Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Be Secure on May 24, 2017, 05:52:33 AM
-
Why avast behavior shield is so slow to monitor the ransomware and failed to block it in time? >:(
But good news is that i am testing it in SD(Shadow Defender)with only avast behavior shield on.
Another good news it is block by FilerepMalware. 8)
It is the new Jaff Ransomware with .wluExtension.
I mention it in SECURITY WARNINGS & Notices:https://forum.avast.com/index.php?topic=52252.msg1396539#msg1396539 (https://forum.avast.com/index.php?topic=52252.msg1396539#msg1396539)
At last Avast users are protected. :D
-
You should have installed Malwarebytes 3.0 Premium. Malwarebytes protects users from this ransomware. Look at my signatures
https://blog.malwarebytes.com/cybercrime/2017/05/new-jaff-ransomware-via-necurs-asks-for-2-btc/
-
You should have installed Malwarebytes 3.0 Premium. Malwarebytes protects users from this ransomware. Look at my signatures
https://blog.malwarebytes.com/cybercrime/2017/05/new-jaff-ransomware-via-necurs-asks-for-2-btc/
Thanks but i am using Voodooshield with avast. :)
Avast also block this ransomware by FileRepMalware but avast behavior shield is so slow to monitor the ransomware and failed to block it in time.
-
hi, according to the same test on malwaretips. Avast was bypassed while AVG's IDP blocked it succesfully
This is the 4th time I have seen this happened
-
hi, according to the same test on malwaretips. Avast was bypassed while AVG's IDP blocked it succesfully
This is the 4th time I have seen this happened
Plus the shell behavior of avast is the same idp of AVG.
-
Hey guys,thanks for reporting.We have brought this to the attention of someone responsible for behaviour detection internally.Just like you guys I am curious about this possible issue and improving Avast.
We need some details from you guys right now.Were both avg and Avast were tested in a in working internet connection environment? And were both products tested only with IDP?
Screenshots of both products IDP detecting it and sample hash.
Now remember IDP is no silver bullet it just has multi stage detections so the malware did something at the end that got caught so files getting encrypted is not unusual Avast is always trying to make it better and filerep and Evo gen always are on toes detecting new samples as it did here so we should be protected.
Much appreciated.
-
according to what I read from the testers, both were tested with internet connections, under a VPN in VMs:
Avast free: File-Web-Behavior Shields, PUP enabled -> blocked | Bonus test: only file shield was disabled -> failed to react, no notification, everything was encrypted
AVG internet security: was tested at least 5-6 hours after avast, similar conditions. Default settings, PUP enabled. Blocked almost instantly by IDP and nothing was encrypted
the AVG tester performed a bonus test WITHOUT the internet connection and AVG's IDP failed to react. As soon as he turned on the internet, IDP blocked it. The 2 testers thought that IDP was cloud-based because of this. Moreover, they noticed, everytime they ran the same samples, they received different numbers from IDP
EDIT: the tester told me this, thank you:
Avast did detect it as Filerep so perhaps it was not analyzed thoroughly as of that time. This could explain why IDP did not get the "correct" answer from cloud or a confirmation of this file being malware.
AVAST: FileRepMalware - IDP did not detect.
AVG: Malware Gen - IDP detected.
-
Thanks@Evjls. :)
-
Just to be clear here:
Avast: Running the sample with internet connection with cloud enabled = IDP never reacted or reacted late?
AVG : Running the sample with internet connection with cloud enabled = IDP caught the sample immediately?
It's also important that both samples were tested near the same time.
-
Just to be clear here:
Avast: Running the sample with internet connection with cloud enabled = IDP never reacted or reacted late?
AVG : Running the sample with internet connection with cloud enabled = IDP caught the sample immediately?
It's also important that both samples were tested near the same time.
Avast never reacted, AVG reacted and caught the ransomware immediately, I assumed because nothing was encrypted
AVG was tested/posted ~5-6 hours after Avast
-
Just to be clear here:
Avast: Running the sample with internet connection with cloud enabled = IDP never reacted or reacted late?
AVG : Running the sample with internet connection with cloud enabled = IDP caught the sample immediately?
It's also important that both samples were tested near the same time.
Avast never reacted, AVG reacted and caught the ransomware immediately, I assumed because nothing was encrypted
AVG was tested/posted ~5-6 hours after Avast
Thanks for that. I've just asked one of the devs behind the Behaviour Shield. The most likely reason is that the AVG test was conducted 5-6 later.the cloud.
-
Regarding the behavior shield being dependent on the cloud, that isn't entirely true:
The cloud is just another layer, it checks the cloud for getting info, if the file is clean/bad etc.
The difference of these samples is because of the time between the two tests and that it meanwhile got classified.
Also, the behaviour shield is the last line of defence. Most of the time other mechanism should catch the malware which is why just testing the behaviour shield on it's own isn't viable.
