also specify the name of the folder to which spam email should be moved after it is confirmed as spam. This folder will be created automatically when it's needed and added to the folder structure in Outlook.

You can also specify that entries in your address book should automatically be added to the whitelist of known email addresses, so that they will never be treated as spam.


Antispam - whitelist

Whitelist

By clicking on the box provided, you can enter the email addresses of senders from whom email will not be treated as spam and will always be delivered as normal. You can enter the specific email address, e.g. john.smith@domain.com, or if you enter the domain name only (e.g. domain.com), all emails from that domain will then be allowed.

To remove an email address from the whitelist, click on it once and then click "Remove".


Antispam - blacklist

Blacklist

By clicking on the box provided, you can enter the email addresses of senders from whom email will always be treated as spam. You can enter the specific email address, e.g. john.smith@domain.com, or if you enter the domain name only (e.g. domain.com), all emails from that domain will be treated as spam.

To remove an email address from the blacklist, click on it once and then click "Remove".


Process virtualization

Sandbox

The avast! Sandbox is a special security feature that allows you to browse the web, or manually run another application, in a completely safe environment, isolated from the rest of your system.

This is especially useful when visiting potentially infected websites, or if you suspect an application may be infected - you can run the program (or your web browser) inside the sandbox to determine whether or not it is safe, while remaining completely protected against any malicious actions that it may try to carry out.

To run an application or to browse the web using the sandbox, just click on "Run a virtualized process" then browse the files on your computer to find the required application e.g. Internet Explorer. The browser or other application will then open in a special window with a red border, indicating that it is being run inside the sandbox.

In the Expert Settings, you can further define applications that should always be run in virtualized mode, and trusted applications that should never be virtualized.

Context Menu

By checking the box "Integrate into the right-click context menu..." on the Parameters screen, you can add this option to the context menu. You can add this option for all users, or only for users with administrator rights.

You can then run an application in the sandbox by simply right-clicking it and selecting "Run virtualized".

If an application should always be run in the sandbox every time it is started, select "Always run in sandbox" and the application will be added to the list of applications on the Expert Settings screen which should always be run virtualized. Every time the application is started, it will appear inside a red border which indicates that it is being run inside the sandbox.

Right-clicking on an application that is already in the sandbox, will open a new context menu which will enable the application to be run one time outside the sandbox or alternatively, it can be removed from the sandbox completely so that it will be run in the normal environment again every time it is started.


Sandbox - parameters

Parameters

  • Show borders around the windows created by virtualized applications

    This allows you to specify that the Sandbox will open in a window inside a colored border. This way you can clearly see when an application is being run in the sandbox. You can also choose the color and width of the border.

  • Show tags in the titles of windows created by virtualized applications

    If this box is checked, a special tag will appear in the name of any application that is being run in the sandbox.

  • Show a small popup window when a virtualized application is started

    If this is checked, a small blue popup message will appear briefly in the bottom-right corner above the taskbar before any application starts in the sandbox.

  • Integrate into the right click context menu

    This allows you to add the virtualization option to the context menu. You can add this option for all users, or only for users with administrator rights. This will enable you to run an application in the sandbox by simply right-clicking it and selecting "Run virtualized".

  • Protect virtualized application from screen capture

    If this option is selected, the content of any virtualized windows will be completely blank in any screenshots of your desktop. This ensures that no sensitive data can be captured if somebody else attempts to take a screenshot in order to steal your data.

  • Assign memory/cpu/time restrictions for unsigned sandboxed processes

    If this option is selected, avast! will apply certain limits on the memory and CPU usage to prevent your system from being fully used up by a virtualized application. This ensures that part of your system will still be available to run other applications if the rest of it is hijacked by malware.

  • Drop administrative rights and run virtualized applications as a limited user

    If the Sandbox is opened while you are logged on as a system administrator, any applications that are started in the Sandbox will be started without administrator rights. This provides another layer of security to prevent access to locations that can only be accessed by a system administrator.

EXPERT SETTINGS

  • Override the maximum copy filesize limit and specify the size manually (MB)

    This allows you to change the maximum size of file which can be modified in the Sandbox. Files that are virtualized are copies of the original file - if an attempt is made to modify a file which exceeds this size, it will not be permitted.


Sandbox - storage

LOCATION

  • Select the drive where you want to keep the sandbox storage

    Here you can specify the location of the folder in which your sandbox files will be saved. By default, a sandbox storage folder will be created in the same location as the modified file. This spreads the storage over the available locations to make the best use of the available space.

