Author Topic: Ransomware Shield in Avast Free - Limited Function?  (Read 2002 times)

0 Members and 1 Guest are viewing this topic.

Offline DougCuk

  • Jr. Member
  • **
  • Posts: 50
Ransomware Shield in Avast Free - Limited Function?
« on: July 18, 2020, 12:51:22 PM »
The update to Avast Free v20.5 added the Ransomware Shield as an installed module.
The release notes state this is now a fully functional module even in the Free version of Avast.

However with "Smart Mode" protection selected I can not trigger any protection response. I tested using a 20 year old Hex Editor with no digital signature and from a random author (not a named company) and was able to freely change file contents without triggering a response.

Can anyone confirm that "Smart Mode" is actually functional?
Have you found an App that this Shield will block?
Exactly what types of program does this Shield consider suspect?

If you select "Strict Mode" then the Shield becomes active and queries any attempt to change files in the protected folders. However you would need to whitelist all your Apps (and Windows Explorer) to avoid being queried on every change to your own data files. Fortunately the Block/Allow Apps functionality is fully active - so you can Blacklist and Whitelist as many programs as you need.

« Last Edit: July 19, 2020, 11:58:02 AM by DougCuk »

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76029
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline DougCuk

  • Jr. Member
  • **
  • Posts: 50
Re: Ransomware Shield in Avast Free - Limited Function
« Reply #2 on: July 18, 2020, 02:59:36 PM »
Asyn you posted in the other thread that you had to whitelist the command line program 7zG.exe from the 7-zip program as it was being blocked by the Ransomware Shield (in Smart Mode I assume). Was that a particularly old version of that file?

I have just tested with v15.2 of that file (7zG.exe) dated Nov 2015 and can't get a reaction when adding files to a 7z archive that is supposedly protected by the Ransomware Shield under Smart Mode. I tested both the x86 and x64 versions and both are ignored by the Shield under Smart Mode - and that version also has no digital signature to validate its origin.

If I activate "Strict Mode" the action is blocked with a red Avast popup warning and if I blacklist 7zG.exe I get a Windows error popup saying Access Denied. So the system is active but doesn't consider my version of 7zG.exe a threat under Smart Mode.

But (as per my original test) if the Shield doesn't react to a 20 year old Hex Editor from a random author with no digital signature then I am not sure what would qualify as a non-trusted app. Still not convinced it is doing anything when set to  Smart Mode.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76029
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Ransomware Shield in Avast Free - Limited Function
« Reply #3 on: July 18, 2020, 03:11:34 PM »
Hi, I'd suggest to continue the discussion in the other thread, else it might be hard to follow. Cheers
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline DougCuk

  • Jr. Member
  • **
  • Posts: 50
Re: Ransomware Shield in Avast Free - Limited Function?
« Reply #4 on: July 19, 2020, 11:57:40 AM »
Asyn the other thread was started to discuss a different Ransomware Shield question - so I think it would make more sense to conclude the discussion about the Free version of this Shield here.

I just triggered a Ransomware Shield (Free version) warning under the default Smart Mode - for a 2013 version of FFMPEG.EXE - so it appears the Smart Mode is working in Avast Free. And it allows you to permanently whitelist the detected program from the warning popup - which is nice.

I have to assume the internal "Trusted Apps" list is either very large (and includes obscure 20 year old Hex Editors) or it is using some other specific criteria to classify an app as "UnTrusted". I will leave the Ransomware Shield running for now and see if it gives me any problems - it will be a nice additional layer of security if it plays well with everything else on the computer.

Offline David_27

  • Full Member
  • ***
  • Posts: 101
Re: Ransomware Shield in Avast Free - Limited Function?
« Reply #5 on: May 27, 2024, 10:04:19 PM »
Was the Ransomware Shield added to the free version of AVG as well, or just Avast?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89349
  • No support PMs thanks
Re: Ransomware Shield in Avast Free - Limited Function?
« Reply #6 on: May 27, 2024, 10:17:37 PM »
Was the Ransomware Shield added to the free version of AVG as well, or just Avast?

Not much point in asking in a topic that is almost 4 years old.

Not to mention this is the Avast Forum not AVG.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline David_27

  • Full Member
  • ***
  • Posts: 101
Re: Ransomware Shield in Avast Free - Limited Function?
« Reply #7 on: May 27, 2024, 11:10:20 PM »
Was the Ransomware Shield added to the free version of AVG as well, or just Avast?

Not much point in asking in a topic that is almost 4 years old.

Not to mention this is the Avast Forum not AVG.
It's the most related topic that I could find, was a too simple of a question to create a new topic just for it.
AVG belongs to Avast, so technically it makes sense to talk about AVG on the Avast forum and my question was just about Avast as much as AVG.
« Last Edit: May 27, 2024, 11:33:04 PM by David_27 »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89349
  • No support PMs thanks
Re: Ransomware Shield in Avast Free - Limited Function?
« Reply #8 on: May 28, 2024, 02:24:46 AM »
The two products are separate.

There is also the Avast One product range and that is covered in a sub-forum of the Avast Forum, but its components and settings are different to the Avast Antivirus for Windows.

So I (an Avast User) don't believe the Components, UI and Settings would be the same.  You are unlikely to find those helping on the forums are for the most part Avast Users with little or no experience of the AVG product range.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security