-
Regarding the behavior shield being dependent on the cloud, that isn't entirely true:
The cloud is just another layer, it checks the cloud for getting info, if the file is clean/bad etc.
The difference of these samples is because of the time between the two tests and that it meanwhile got classified
The tester of AVG told me that he also tested AVG without the internet connection after the sample being blocked by IDP in the previous test. IDP didn't react and everything was encrypted. Then, he turned on the internet and tested it again. IDP worked
Therefore, we agreed that without the internet, IDP won't work properly
-
Regarding the behavior shield being dependent on the cloud, that isn't entirely true:
Sure, it's not. It has it's own rules and goodies :) Overall I think this whole thing is kinda overblown in terms of Avast vs AVG (or such). Let me explain my understanding/point of view:
First: The test itself is far from perfect and does not mimic real world scenario.
Avast in my test picked up the samples as FileRepMalware. This (as far as I know) is coming straight from the cloud or classification system(s). I say that because for example Windscribe VPN is blocking cloud access for some strange reasons. So while I did use Windscribe some time ago, detections from right click scan never showed "FileRep" or similar "cloud" detections.
Now onto AVG's case: It was tested ~5 hours later. From the right click scan we can see this same file was now categorized as Malware-Gen - meaning it is deemed as malware and signature was created. So with Web/Behavior Shields on, IDP queried the cloud and since the file was 100% marked as malicious, it gave it random name and quarantined it...? Seems like so.
I don't think Avast devs want to go into details on how their systems work. I don't see a problem - the file was detected correctly in both cases and VM was protected.
However, IDP itself was not able to detect the file via behavior in both cases (in my opinion). So that's where Devs need to work on.
-
Therefore, we agreed that without the internet, IDP won't work properly
That is not true. Without the cloud, you are just missing another layer. If you had the file shield enabled, it would get caught by file shield.
Ofcourse some IDP detections do come from the cloud (most come behaviorally) but that doesn't mean Avast would fail to detect the sample since the File Shield would catch it.
-
The main thing to take away from this is that Avast does detect and protect. :)
-
The main thing to take away from this is that Avast does detect and protect. :)
Of course,but we want to improve the protection.
-
@Alikhan and others I think we should be trimming off some the info on IDP over here since malware writers are watching too ;)
IDP is somewhat helped by cloud not entirely though and vice versa to be short.
There are discussions still going on internally among Avast forum members and the respective employees let's say we are trying ;)
-
The main thing to take away from this is that Avast does detect and protect. :)
Of course,but we want to improve the protection.
exactly. If there is a new variant of Jaff ransomware and it hasn't been detected by cloud or signatures, avast would be bypassed
Perhaps, hardened mode would be able to stop it but many people don't turn on HM
-
The main thing to take away from this is that Avast does detect and protect. :)
Of course,but we want to improve the protection.
exactly. If there is a new variant of Jaff ransomware and it hasn't been detected by cloud or signatures, avast would be bypassed
Perhaps, hardened mode would be able to stop it but many people don't turn on HM
Some people still forget that there's no such thing as a perfect AV; as much as we would love that tom happen. :)
-
The main thing to take away from this is that Avast does detect and protect. :)
Of course,but we want to improve the protection.
exactly. If there is a new variant of Jaff ransomware and it hasn't been detected by cloud or signatures, avast would be bypassed
Perhaps, hardened mode would be able to stop it but many people don't turn on HM
Some people still forget that there's no such thing as a perfect AV; as much as we would love that tom happen. :)
yes I know this but there can be improvements. Avast cannot stop improving their products here. IDP falls behind at least 3 other competitors' behavioral blockers
according to this post, I can see that avast should improve their IDP blocking method and it should be faster. It should not allow ransomwares to encrypt the files before there is a notification
-
@ Evjls
I can't find anything posted here that want's Avast to stop improving their product. :)
-
Of course,but we want to improve the protection.
Avast (and all the other AV companies) should always improve the protection :)
But nevertheless: if they detect this malware fast, they can also fail with new ransomware.
Nobody is perfect - no software too.
We must protect ourself with backups that are stored outside the computer.
-
Of course,but we want to improve the protection.
Avast (and all the other AV companies) should always improve the protection :)
But nevertheless: if they detect this malware fast, they can also fail with new ransomware.
Nobody is perfect - no software too.
We must protect ourself with backups that are stored outside the computer.
The only way to be truly protected against a disaster is to be prepared for the disaster before it happens (https://youtu.be/hZy5in3WNe4).
That's where the backup comes in. :)
-
There is definately room for improvement when it comes to IDP.There is a upcoming feature that will resolve the delay in detection of IDP according to avast which everyone will like since it protects user data from encryption.
Of course there is always room for improvement and nothing is perfect but we can make it statistically better than others. If everyone keep going by the notion of "Nothing is perfect" Avast would have or will never be the free AV with better detection rates than paid IMO.