Behavior Shield

This Article Applies to:

Avast Business On-Premise Console

Behavior Shield is an additional layer of Antivirus active protection. It monitors all processes on the device in real time for suspicious behavior that may indicate the presence of malicious code. Behavior Shield works by detecting and blocking suspicious files based on their similarity to other known threats, even if the files are not yet added to the virus definitions database.

Behavior Shield is available for Windows workstations only.

Configuring Behavior Shield Settings

To access Behavior Shield settings:

Go to the Policies page
Open the desired policy
Select Windows Workstation
Go to the Active Protection tab
Click the Customize link next to Behavior Shield

Two sets of settings are available here:

Main settings
Exclusions

Main Settings

These settings let you define which action the shield should perform upon detecting a suspicious program. You can choose between the following options:

Always ask: Behavior Shield asks what you want to do with a detected threat before any action is taken.
Automatically move detected threats to the Quarantine: Threats that behave similarly to known threats listed on the Avast virus definitions database are moved to Quarantine.
Automatically move known threats to the Quarantine (enabled by default): Threats that are listed on the Avast virus definitions database are moved to Quarantine, unknown threats will be asked.

Exclusions

These settings allow specifying locations that should be excluded from Behavior Shield scans. All added exclusions will be displayed here and can be edited or deleted if needed.

Exclusions that you specify here only apply to Behavior Shield and do not affect any other scans or shields. To exclude a location from all Antivirus scans, set up standard exclusions instead.

For more information on standard and component-specific exclusions, see Configuring Antivirus Exclusions.

Behavior Shield does not support wildcards within the file path (for example, C:\users\*\application.exe). You can still use a wildcard at the end of the file path, such as C:\users\username\*.