    Alternatively, you can specify that there should be just one sandbox storage folder located on your C: drive, or you can browse your computer to select a different location.

    Note that if you change the location of your sandbox storage, you will need to restart your system to make it effective and the current folder and all of its content will be deleted.

ACCESS CONTROL

  • Assign a drive which can be used to access your aggregated sandbox storage

    By default, Windows will assign a specific drive letter which you can then use to access your entire sandbox storage. However, you can select any other available drive letter instead. This is useful if you have multiple storage folders (for example, if storage folders are created on the same drive as the modified file) and allows you to access and manage all of your stored files together, regardless of their actual location.

  • Mount automatically at startup

    If you assign a new drive letter for accessing your aggregate sandbox storage, you can apply (mount) the new drive immediately, or when your computer is next started.


Sandbox - web browsers

Web browsers

  • Save trusted downloaded files outside the sandbox

    If this box is checked, files saved or downloaded while working in the sandbox will be saved outside the sandbox. In other words, the process of saving or downloading files to these locations will not be virtualized. This box is checked by default, but if unchecked, any files that you save or download while working in virtualization mode will not actually be saved.

  • Detect updaters and run them outside the sandbox

    Enabling this option means that any web browser updates which are detected while browsing in the Sandbox will be allowed to run as normal outside the Sandbox.

Exclusions

Here you can specify that some options should not be virtualized when running your web browser in the sandbox e.g. bookmarks, browsing history, and cookies. This means that even when running your web browser in the sandbox, these options will not be virtualized and will be available to any other browsing sessions which are open or which are opened later, whether inside the sandbox or outside.

Maintenance

  • Cache web browser's files (sandbox will not be automatically deleted)

    Normally, whenever an application is launched in the sandbox, avast! creates a special sandbox storage area for that application and where virtualized files/folders are saved. This sandbox storage is then normally deleted when the application is terminated.

    If this box is checked, a completely separate sandbox storage will be used for web browsers and this will not be automatically deleted when the browser is terminated. This means that the next time the browser is launched, it will use the same sandbox storage from the previous browser session, which will therefore improve the browser's performance.

  • Automatically cleanup sandbox storage

    Here you can specify that the sandbox contents should be automatically deleted. You can also specify how frequently, for example after a given number of days, on the same day every week, or on the first given day of every month.


Process virtualization - virtualized processes

Virtualized processes

On this page you can specify files that should always be run virtualized. Just click on the browse button and then locate and select the file or path that should always be run inside the sandbox. To remove a file or path from the sandbox, just click the delete button.


Sandbox - privacy

Privacy

On this screen you can limit the access that virtualized applications will have to various locations on your computer You can use this setting to block access to your private files and data e.g. MS Office files, Cookies, recently typed URL, etc.

You can mark specific locations as "Read-only", so that files can be opened, but any attempt to delete, modify or rename the files will not be permitted. Or you can completely block all access to your files, so that they will not even be visible to a virtualized application. This prevents any malware from accessing your files, collecting them and sending them to somebody else via the Internet.

By default files located in the "System", "Internet Explorer" and "Application Data" directories are automatically blocked. However you can unblock them by unchecking the box, or you can change the status from "Blocked" to "Read-only". You can also add your own folders and set the same block/read-only access for them.


Process virtualization - exclusions

Exclusions

On this page you can specify files that should never be run virtualized. Just click on the browse button and then locate and select the file or path that should be excluded. To remove a file or path from the list of exclusions, just click the delete button.


Process virtualization - Internet access

Internet access

Here you can define which (or if any) virtualized applications are allowed to access the Internet.

It is possible to "Allow all" or to "Block all" or you can specify certain applications that will be allowed Internet access and all others will be automatically blocked. For example, you can allow access for all web browsers or you can define other specific applications by clicking in the box "Select additional applications" and using the browse button to locate and select applications that should be allowed Internet access.


Process virtualization - report file

Report file

On this screen you can specify that a report should be created after an application is run in virtualization mode. You can specify the type of report file (plain text or xml) and the period for which the report should be retained.

The report will contain basic information about the application that was run in virtualized mode, the date and time the application was run in virtualized mode and details of what actions were carried out while the program was running in virtualization mode.

The report file is saved in the folder C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report (Windows 2000 and Windows XP) or in the folder C:\ProgramData\AVAST Software\Avast\report (Windows Vista, Windows 7).


