Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: cristianojgm on July 21, 2017, 07:34:49 PM

Title: The behavior shield and the ransomware shield need improvement.
Post by: cristianojgm on July 21, 2017, 07:34:49 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: bob3160 on July 21, 2017, 10:13:26 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc (https://www.youtube.com/watch?v=8NuJc_-qqcc)
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 21, 2017, 11:21:11 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc (https://www.youtube.com/watch?v=8NuJc_-qqcc)
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.

Nothing "interacts". That's why these are INDIVIDUAL shields which can be enabled or disabled INDIVIDUALLY.

The "interaction" thing is the usual excuse to justify failure...
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: cristianojgm on July 21, 2017, 11:23:59 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc (https://www.youtube.com/watch?v=8NuJc_-qqcc)
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.

Nothing "interacts". That's why these are INDIVIDUAOL shields which can be enabled or disabled INDIVIDUALLY.

The "interaction" think is the usual excuse to justify failure...

I agree with you.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: bob3160 on July 21, 2017, 11:28:01 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc (https://www.youtube.com/watch?v=8NuJc_-qqcc)
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.

Nothing "interacts". That's why these are INDIVIDUAOL shields which can be enabled or disabled INDIVIDUALLY.

The "interaction" think is the usual excuse to justify failure...

I agree with you.
You have that right even if it's not correct. :)
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 22, 2017, 12:41:30 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc (https://www.youtube.com/watch?v=8NuJc_-qqcc)
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.

Nothing "interacts". That's why these are INDIVIDUAOL shields which can be enabled or disabled INDIVIDUALLY.

The "interaction" think is the usual excuse to justify failure...

I agree with you.
You have that right even if it's not correct. :)


Why "exactly" it's not correct?
Which shields " interact and are a part of the other"???
If they are part of each other, how come you can disable them , one by one, ore even decide to uninstall them????

I understand that you are in love with Avast!, but this shouldn't affect common sense.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 22, 2017, 02:21:38 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc (https://www.youtube.com/watch?v=8NuJc_-qqcc)
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.

Nothing "interacts". That's why these are INDIVIDUAOL shields which can be enabled or disabled INDIVIDUALLY.

The "interaction" think is the usual excuse to justify failure...

I agree with you.
You have that right even if it's not correct. :)


Why "exactly" it's not correct?
Which shields " interact and are a part of the other"???
If they are part of each other, how come you can disable them , one by one, ore even decide to uninstall them????

I understand that you are in love with Avast!, but this shouldn't affect common sense.

That is the point.  Why do you have switches to turn shields off it they depend on each other?
When is Avast going to stick to doing a good job of its Anti-virus, Keyloggers, Malware and Ransomware and leave out all the other gimmicks that do not work.  Get the things that should work working and forget about programmes that are out of date that Avast can't update most of the time anyway.  Get the job you are supposed to be doing done and do a good job at it, be the best and drop all the gimmicks.
 
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: bob3160 on July 22, 2017, 02:30:52 PM
If you don't like the added features simply use a custom install.
Which you should actually do any time you install any program.
Avast happens to do an excellent job. One of the reasons it's my AV of choice since 2003.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Be Secure on July 22, 2017, 02:58:32 PM
From Topic: The behavior shield and the ransomware shield need improvement.
Yes it(BS) need improvement(basically on fast encryption of Ransomwares).No doubt about that and Avast needs to be more active on development of CyberCapture because the option on the settings:Allow me to decide is a flop. :(
Hope avast team is read this post.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Be Secure on July 22, 2017, 03:10:47 PM
https://www.youtube.com/watch?v=8NuJc_-qqcc (https://www.youtube.com/watch?v=8NuJc_-qqcc)
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.
Hi bob.
You are partly correct.They call it behavior shield because it is not rely on any other shields(File/Web).
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Eddy on July 22, 2017, 03:12:46 PM
I strongly suggests you read Bob's first reply here again.
Quote
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.

