Avast Ramsonware blocks legal apps by default

[Richard567]

I just renewed my Avast Internet Security subscription a pair of days ago.

Today I was working on a new image in Photoshop, in fact I had been about 2 hours working on the image when it was time to save it.  But I got a very bad surprise, I couldn't save the file.  There was a Photoshop error message: "Could not save as C:\.." because the file is locked. Use the 'Properties' command in the Windows Explorer to unlock the file."

I searched the Internet for suggestions, but as I hadn't saved the file yet there was no folder to un-protect.  Neither had I made any mistake in my editing.  In the end I had to give up, close the file and restart my computer.  But that didn't help either.  Breaking my head hard for hours, but HEY there comes a POP-UP from Avast, long time past ruining my work.

The STUPID thing, without asking me, with no warning at all, had decided to block Photoshop using the Ransomware Shield.  I can understand there are false positives, but WTH isn't it configured to warn you when it decides to block something. 

Was Avast going to demand a ransom in exchange for unblocking my Photoshop? Or is it a bug?
One thing for sure, it was a B deception.

How should we configure this ransomware shield so it really works properly?  How can one protect folders and still open files and save files? Or do we have to be enabling and disabling it every time we want to open or save a file?
Shouldn't the shield stop things coming in instead of attacking things one has had on one's computer for years.

How can one know for sure that was a false positive or not? 

Sorry about this rant, but I've been without work for months and throwing my efforts down the drain doesn't make me at all happy.

At least, I hope this saves the work of someone else, checking Avast before taking any other actions.

[Asyn]

-> https://www.avast.com/faq.php?article=AVKB50

[ss_nra]

Ransomware Shield is blocking a Firefox extension that can download files.  I tried to unblock the extension using Ransomware Shield settings to "allow the app".  When specifying the app path the Ransomware Shield would only allow me to select EXE files.  The extension is included in a Firefox  XPI file and appears to use JavaScript for the downloading function. 

To use the Firefox extensions I have to turn off the Ransomware Shield.

Is there any way to UNblock/allow the Firefox )Version 80.0.1) extension?

[RejZoR]

avast! by default blocks and ASKS for everything that isn't:
- excluded
- whitelisted

You should really get a popup asking to allow the unknown app. And I find it strange that Photoshop isn't whitelisted, because avast! has one of the best whitelists I know and it's actually really hard to find somewhat popular app that isn't whitelisted.

[ApoC]

Hello,

avast! by default blocks and ASKS for everything that isn't:
- excluded
- whitelisted

This is not completely true statement. AVAST! asks for everything what seems to be suspicious (and it is not on users allow list). If the file is digitally signed and we trust the signer, or if it is well-known unsigned clean app there is no need for dialog to be shown etc.

In case to diagnose the issue with the Firefox extension we need to know which extension are you exactly using so we can test the behavior.
Do you have a screenshot of "detection window"? Is there mentioned Firefox process or something else? Have you tried to add exception directly from the dialog by pressing allow button?

Best Regards,
MD

[Asyn]

And I find it strange that Photoshop isn't whitelisted, because avast! has one of the best whitelists I know and it's actually really hard to find somewhat popular app that isn't whitelisted.

Hi, check the date, the OP is from March 2019.