SafeZone parameters

By clicking the "Reset SafeZone" button, all contents of the SafeZone will be permanently deleted.


AutoSandbox

The avast! AutoSandbox is a special security feature which allows potentially suspicious applications to be automatically run in a completely isolated environment with no risk to your computer or any of your other files.

By default, if an application is started and avast! detects anything suspicious, it will automatically run the application in the Sandbox. In the AutoSandbox settings, you can change this so that avast! will ask you first. If you answer "Open in sandbox", the application will then be started inside the Sandbox where it cannot cause any damage to your system.

This allows you to check any suspicious applications while remaining completely protected against any malicious actions that an infected application might try to perform.

The browser or other application will then open in a special window with a red border, which indicates that it is being run inside the Sandbox.

In the settings, the AutoSandbox can also be disabled completely, or you can specify any files or applications that should not be run automatically in the Sandbox.

The AutoSandbox settings can also be found in the Expert Settings for the File System Shield.

In avast! Pro Antivirus and avast! Internet Security, the main Sandbox settings will also be used by the AutoSandbox - for example, whether or not downloaded files and other browser options are automatically deleted when the sandbox is closed.

These settings are not available in avast! Free Antivirus and when the Sandbox is closed any downloaded files will be automatically deleted.


AutoSandbox Settings

Here you can specify that avast! should ask you before running any suspicious applications in the Sandbox, by simply changing the "AutoSandbox mode" to "Ask".

You can also exclude particular files from being run in the Sandbox by first clicking on "Enter path" and then clicking on the "Browse" button to select the files that you want to exclude.

To turn off the AutoSandbox completely, just uncheck the box "Enable AutoSandbox".


SafeZone

avast! SafeZone

The avast! SafeZone is an additional security feature in avast! Pro Antivirus and avast! Internet Security, which allows you to browse the web in a private, secure environment, invisible to the rest of your system. For example, if you do your banking or shopping online, or other security-sensitive transactions, you can be sure that your personal data cannot be monitored by spyware or key-logging software. If you go to a banking site which is recognized by avast, you will be automatically prompted to use the SafeZone browser for your online transactions. Unlike the avast! Sandbox, which is intended to keep everything contained inside so that it cannot harm the rest of your system, the avast! SafeZone is designed to keep everything else out.

To open the secure SafeZone desktop manually, just go to the "Additional Protection" tab, then open the "SafeZone" tab and click "Switch to SafeZone"

When you switch to SafeZone, the SafeZone web browser will start automatically. The SafeZone browser is a special browser without any additional components such as "plug-ins" which are often used to distribute spyware.

When you are done, click on the Start menu and select “Turn Off” to close the browser and return to your normal desktop. Your browser settings and any files that you have downloaded will be saved automatically and will be there the next time you open it. If you don't want anything to be saved, click the "Reset SafeZone" button and everything will be deleted. The contents of the SafeZone, including all browser settings, will be reset to their original state.

Alternatively, you can just click the “switch back” button on the taskbar (next to the clock) which will return you to your normal desktop without terminating your web browser, so you can return to it later.


Browser Protection

On this screen you can specify whether your web browsers should always be started in the Sandbox, so that you are always protected from any threats from the Internet.

In the expert settings, you can enable the WebRep feature and the Phishing filter, if they are available for your browser.

If you use Google Chrome, the plugins are automatically installed during the installation of avast. They can be uninstalled or installed for any other supported browser just by clicking "Uninstall" or "Install". Once installed, you can activate them by checking the box in the expert settings.

The WebRep is based on information received from the global avast! user community related to the content and security of visited websites, to help improve the browsing experience of all users. You can contribute your own feedback by "voting" on the content and security of websites that you visit - see below.

When you visit a website, you will see a sequence of three bars (red, yellow, or green) which tell you how the website has been rated, or when you do a search using one of the popular search engines, you will see the same color-coded indicator next to each of the listed results.

The color of the indicator tells you whether the site is rated as "good" (green), "average" (yellow), or "bad" (red). The number of bars that are highlighted indicate the strength of the rating. One, two, or three highlighted bars represent a small, limited, or large number of votes.

Clicking on the colored indicator will open a box where you can see more information about how the site has been rated and where you can also submit your own vote.

On the left side, you can see the overall rating. Below the rating, you can see smaller icons which represent the categories that the site belongs to.