And that guy really didn't test the ransomware shield at all.
First mistake he made was not disabling the build in ransomware protection in Windows.
Second huge mistake is not explaining how the ransomware shield is supposed to work.

Sure I can run a test and say it failed or succeeded.
But no mater what I say, it doesn't mean anything if the readers doesn't know what exactly has been tested and how/why.

And what has "Got talent"(?) got to do with the testing ?
Is Simon Cowel ransomware ?
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Be Secure on July 22, 2017, 03:21:59 PM
I strongly suggests you read Bob's first reply here again.
Quote
Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.

And that guy really didn't test the ransomware shield at all.
First mistake he made was not disabling the build in ransomware protection in Windows.
Second huge mistake is not explaining how the ransomware shield is supposed to work.

Sure I can run a test and say it failed or succeeded.
But no mater what I say, it doesn't mean anything if the readers doesn't know what exactly has been tested and how/why.

And what has "Got talent"(?) got to do with the testing ?
Is Simon Cowel ransomware ?
Hmm.You got points.But no matter what avast needs improvements for sure.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: cristianojgm on July 22, 2017, 04:11:00 PM
Avast BB needs to be more sensitive. My opinion.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Alikhan on July 22, 2017, 04:27:06 PM
Actually the behaviour shield is linked with the File Shield in some aspects. I can't go into much detail but I'll give an example. Most of the time zero day malware is already classified in the cloud (old malware is also classified in the cloud). Now here comes the important bit, malware is executed and IDP (behaviour shield) checks the cloud and gets a result that the file is classified as malicious but IDP does this check "asynchronously". This means that the behaviour shield would not block the malware immediately since the File Shield which does the check "synchronously" would have already removed the threat before IDP got involved.  File Shield does this query synchronously, e.g. it will block the malware process creation immediately while the query result gets back from the cloud. This is why sometimes some files get encrypted by ransomware before IDP reacts.

Another example would be CyberCapture being linked to the Web Shield.

I'll need to see why the Ransomware Shield didn't react, did the person making the video reboot after enabling the ransomware shield? The default mode for Ransomware Shield is "smart" mode so any trusted applications which are trusted via the cloud will be allowed to make changes such as Word etc. Any unknown programs will require user intervention.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: RejZoR on July 22, 2017, 08:30:21 PM
To avast!'s defense, he didn't actually have the folder he was testing in protected. Of course avast! failed to prevent encryption if it wasn't even designated to protect that folder.

To the defense of the tester however, the way how avast! protects folders is nothing short of idiotic. It just randomly picks some folders with an excuse of "performance costs". Protect the whole damn Music, Pictures, Documents and Videos folders. No buts or excuses. It's absurd to expect regular Joe's to protect the folders themselves because avast! has a bad mechanism for doing that automatically.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Asyn on July 22, 2017, 09:04:15 PM
In all short, crippling an AV an run tests on it afterwards is nonsense.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: bob3160 on July 22, 2017, 10:13:59 PM
In all short, crippling an AV an run tests on it afterwards is nonsense.
Pretty much what I said in reply #1 but who's counting. :)
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Asyn on July 22, 2017, 10:24:23 PM
In all short, crippling an AV and run tests on it afterwards is nonsense.
Pretty much what I said in reply #1 but who's counting. :)
Well, see it as acknowledgement/reassurance. ;)
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 22, 2017, 11:02:58 PM
In all short, crippling an AV an run tests on it afterwards is nonsense.

Not necessarily!

A lot of antiviruses would advertise various "shields": Web protection, Exploit protection, Malware protection, Ransomware protection, Behavior blocker, Heuristic, Machine learning , etc and all kind of other gimmicks , in order to inspire confidence.

