[Wish] Anti-Ransomware Protection feature (idea)

[RejZoR]

Why? What's the purpose of avast! then? And backups are slow, clumsy and they'll refuse to work just when you'll need it the most. And you can't have a backup of the backup for the backup just to be sure. It' stupid. My approach would block basically 100% of malware. I've seen how reliable Hardened mode whitelist is. With that, even if ransomware blocks access to desktop, you could be assured the data is intact. Meaning I can still stick the drive into USB case and pull data in unencrypted form from it. Or just stick it in another PC and do the same. That would be the worst case scenario. Compare that to cost of having an extra drive for backup and spending day after day backing up stupid crap. No thanks. Home users shouldn't be relying on enterprise measures to protect their data. AV's are capable enough to do that, some just don't do that for reasons unknown.

[bob3160]

@ RejZoR,
When you deal with enough novice computer users, you'll find out they can handle a simple backup routine.
They can't correctly handle dealing with blocks if they use hardened mode.

[DavidR]

@ RejZoR,
You only have to browse the viruses and worms forum to see 100% detection isn't there. As most say 100% is a target that is hard to achieve and maintain.

I don't spend day after day "backing up stupid crap" I run a full disk image backup once a week, which doesn't take that long and I'm not sitting waiting on it to complete. There are drive imaging applications that also do incremental backups, my backup software only does full backups, so for me it isn't much of a hassle.

[Be Secure]

Look at the Emsisoft like company it is too small compare to avast but it effectively block RANSOMEWARE!!! I know backups are important but it(Ransomware protection) is long time due.Now days Ransomware is a headache to AV company and avast bit late on that list truely.

[RejZoR]

@ RejZoR,
You only have to browse the viruses and worms forum to see 100% detection isn't there. As most say 100% is a target that is hard to achieve and maintain.

I don't spend day after day "backing up stupid crap" I run a full disk image backup once a week, which doesn't take that long and I'm not sitting waiting on it to complete. There are drive imaging applications that also do incremental backups, my backup software only does full backups, so for me it isn't much of a hassle.

You don't understand the priorities here. Yes, I do believe that by employing this whitelist system avast! could have a 100% protection against ransomware because I've seen how strong Hardened Mode (Aggressive) is. If it only targeted modification of media files that ransomware usually targets, you make it 99% less annoying to the user compared to any Hardened mode we have now. And ransomware, unlike other malware needs 120% attention from the company. No one cares if some regular malware infects the system. If it doesn't steal user data like passwords, it's just an annoyance that needs to be removed at some point. Ransomware doesn't give you that luxury as it's irreparable in most cases due to strong encryption. So, prevention is crucial. And we have none. We can only rely on traditional detection methods which we know aren't 100% like you've said. Whitelist system would be unless ransomware specifically targeted avast! protection method and found a way around it. In which case avast! could simply adapt it to protect for that. But now we have neither of that.

Would be nice if anyone from avast! team dropped by and commented on this. Either if they have any plans to implement this or they already are working on something similar, just so we know where we are at.

[REDACTED]

Ransomware Shade.

https://www.virustotal.com/ru/file/98091b40a51832a39de0ca7c667ef4f3b2652f364286b616ef80897daa4d598b/analysis/
https://www.virustotal.com/ru/file/693e1a6056b6efb4cff6e0d8b380d297646e79231e4df7a9aad8661b714758a8/analysis/
https://www.virustotal.com/ru/file/0e4643de78d2725b8d14657de485e121418d6a5671432ddf4a2fbe5145fd2522/analysis/1476868784/

[bob3160]

@ RejZoR,
You only have to browse the viruses and worms forum to see 100% detection isn't there. As most say 100% is a target that is hard to achieve and maintain.

I don't spend day after day "backing up stupid crap" I run a full disk image backup once a week, which doesn't take that long and I'm not sitting waiting on it to complete. There are drive imaging applications that also do incremental backups, my backup software only does full backups, so for me it isn't much of a hassle.

You don't understand the priorities here. Yes, I do believe that by employing this whitelist system avast! could have a 100% protection against ransomware because I've seen how strong Hardened Mode (Aggressive) is. If it only targeted modification of media files that ransomware usually targets, you make it 99% less annoying to the user compared to any Hardened mode we have now. And ransomware, unlike other malware needs 120% attention from the company. No one cares if some regular malware infects the system. If it doesn't steal user data like passwords, it's just an annoyance that needs to be removed at some point. Ransomware doesn't give you that luxury as it's irreparable in most cases due to strong encryption. So, prevention is crucial. And we have none. We can only rely on traditional detection methods which we know aren't 100% like you've said. Whitelist system would be unless ransomware specifically targeted avast! protection method and found a way around it. In which case avast! could simply adapt it to protect for that. But now we have neither of that.

Would be nice if anyone from avast! team dropped by and commented on this. Either if they have any plans to implement this or they already are working on something similar, just so we know where we are at.

White listing is what's currently used by PC Matic and they are advertising heavily.

[Pondus]

New ransom sample, AVG got it but not avast

First submission 2016-10-16 00:12:11 UTC ( 2 days, 16 hours ago )
https://virustotal.com/en/file/85da17f723f971c4256752ecaf5e94b1838fe8df190ad5920b1ab4de467a7473/analysis/1476809991/

And today avast detect
https://virustotal.com/nb/file/85da17f723f971c4256752ecaf5e94b1838fe8df190ad5920b1ab4de467a7473/analysis/1476882821/

[Milos]

Ransomware Shade.

https://www.virustotal.com/ru/file/98091b40a51832a39de0ca7c667ef4f3b2652f364286b616ef80897daa4d598b/analysis/
https://www.virustotal.com/ru/file/693e1a6056b6efb4cff6e0d8b380d297646e79231e4df7a9aad8661b714758a8/analysis/
https://www.virustotal.com/ru/file/0e4643de78d2725b8d14657de485e121418d6a5671432ddf4a2fbe5145fd2522/analysis/1476868784/

Hello,
they are detected by avast, but not on VT, because avast scanner on VT does not use all detection engines.