On the right side, you can submit your own vote. Here you can see a single bar divided into five colored segments which you can use to assign a more detailed rating to the domain. Below this bar you can again find the category icons. Click on one or more icons to assign the domain to the relevant categories, then finally click on "vote" to submit your rating.

The Phishing filter offers you additional protection by warning about known sites which are designed to steal your personal login details or other sensitive financial data.


WebRep

The avast! WebRep is automatically installed during the installation of avast! antivirus. It can be uninstalled or installed for any supported browser by opening the avast! interface, then in the "Additional Protection" tab, select "Browser protection" and then just click "Uninstall" or "Install". Here you can also see whether your Internet browser is supported, before you try to install it.

The WebRep is based on information received from the global avast! user community related to the content and security of visited websites, to help improve the browsing experience of all users. You can contribute your own feedback by "voting" on the content and security of websites that you visit - see below.

As well as protecting you from known infected sites, it also offers you protection from phishing sites which are designed to steal your personal login details or other sensitive financial data.

When you visit a website, you will see a sequence of three bars (red, yellow, or green) which tell you how the website has been rated, or when you do a search using one of the popular search engines, you will see the same color-coded indicator next to each of the listed results.

The color of the indicator tells you whether the site is rated as "good" (green), "average" (yellow), or "bad" (red). The number of bars that are highlighted indicate the strength of the rating. One, two, or three highlighted bars represent a small, limited, or large number of votes.

Clicking on the colored indicator will open a box where you can see more information about how the site has been rated and where you can also submit your own vote.

On the left side, you can see the overall rating. Below the rating, you can see smaller icons which represent the categories that the site belongs to.

On the right side, you can submit your own vote. Here you can see a single bar divided into five colored segments which you can use to assign a more detailed rating to the domain. Below this bar you can again find the category icons. Click on one or more icons to assign the domain to the relevant categories, then finally click on "vote" to submit your rating.


Remote Assistance

The remote assistance tool enables you to give another person remote access to your computer. This can be useful if you are having any difficulties and you want another person to take control of your computer to help resolve the problem.

If you need to request assistance from another person, click “Allow Remote Control”.

Avast! will generate a code that you then need to provide to the assisting person. To transfer the code to the other party please use e.g. telephone, e-mail or chat. By sending the code you are granting remote access to your computer to another person. After the person takes control, this dialog disappears automatically.

If you will be providing the remote assistance, click on "Control Remote Computer". Enter the code which you receive from the person needing assistance, then click the "Connect" button. When the connection is established, this dialog disappears and the remote desktop window appears.

To close the connection, click the following link or press the Alt+Shift+End shortcut.


Site blocking

On this page you can enter the URLs of any websites that should be blocked so that they cannot be viewed in your browser. This feature can be used to block access to sites that you do not want children or other users to be able to access, e.g. sites that contain adult content.


Firewall

avast! Internet Security includes a fully integrated firewall which can be controlled directly from the avast! user interface.

The firewall monitors all communication between your computer and the outside world and blocks unauthorized communication based on a number of "allow" and "deny" rules. In this way, the firewall can prevent sensitive data from leaving your computer and can also block attempted intrusions by external hackers.


Firewall settings

On this page, you can adjust the firewall security settings to limit external connections according to the environment in which the computer is being used.

Three security levels are defined:

  • Home/low risk zone - suitable when using your computer as part of a home/private network. If this setting is selected, the firewall will allow all communication with the network.
  • Work/medium risk zone - suitable for when your computer is connected to a wider public network, including direct connections to the internet. This is the default setting and if selected, the firewall will allow communication in and out only if allowed by the "Application Rules". If no rule has been created, you will be asked to confirm whether or not communication with a particular application should be allowed.
  • Public/high risk zone - suitable when using your computer to connect to a public network and where you want to ensure the maximum level of security. This is the most secure setting and if selected, no incoming communication will be allowed, effectively making your computer completely invisible to others.

You can adjust the level of security by either clicking on the relevant icon, or by clicking on the orange slider and moving it to the left or right while holding the mouse button down.

On this page, you can also turn off the firewall completely, either permanently or for a specified period of time by clicking the Stop button and selecting the required option. Click Start to turn it on again.

Show statistics history

In the graph at the bottom of the page, you can see a real- time representation of the amount of incoming and outgoing data. To see a more detailed view, click on "Show statistics history". On the Statistics screen, you can view the data for the firewall, antispam filter, or any of the real-time shields over the period selected. To change the scale of any part of the graph, click on the vertical line and drag it to the right. To return to the previous view, just click on "Show all" and the previous view will be restored.