In fact, 99% of detection is still signature based, and when somebody tries to test a specific shield , the answer is " is nonsense"

To illustrate better, see here :

https://support.emsisoft.com/topic/27503-new-anti-ransom-module/

Emsisoft changed the name of their "behavior blocker" (formerly known as Mamutu" to Anti_Ransomware module strictly for commercial reasons

In fact, that module has nothing to do with ransomware.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Asyn on July 22, 2017, 11:15:26 PM
In all short, crippling an AV and run tests on it afterwards is nonsense.
Not necessarily!
Well, feel free to dream on...
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 22, 2017, 11:30:31 PM
In all short, crippling an AV and run tests on it afterwards is nonsense.
Not necessarily!
Well, feel free to dream on...

Well... , see here some other opinions (non-evangelists)

http://www.dslreports.com/forum/r31519031-Avast-Antivirus-v17-5-2303-Released


"Avast Antivirus v17.5.2303 Released
Avast Antivirus v17.5.2303
Released 18 July 2017"


"Is this program still bloated? For example having a crazy amount of "shields" along with unnecessary services?"


"I think it does and that is why I just post the updates and don't use it anymore!! good luck bro "
 

 



Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Asyn on July 22, 2017, 11:33:46 PM
In all short, crippling an AV and run tests on it afterwards is nonsense.
Not necessarily!
Well, feel free to dream on...
Well... , see here some other opinions (non-evangelists)
1. Your links are OT here.
2. https://www.avast.com/faq.php?article=AVKB96#artTitle (Add/Remove components)
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: bob3160 on July 23, 2017, 12:15:39 AM
I personally think all this crapp is to simply to continue pushing the nonsense video.
I'm finished with any other responses to this post. Apparently the user isn't willing to listen to reason.


Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 23, 2017, 06:56:40 AM
To avast!'s defense, he didn't actually have the folder he was testing in protected. Of course avast! failed to prevent encryption if it wasn't even designated to protect that folder.
When he realized that he added the folder to ransomware shield but even after that the files got encrypted by another ransomware.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: stibi on July 23, 2017, 11:07:58 AM
To the defense of the tester however, the way how avast! protects folders is nothing short of idiotic. It just randomly picks some folders with an excuse of "performance costs"

What does this mean? Does Avast protect really "randomly some folders"? I cannot believe this...
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: RejZoR on July 23, 2017, 12:29:31 PM
From my system, that was exactly the case. I don't know what kind of mechanism they use, but I know it's a garbage one. I have tons of images in Pictures folder. And avast! just selectively picked few folders from it. Not even all the folders or entire Pictures folder. Granted, I have my data folders on drive D: (relocated), but quite frankly, these destinations are variable based, it doesn't matter where user relocates them, Windows is always aware of the path.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: Asyn on July 23, 2017, 12:31:54 PM
Ransomware Shield - FAQ: https://www.avast.com/faq.php?article=AVKB50
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: chris.. on July 23, 2017, 01:15:08 PM
Quote
Ransomware Shield secures your personal photos, documents, and other files from being modified, deleted, or encrypted by ransomware attacks. This feature scans for and automatically secures folders which may contain personal data and allows you to specify which other folders you want to protect from untrusted applications. Additionally, you can specify which applications are allowed to modify the files in your folders and which applications are always blocked.
So , if we can protect the files we want, why not protect all the files on the hard drive ?
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: stibi on July 23, 2017, 06:10:08 PM
Ransomware Shield - FAQ: https://www.avast.com/faq.php?article=AVKB50

Ok, but that's unbelievable, until one adds all his personal folders manually. And this may slow the system down ...
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: RejZoR on July 24, 2017, 10:19:09 AM
Quote
Ransomware Shield secures your personal photos, documents, and other files from being modified, deleted, or encrypted by ransomware attacks. This feature scans for and automatically secures folders which may contain personal data and allows you to specify which other folders you want to protect from untrusted applications. Additionally, you can specify which applications are allowed to modify the files in your folders and which applications are always blocked.
So , if we can protect the files we want, why not protect all the files on the hard drive ?

