How well does Avast Free block ransomware?

[glnz]

thekochs - thanks very much for the lead to Macrium Reflect Free. 
1) When it runs automatically (scheduled) does it run off the same hard disk you are backing up, or off a CD? 
2) Do you program it to overwrite the previous night's backup?

I'm glad you found NoScript for Firefox - good to return the favor.  NoScript is the start of a much more secure browsing experience than you're used to although it takes some work.  You should also consider (for Firefox) the add-ons known as:

• Better Privacy
• Adblock Plus
• Disconnect
• IE Tab 2+ (when you just need to use an open browser)
• HTTPS-Everywhere
• Perspectives

But we're getting a bit off topic.  I still ask Avast to comment on the big problem - ransomware.

[Eddy]

If you want avast to answer, submit a ticket.
But stop asking for it here, it is getting annoying.
Besides, you are already being told how avast looks at it.

Also read the blogs and do some (re)searching.

[REDACTED]

thekochs - thanks very much for the lead to Macrium Reflect Free. 
1) When it runs automatically (scheduled) does it run off the same hard disk you are backing up, or off a CD? 
2) Do you program it to overwrite the previous night's backup?

I'm glad you found NoScript for Firefox - good to return the favor.  NoScript is the start of a much more secure browsing experience than you're used to although it takes some work.  You should also consider (for Firefox) the add-ons known as:

• Better Privacy
• Adblock Plus
• Disconnect
• IE Tab 2+ (when you just need to use an open browser)
• HTTPS-Everywhere
• Perspectives

Thx....

For Reflect it images from the HDD you are on (whole HDD or individual partitions.....you setup backup job details then schedule) to USB HDD.  As above, I have USB HDD I backup to then disconnect......you can get them for $50 now a days.
Here is Forum: http://support.macrium.com/
Here is their knolwdge base link: http://kb.macrium.com/Knowledgebase.aspx
You can restore files within the Macrium software by mounting one of your images and getting the files or if catastrophy happens restore the entire image to new HDD using recovery CD......or recover to current HDD that perhaps has been crypto locked or O/S hosed and you have prior backup image on USB.

[Eddy]

Macrium > No incremental or differential backups

[glnz]

Eddy - If you're an evangelist, then you know Avast's market needs hard facts.

Avast - how are you actually doing with preventing ransomware?  Please answer.

[essexboy]

The answer is NG and the various shields

But, and here is the crippler the malware changes on a daily basis and no (R) no av guarantees that they will stop them all.  Hence cryptoprevent which locks down the common launch points and even that does not guarantee to stop it

Common sense is the best weapon against this, do not open e-mail attachments that are suspicious or unexpected and keep UAC enabled

[REDACTED]

Macrium > No incremental or differential backups

Sure it does: http://kb.macrium.com/KnowledgebaseArticle50075.aspx
Just not in the FREE......allows scheduled but FULL.
To be honest this is not only fine for me since the imaging is done at night very-very late when "me iz a sleep."......but I also PREFER because I've seen incremental & partial backups on "restores" not work........then you whole backup is toast.
I prefer having multiple FULL backups....of course the amount/number is dependent on size USB HDD you have.

I'm not pushing Macrium.....frankly if OP uses any it is better than the none he has now.
But I've used alot of them and for W7 and down (not 8.1) I think Macrium is the best BY FAR....especially at "free".

[REDACTED]

If you disconnect from the internet there is a 98% chance you won't get infected with any ransomwares. The 2% would be from infected usb's, cd, or any external shares. 

[REDACTED]

  Sutieday - with respect, I've been around for a while.  There are so many people being hit, and they all have some kind of anti-virus.  Or they have kids with PCs on the network and stuff happens despite the AV.

The Truth of the matter is an AV can't realistically prevent a 100% of PC threats! It doesn't matter if it is a Trojan, Ransomware, or spyware! Tons of threats are created every hour all across the globe! You can't honestly assume that Avast can detect/block all of them. Avast will block known threats, but also has protection against the unknown with the help of, 1) Hardened mode 2) Deepscreen 3) The massive Avast! community.

It's not realistic that Avast would focus their efforts on the detection of ransomware when that is one of the many types of threats to the PC user.

Here is some food for thought. Recently I submitted a file to Avast! so they could add signatures for it.

Before: https://www.virustotal.com/en/file/3913229db519d4b82cfe8f93cf4ac34e5f541d9a1a301da59bddff859b0d7ac3/analysis/1422418584/

After: https://www.virustotal.com/en/file/3913229db519d4b82cfe8f93cf4ac34e5f541d9a1a301da59bddff859b0d7ac3/analysis/1422443780/

[REDACTED]

Been an interesting thread to read.....thx.
Avast is not going to comment because while the will see/remove I do not think they "block".
I'm not sure because no Avast Team has answered so the silence makes me believe this to be true.
Most A/Vs can remove but by that time the damage/encryption is done.

While going thru this thread I did see one company that shows on video how they "block" the execution.
http://www.sophos.com/en-us.aspx
I have no idea about the company and really haven't seen how they stack up.
At first glance they seem to be a MUCH higher end Enterprise type security company.

[Eddy]

glnz,

go do some reading and you will find the answer on how avast is doing.
avast has already told it many times.
Here is one of the many links on the avast website that gives the information.
https://www.avast.com/virus-update-history

[Pondus]

since the info already given is not enough, search avast blog for ransome or ransomware   https://blog.avast.com/   

[REDACTED]

Pondus/Eddy, thx ! .........been interested about this too.
However, the blog does really not show/talk about the "blocking" in action....ie, Sandbox, Shield, NG, DeepScreen, etc.
In fact, the comments are very generic and dance around "block" versus "find/detect".
I'd truly like to see a Youtube Video from Avast showing the "blocking" (most/all A/Vs detect and remove but that is too late) ability.
How Avast prevents the infection
1. Avast Antispam and antiphishing protection prevents some vectors distribution.
2. Virus signature block all known ransomwares versions. Remember that Avast automatic streaming updates releases hundreds of daily updates for virus definitions.
3. Community IQ intelligence and sensors of our more than 220 million users that detects malware behavior all over the world. See how it works in this YouTube video.
4. Keeping your software updated is another security measure that prevents the exploit of their vulnerabilities. Learn how Avast Software Updater can help you with this job.

Also, did some research on MBAM Anti-Exploit and interesting how it covers you on the new CrytpoWall.
https://www.youtube.com/watch?v=34rrjkRkj1s
I mention since so many "Avast" people use MBAM as supplement.....me included.
This is type video I mention above I'd like to see from Avast.

Anyway, interesting discussion......

[glnz]

Pondus and Eddy - I agree with thekochs.

Given the huge spread of ransomware, and the totality of its impact on the end user or small business without an IT department, it's time for Avast to provide more nitty-gritty info.

Avast - how much is getting through your shields, and how much is blocked?  How high is the failure rate?  Take the last three months and please give us the figures: how many successful ransomware infections in how many total machines using Avast?

Yeah, I do want to know.  I don't expect a failure rate of zero, but I want to know how much more than zero.  Thanks.

[DavidR]

I'm afraid that the nitty gritty wouldn't be that detailed, assuming avast would be prepared to give it - go into too much detail and you could be effectively showing how to circumvent the detection/blocking.