Firewall - policies

On this page you can specify what action should be taken if the firewall mode is set to "Work/Medium Risk Zone" but no rule exists for an application on the Application Rules page. The default is "Auto decide". In this case, if the application is from a trusted publisher, it will be allowed, but if not, various other criteria will be used to determine if it is safe to allow the connection.

The default action can be changed to "Allow", "Block", or "Ask". The least secure setting is "Allow" as this means all connections will be allowed irrespective of the risk. This would have the same effect as changing the profile setting to "Home/Low Risk Zone".

The most secure setting is "Block", which means no connections will be allowed other than those permitted on the Application Rules page, however, this might also result in legitimate connections being blocked.

Alternatively, if you select "Ask", you will see a message every time an application tries to connect to your computer, asking you to confirm whether or not the connection should be allowed.

The recommended action is the default "Auto-decide" as this will ensure that suspicious connections are not permitted, without continually asking you to confirm whether or not the connection should be allowed.

Preferences

Here you can choose to receive a notification message whenever a new "allow" or "block" rule is created by the auto-decide feature.

You can also turn on the Internet Connection Sharing (ICS) mode - this should be checked only if the Windows ICS mode is also turned on. As your computer will be acting as a gateway between the Internet and other computers with their own security settings, certain ports which would normally be closed, would have to be opened. As a result, the level of security is slightly reduced if this box is checked.

Use fast checksums - checksums (or hashes) are used to identify the applications defined on the Application Rules page. If the calculated checksum does not match the checksum that is stored for an application, it will be treated as a new application. As calculating full hashes/checksums is a lengthy process, "fast" checksums are used by default - using these is only slightly less secure, but considerably faster.


Firewall - network profiles

Network Profiles

If a profile has been specified for a particular network, the network and its corresponding profile will be listed on this page.

Normally, when a new network is detected, you will be asked to specify the new network profile. However, checking the box "Enable automatic profile switching" will result in the profile being changed automatically when a new network is detected, if the new network corresponds with one of the networks in the table.


Firewall - process control

Process control

Here you can define which programs can, and cannot, run other applications that have access to the Internet or can connect with other computers on your network. This is useful as it can prevent an incoming connection from simply launching another application, which may then be used to perform unauthorized actions. This is a trick commonly used by hackers to collect personal or sensitive information without the user's knowledge.

If a program is not listed in either category, avast! will decide automatically whether or not the process should be allowed by carrying out various checks, for example whether the program that is trying to launch another application is a recognized program and one that would normally be expected to behave in this way.


Firewall - Friends

Friends

On this page, you can specify networks which are considered to present a low security risk. This is then used where the access permission is limited to friend networks on the application rules page.

On the application rules page, you can set the permission to any of the following:

  • Friends out
  • Friends in/out
  • Internet out
  • Friends in and Internet out
  • All connections

Friends out is the most secure setting as no incoming connections will be allowed and outgoing communication will only be allowed with networks defined on this page as friend networks.

Connections to the Internet automatically include connections to Friends. For example, "Internet out" automatically includes "Friends out". If "Friends in and Internet out" is selected, outbound connections to the Internet will be allowed, plus both inward and outbound connections with Friends. If "All connections" is selected, all incoming and outbound connections will be allowed.


Firewall - network connections

Network connections

This screen just shows you the connections that are currently open, or were open recently on your computer. You can see more details by clicking the checkboxes at the top of the page. By right-clicking on any particular connection, you can get more details about the specific IP address, or trace the route taken by a piece of data to get to or from your computer - see Network Utilities.


Firewall - application rules

Application Rules

On this page, you can set the communication rules for specific applications. The firewall will then follow the application rule whenever a particular application tries to establish a connection with the Internet or with another network.

Default rules will be created automatically for applications from trusted sources when the application is first started. To add an application to an existing group, just click on "New application rule", select the group and browse for the application to be added. Then select the level of access allowed by clicking on the group name and then clicking the orange bars displayed next to the added application. Alternatively, you can create a new group by clicking the "New Group" button and then adding the new application rule. You can name the new group at the moment it is created, or you can re-name it later using the right-click context menu. You can also move an application to another group by right-clicking on it and selecting "Move".