They say it's for performance reasons. Though, quite frankly, protecting entire Documents, Pictures, Music and Videos folders shouldn't present too much of a performance hit quite frankly.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: chris.. on July 24, 2017, 10:45:26 AM

They say it's for performance reasons.

However , I just did the test , impossible to add  ;)
(A message appears, but I do not have time to read it full , it disappears quickly , just begins by : "impossible to add....")
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: mchain on July 24, 2017, 07:34:19 PM
If the folder in question is under user\user name\Pictures (i.e. Pictures) what is said here is that not all pictures and their respective folders inside the Picture folder is/are protected?  Must one create a custom file protection setting for each folder?

Isn't the default setting really about the file extension?  See attached below:

Not clear at all what is not protected by default settings here if we go by what has been posted.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 24, 2017, 07:44:21 PM
I'm sure one of the Avast evangelists will promptly reply that you are the problem and Avast works perfectly.  Meanwhile, we should all consider a product that performs without bloatware that is soulessly designed for marketing purposes.

Any suggestions?
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: bob3160 on July 24, 2017, 07:51:45 PM
I'm sure one of the Avast evangelists will promptly reply that you are the problem and Avast works perfectly.  Meanwhile, we should all consider a product that performs without bloatware that is soulessly designed for marketing purposes.

Any suggestions?
What are you doing on this Avast help forum ??? You don't have a question and obviously aren't here to offer any help ???
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: REDACTED on July 25, 2017, 07:40:18 AM
I'm sure one of the Avast evangelists will promptly reply that you are the problem and Avast works perfectly.

Yeah, too much blind fanboy shit here . They just don't want to see or hear anything bad about Avast or they just want to be in the good boy list of Avast.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: stibi on July 25, 2017, 12:12:02 PM
Just OT here.
More interesting for me is information from the Avast people how this function really works.

https://www.avast.com/faq.php?article=AVKB50 misses concrete information what exaxtly is protected. "scans for and automatically secures folders which may contain personal data" is pure nonsense.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: bob3160 on July 25, 2017, 02:15:54 PM
I'm sure one of the Avast evangelists will promptly reply that you are the problem and Avast works perfectly.

Yeah, too much blind fanboy shit here . They just don't want to see or hear anything bad about Avast or they just want to be in the good boy list of Avast.
Total bull. We criticize Avast more than most novices but, we do it to improve the product.
Most of the comments here are from folks who don't know the first thing about the product or,
those with an agenda.
If I don't like a product, and can't get a problem with that product resolved, I move on.
I don't waste my time writing meaningless petty crap on their forum. Especially a support forum
where most of the posts come from people who have a problem and are seeking help.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: PDI on July 25, 2017, 04:41:33 PM
Hi gyus,

I may lost it in this thread but first of all the ransomware shield isn't configured based on directories only but even on extensions.
The guy in the video haven't add the .txt into the protected extensions and therefore his URLs are lost.

Regards,
PDI

Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: mchain on July 25, 2017, 05:15:10 PM
I'm sure one of the Avast evangelists will promptly reply that you are the problem and Avast works perfectly.

Yeah, too much blind fanboy shit here . They just don't want to see or hear anything bad about Avast or they just want to be in the good boy list of Avast.
Total bull. We criticize Avast more than most novices but, we do it to improve the product.
Most of the comments here are from folks who don't know the first thing about the product or,
those with an agenda.
If I don't like a product, and can't get a problem with that product resolved, I move on.
I don't waste my time writing meaningless petty crap on their forum. Especially a support forum
where most of the posts come from people who have a problem and are seeking help.
+1

We always look to help.  Maybe not white hats here?

@  PDI -  valid point - crippling an antivirus to make a point is pointless.
Title: Re: The behavior shield and the ransomware shield need improvement.
Post by: stibi on July 27, 2017, 05:54:51 PM
We criticize Avast more than most novices but, we do it to improve the product.
Exactly, Bob. Such comments are spam. For me at least.