eEye Digital Security

Curentaly my auto update is set for an early AM run - And of course I shut my computer down each night becase its loud and anoying...

When i start up in the AM - I know the updater starts clicking away.....and it wants to run the update... well here is the issue....

Each AM I run Outlook to get my emails - and just about everytime there is a more major update - BLINK will update and restart the app thus for a short period of time I am (as far as I can tell) unprotected.... becase Outlook is open and Blink is updating.... so if Outlook at that same time was to download a virus email - I would be exposed to it correct?

I also have noticed that if leats say last night I updated manually..... Blink will reupdate in the AM and it seems reinstall the same update I got from the night before manually...

For the time being I will just mnaually update and disable the scheduled update, any thoughts about a possible better way to handle updates where we might not get exposed when using the auto updater?

 

Anyone seen this issue?

 

 

It's interesting that yours was the first post I saw when I logged in because I came to the forum to see if anyone else was having Blink turn off regularly and unexpectantly. I don't have the same issue regarding Outlook because I don't use it, but I will be surfing the net or working with some program and Windows will pop up an alert informing me that my firewall and antivirus is disabled. I initially thought I was infected and the virus had purposely turned off my security software, however after a few moments the program will start back up so then I started to wonder if there was something wrong with the program. I don't recall ever seeing any other AV or firewall program I have used in the past exhibit this "automatic shutdown" behavior. I am behind a hardware router/firewall and not completely vunerable but it still concerns me that my primary security program needs to be turned off each day for a few moments while the updater runs. Needless to say this behavior has made me start thinking about going back to a layered approach and using a seperate AV, firewall, anti-spy, HIPS, etc. instead of an all-in-one suite.

Blink does have a layered approach and while the AV signature database is updating the rest of the layers are still active protecting your system. Even more so, while doing signature updates all files that are being accessed are recorded for a later scanning.

We will however take steps to make sure that the update is as fast as possible, and even maybe find a way of not unloading the old signature database until the new one is loaded and active. The main reason we haven't done that is because the memory usage would spike significantly for a few seconds and that might put an extra burden on less powerful systems.

 

Laurentiu,

Thanks for the quick response.

You mentioned that "all files that are being accessed are recorded for a later scanning". Does this scanning take place automatically when the AV restarts after the update or at some other time?

Also, is it normal for the firewall component to be shutdown during the AV updates?

Thanks and Regards

The scanning takes place after a while.

The firewall should not be stopped unless the firewall engine itself is updated. Are you seeing the firewall shutting down every day?

Yes, I believe so. I'll have to pay closer attention to confirm, but I believe that each time it happens the Windows pop-up says that both my AV and firewall are disabled.

I'll start watching closely to confirm.

I have a suggestion that may or may not be feasible, but anyway....it would be better I think if if there was a way for Blink to immediately scan those files that it recorded as being accessed (and only those files) after an update instead of waiting an indeterminate time before doing so. It would seem to me that a process such as that would eliminate any concerns over malware slipping in during the update and not being caught until some time later.

Like I said it's just a suggestion and since I'm not a firewall or AV expert I may be off base and this may not be necessary.

Ok - so covered on the virus side with mutiple layers...

That said...

I think I remember when using mcafee - it would actually hold up email recieving if it was updating - even with outlook open...

I assume this is just not needed with Blink becase of the mutiple layers of protection - but that said it is a bit disconcerting when the auto update happens and all of a sudden out of what seems like nowhere the system tells me that I have lost my AV protection or Firewall protection...