Five levels of access are possible:

  • Friends out
  • Friends in/out
  • Internet out
  • Friends in and Internet out
  • All connections

"Friends out" is the most secure setting as no incoming connections will be allowed and outgoing communication will only be allowed with networks defined on the Friends page in the expert settings.

Connections to the Internet automatically include connections to Friends. For example, "Internet out" automatically includes "Friends out". If "Friends in and Internet out" is selected, outbound connections to the Internet will be allowed, plus both inward and outbound connections with Friends. If "All connections" is selected, all incoming and outbound connections will be allowed.

You can further specify how to deal with connections above the selected level, for example, if an incoming connection from the Internet is detected, but the access level is set only to "Internet out":

"Block" means that such connections will never be allowed.

"Auto-decide" means the connection will normally be allowed, however any suspicious connections will be automatically blocked. This will be based partly on a large white-list database of safe applications maintained by avast!

If "Ask" is selected, you will see a message asking you to confirm whether or not the connection should be allowed.


Firewall - network utilities

Network utilities

Here you can find out more information about specific IP addresses and you can also see a map of the route that a piece of data takes to get to or from your computer. Just enter the IP address and click on "Get details" or "Trace".

On this screen, if you're an experienced user, you can also reset the Windows network stack if this has been affected by a severe virus infection.


Firewall logs

On this page, you can choose to view the firewall logs related to "connections" or "activity".

If "connections" is selected, you will see details of connections that have been blocked based on the rules in the firewall settings and the application rules.

If "activity" is selected, other actions carried out by the firewall will be listed, for example, new allow or block rules that have been created automatically (as a result of selecting "auto-decide" or "ask" in the firewall settings) and which will be applied whenever an attempt is made to establish a new connection. Whenever a new rule is created, it will be added to the list on the "Application Rules" page where it can also be modified, if required.


Using the command line

How to use the command-line scanner

This feature is only available in avast! Pro antivirus and avast! Internet Security.

The ashCmd program uses the same avast! scanning engine to detect potential malware infections so the results are exactly the same as running a scan via the normal program interface. The avast! command-line scanner, ashCmd.exe, is normally installed in the directory C:\Program Files\AVAST Software\avast.

A scan is run from the command prompt using various switches and parameters. To see a description of the parameters, locate the ashCmd file and double click on it. This will open a new window in which the various parameters are displayed. A list of all the parameters can also be found here in the avast! Help.

To run a scan, go to the command prompt and change the directory to:

C:\Program Files\AVAST Software\avast

Then type the program name ashCmd.exe followed by the area to be scanned and the appropriate parameters. For example, to scan all local hard drives, the command line would be:

ashCmd.exe /*

Additional parameters can be added as required. To scan a particular file, type the required path, making sure that any names containing spaces are enclosed in quotation marks (" ") e.g.

ashCmd.exe "C:\Program Files"

To run a particular scan, type the program name followed by /@=<name of scan>. For example, to run a scan called "Weekly scan", the command line would be:

ashCmd.exe /@="Weekly scan"

The scan will be run based on the parameters defined for the given scan. Any other parameters entered in the command line will be ignored.

When the scan is finished, the results can be output to a file using the parameter "/_ >" so, for example, the command line:

ashCmd.exe C:\Windows /_ > results.txt

would result in the path C:\Windows being scanned and the results of the scan being saved in a new file called results.txt


Command line parameters

Parameters and Switches

Example: "C:\Program files" /p /u=virus@avast.com --soundoff /v="key kapt"

d:\path
This parameter specifies the drive and directory that should be tested. If the parameter is not given, the files in the root directory of the current drive are scanned. It is possible to specify more drives simultaneously.

d:\path\file
When the full pathname of a file is given, ashCmd only this one file is scanned. The file must exist!

/H or /? (or --help)
Prints brief help and a list of possible switches.

/# (or --remote)
Scans remote disks.

/* (or --local)
Scans local hard disks.

/_ (or --console)
The application will be ready for STDIN/STDOUT. All the output will be redirected to the standard output (STDOUT). It means that the output can be processed using various UNIX-style command-line tools.

/A (or --testall)
Tests all files.

/@=<task name> (or --task)
Starts a particular avast! scan. All the other parameters are ignored. If the scan name contains any spaces, it must be enclosed in quotes.

/C (or --testfull)
Switches on scanning of whole files. By default, only the important parts of the files are tested, which is much faster. When any virus is found, the program switches to scanning the whole files automatically.