Milos

[bob3160]

Ransomware Shade.

https://www.virustotal.com/ru/file/98091b40a51832a39de0ca7c667ef4f3b2652f364286b616ef80897daa4d598b/analysis/
https://www.virustotal.com/ru/file/693e1a6056b6efb4cff6e0d8b380d297646e79231e4df7a9aad8661b714758a8/analysis/
https://www.virustotal.com/ru/file/0e4643de78d2725b8d14657de485e121418d6a5671432ddf4a2fbe5145fd2522/analysis/1476868784/

Hello,
they are detected by avast, but not on VT, because avast scanner on VT does not use all detection engines.



Milos

This needs to be corrected since it makes Avast look bad when it's really doing a good job. 

[Pondus]

Ransomware Shade.

https://www.virustotal.com/ru/file/98091b40a51832a39de0ca7c667ef4f3b2652f364286b616ef80897daa4d598b/analysis/
https://www.virustotal.com/ru/file/693e1a6056b6efb4cff6e0d8b380d297646e79231e4df7a9aad8661b714758a8/analysis/
https://www.virustotal.com/ru/file/0e4643de78d2725b8d14657de485e121418d6a5671432ddf4a2fbe5145fd2522/analysis/1476868784/

Hello,
they are detected by avast, but not on VT, because avast scanner on VT does not use all detection engines.



Milos

This needs to be corrected since it makes Avast look bad when it's really doing a good job. 

VirusTotal FAQ does give some info about the engines / how it work ... but who read that   

[REDACTED]

Ransomware Shade.

https://www.virustotal.com/ru/file/98091b40a51832a39de0ca7c667ef4f3b2652f364286b616ef80897daa4d598b/analysis/
https://www.virustotal.com/ru/file/693e1a6056b6efb4cff6e0d8b380d297646e79231e4df7a9aad8661b714758a8/analysis/
https://www.virustotal.com/ru/file/0e4643de78d2725b8d14657de485e121418d6a5671432ddf4a2fbe5145fd2522/analysis/1476868784/

Hello,
they are detected by avast, but not on VT, because avast scanner on VT does not use all detection engines.

Milos

Hello. On default settings, why not a detected? Why the user must change the settings? This encoder quietly bypasses the antivirus Avast.

[DavidR]

Ransomware Shade.

https://www.virustotal.com/ru/file/98091b40a51832a39de0ca7c667ef4f3b2652f364286b616ef80897daa4d598b/analysis/
https://www.virustotal.com/ru/file/693e1a6056b6efb4cff6e0d8b380d297646e79231e4df7a9aad8661b714758a8/analysis/
https://www.virustotal.com/ru/file/0e4643de78d2725b8d14657de485e121418d6a5671432ddf4a2fbe5145fd2522/analysis/1476868784/

Hello,
they are detected by avast, but not on VT, because avast scanner on VT does not use all detection engines.

Milos

Hello. On default settings, why not a detected? Why the user must change the settings? This encoder quietly bypasses the antivirus Avast.

I believe it isn't so much that the user needs to change anything, more the fact that VT is using the on-demand scanning.

On a users system the file if present and active would be scanned by the on-access scanning functions. These functions aren't available to the on-demand scan used by VT. One such function not available is the could be the on-line checking of the file hash against the avast cloud database, if it has never been seen it would trigger other responses. Also if the user has Hardened mode enabled and set to Aggressive (or if Reputation services is enabled) it isn't checked against the cloud database.

[REDACTED]

Ransomware Shade.

https://www.virustotal.com/ru/file/98091b40a51832a39de0ca7c667ef4f3b2652f364286b616ef80897daa4d598b/analysis/
https://www.virustotal.com/ru/file/693e1a6056b6efb4cff6e0d8b380d297646e79231e4df7a9aad8661b714758a8/analysis/
https://www.virustotal.com/ru/file/0e4643de78d2725b8d14657de485e121418d6a5671432ddf4a2fbe5145fd2522/analysis/1476868784/

Hello,
they are detected by avast, but not on VT, because avast scanner on VT does not use all detection engines.

Milos

Hello. On default settings, why not a detected? Why the user must change the settings? This encoder quietly bypasses the antivirus Avast.

I believe it isn't so much that the user needs to change anything, more the fact that VT is using the on-demand scanning.

On a users system the file if present and active would be scanned by the on-access scanning functions. These functions aren't available to the on-demand scan used by VT. One such function not available is the could be the on-line checking of the file hash against the avast cloud database, if it has never been seen it would trigger other responses. Also if the user has Hardened mode enabled and set to Aggressive (or if Reputation services is enabled) it isn't checked against the cloud database.

Most people use the default setting in the antivirus. A housewife not will to change the settings in the antivirus - it is a dark forest for her.

[DavidR]

@ mike 1

Most people use the default setting in the antivirus. A housewife not will to change the settings in the antivirus - it is a dark forest for her.

As I mentioned, this has nothing to do with the users settings. We are talking about why avast didn't detect it on the VirusTotal scan.

Avast's on-demand scans have functions that aren't replicated by the on-demand scan run by VirusTotal.