Author Topic: Ransomware Shield-Answered  (Read 1535 times)

0 Members and 1 Guest are viewing this topic.

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 348
Ransomware Shield-Answered
« on: November 19, 2021, 05:09:28 AM »
Avast Free Antivirus

Avast was blocking WPS Office because the developer's certificate was recently changed, causing Avast to recognize them as a virus but Avast has since been advised by Kingsoft to add them to the 'allowed list' (so that false positives do not occur every time the software is updated).

For my part, I removed WPS Office from the 'Blocked List' and added it to the 'Allowed List.' As a result, the software now opens and functions without any issues.

Question: The developer advised me to find its pathway and 'unprotect' it from the Ransomware Shield. However, when I access that component, it lists 15 folders, none of which are related to WPS.

The specific folders are:

C:\Users\GUEST\Documents
C:\Users\OWNER\Documents
C:\Users\UPDATUSUSER\Documents
C:\USERS/USER\Documents
C:\USERS/ADMINISTRATOR/Pictures
C:\USERS\GUEST\Pictures
C:\USERS\OWNERS\Pictures
C:\Users\UPDATUSUSER\Pictures
C:\USERS/USER\Pictures
C:\USERS/ADMINISTRATORDesktop
C:\USERS\GUEST\Desktop
C:\USERS\OWNERS\Desktop
C:\Users\UPDATUSUSER\Desktop
C:\USERS/USER\Desktop
C:\USERS/Administrator/Desktop

Q1. Since WPS Office was initially automatically placed in the 'blocked list' (before I placed it in the Allow list'), why wasn't it listed in RS as well?

Answer:

Q2. Why are the above non-WPS Office folders being automatically protected when they are empty in Windows Explorer?

Answer:










 
« Last Edit: November 20, 2021, 06:50:16 PM by Spiritual2016 »

Offline kitmubet

  • Jr. Member
  • **
  • Posts: 28
Re: Ransomware Shield-Thoroughly Confused
« Reply #1 on: November 19, 2021, 10:52:44 AM »
Q1. Since WPS Office was initially automatically placed in the 'blocked list' (before I placed it in the Allow list'), why wasn't it listed in RS as well?

Answer: its in the Menu > Setting > general >  Block Allowed App (i dont know why the settings is on 3 different places)

Q2. Why are the above non-WPS Office folders being automatically protected when they are empty in Windows Explorer?

Answer: by default document, download folder, etc.. is already in the protected folder of ransomware

Ransomware Guide/help
https://support.avast.com/en-ph/article/Use-Antivirus-Ransomware-Shield/
Just an Ordinary User

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 348
RE: Ransomware Shield
« Reply #2 on: November 19, 2021, 08:14:06 PM »
Kitmubet:

Do I have the following information correct:

-WPS Office was detected as a threat (even though it was, in actuality, a false positive). As a result, Avast automatically placed it in the Blocked List BUT its related folder did not also automatically get added to Ransomware Shield's protected list.

-After moving it to the 'Allowed List' earlier this week (it functions without issue now), that was the only step that I needed to take.

Answer:

(I figured that it was a two-step process-Move it from the Blocked List to the Allowed List AND 'unprotect' its folder from RS).

*By the way, what do you mean that the Blocked List is in 'three places?' The only location that I see the list is Settings >General >Block and Allow Lists.

Answer:
« Last Edit: November 20, 2021, 03:33:55 AM by Spiritual2016 »

Offline kitmubet

  • Jr. Member
  • **
  • Posts: 28
Re: Ransomware Shield
« Reply #3 on: November 20, 2021, 10:59:27 AM »
Do I have the following information correct:

-WPS Office was detected as a threat (even though it was, in actuality, a false positive). As a result, Avast automatically placed it in the Blocked List BUT its related folder did not also automatically get added to Ransomware Shield's protected list.

Answer:  I dont know if ransomware shield automatically put things on the blocked app list (never happened to me yet), what i do know it will ask you if to allow or block the program and option to add it to the list

-After moving it to the 'Allowed List' earlier this week (it functions without issue now), that was the only step that I needed to take.

Answer:
You only need to add the app to the allowed list, no need to removed the folder in the protected folder as only those listed are being protected
The protected folders are the places that ransomeware shield protect from modification (if the files are not on those folder it wouldn't be protected),
While the Allowed/Block list are the program that are allowed or blocked from modifying files in the protected foldes
not all files types is protected only those with extension in the Menu > Settings > Ransomware file types

(I figured that it was a two-step process-Move it from the Blocked List to the Allowed List AND 'unprotect' its folder from RS).

*By the way, what do you mean that the Blocked List is in 'three places?' The only location that I see the list is Settings >General >Block and Allow Lists.

Answer:
What i meant was the Ransomware shield settings are divided in 3 areas

1. Protection > Ransomware Shield = the protected folder list

2. Menu > Settings > General > Block / Allowed app = the list of program/app allowed or blocked from modifying files under protected folder

3. Menu > Settings > Protection > Ransomware Shield = Smart/Strict mode and what files types/extensions are protected

Edit
Removed the image links and attached them instead
« Last Edit: November 20, 2021, 11:19:11 AM by kitmubet »
Just an Ordinary User

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 348
Re: Ransomware Shield-Answered
« Reply #4 on: November 20, 2021, 06:50:34 PM »
Thx a lot for the info.