/D (or --dontpanic)
Tells avast! that it should not switch to "panic mode" when an infected file is found. Panic mode means, the sensitivity is automatically increased to the maximum.

/E=<value> (or --heuristics)
Sets the heuristic sensitivity of the scan. The value can be in the range 0 - 100, where "0" means disabled and "100" is the maximum heuristic sensitivity.

/F=<value> (or --fileactions)
Tells avast! how to process infected files, e.g.

  • B = allow delayed actions (after reboot) for locked files.
  • P = if a file cannot be removed from an archive, try to remove the parent archive
  • S = do not remove associated auto-start references when removing a file
  • W = if an infected file is found inside an archive, apply the action to the whole archive, not just the infected file.

/G=<value> (or --checkgenuine)
This tells avast! to check the digital signatures of suspicious files and what to do if the signature is from a trusted source. The value can be "0" (which means all files will be reported) or "1" (to not report files with digital signatures from trusted publishers)

/I (or --ignoretype)
Switches on searching for all viruses in all files (i.e. boot viruses will be looked for even in .exe files etc.).

/J (or --paging)
Pages the lines if the program is not in STDOUT mode (i.e. stops after each full page of results).

/M (or --boot)
Tests boot sectors and the operating memory.

/P (or --continue)
This switch specifies that the program will run without any delays after checking the disk system areas and without waiting for user interaction when a virus is found. To check the result of the scan, you can use predefined return codes, or information stored in a report file. To specify an automatic action with the infected files, use /P=[1234], where 1 = delete file, 2 = move to Chest, 3 = repair, 4 = stop.

/R=[*] [file name] (or --report)
This switch specifies that a text file will be created with a list of viruses found and a summary table (report file). If the file name is not given, ashCmd.rpt in the current directory is used for the output. When the switch /R is followed by the "*" character, all the scanned files will be written to the report file (even those where no virus was detected).

/S (or --soundoff)
This switch turns off the virus sound alert. By default, any virus found is announced by a beep.

/U=<address> (or --sendmessage)
If a virus is found, a warning message is sent to the given address.

/T=[JZIMXRSTGCBWOEQHFVKPY7D6U123AN] (or --archivetype)
Specifies the type of archives to scan (J:ARJ, Z:ZIP, I:MIME, M:MAPI, X:Exec, R:RAR, S:Streams, T:TAR, G:GZ, C:CAB, B:BZIP2, W:WinExec, O:ZOO, E:ACE, Q:ARC, H:LHA, F:TNEF, V:CPIO, K:CHM, P:RPM, Y:ISO, 7:7ZIP, D:DBX, 6:SIS, U:OLE, 1:Installer, 2:Dropper, 3:Emulator, A:All, N:none).

/X=<value> (or --virustypes)
Sets specific malware types that should be detected (types not detected by default)

  • P = PUPs (Potentially Unwanted Programs)


Silent installation

Silent installation of avast!

This option, intended especially for network administrators, makes it possible (and easy) to install avast! on other computers, without involving the other computer users. The installation can be carried out with pre-defined program and scan settings.

To create the silent installation:

  1. Install avast! on one computer.
  2. Modify the avast! settings as you want them to be on the other computers.
  3. Set the scan parameters as required.
  4. If required, set a password to access the real-time shield settings.
  5. Select File ® Create Silent Installation.
  6. Set the parameters of the silent installation:
    • Silent mode - During the installation on the target computers, only error messages will be displayed.
    • Very silent mode - During the installation on the target computers, no messages will be displayed.
    • Installation path - Enter the folder in which avast! should be installed (by default, %PRGFILES%\Alwil Software\Avast5).
    • No reboot - avast! normally requires the computer to be restarted after installation. If you select this option, the reboot will not be requested.
    • Ask for reboot - When the installation is finished, the user will be asked to reboot.
    If neither No reboot nor Ask for reboot is checked, the system will be restarted automatically when the installation is finished.
  7. Click the Create button.
  8. Select the folder where the files necessary for the silent installation should be stored.
  9. The following two files will be written to the selected folder: admin.ini and tasks.xml. The file admin.ini contains the settings of the avast! program, the file tasks.xml contains the relevant scan settings. If a password was set for the real-time shield settings, there will be another file in the target folder: aswResp.dat; this contains the encrypted password to access the real-time shield settings.
  10. Put these two or three files into a shared folder.
  11. Put the avast! installer into the same folder.
  12. On the target computers, start the avast! installation from this folder.