avast behavior shield is late my all files are encrypted by jaff Ransomware

Evjls · 2017-05-24T16:33:16.000Z

hi, according to the same test on malwaretips. Avast was bypassed while AVG’s IDP blocked it succesfully
This is the 4th time I have seen this happened

cristianojgm · 2017-05-24T16:50:12.000Z

Evjls post:4:

hi, according to the same test on malwaretips. Avast was bypassed while AVG’s IDP blocked it succesfully
This is the 4th time I have seen this happened

Plus the shell behavior of avast is the same idp of AVG.

TrueIndian · 2017-05-24T18:18:12.000Z

Hey guys,thanks for reporting.We have brought this to the attention of someone responsible for behaviour detection internally.Just like you guys I am curious about this possible issue and improving Avast.

We need some details from you guys right now.Were both avg and Avast were tested in a in working internet connection environment? And were both products tested only with IDP?

Screenshots of both products IDP detecting it and sample hash.

Now remember IDP is no silver bullet it just has multi stage detections so the malware did something at the end that got caught so files getting encrypted is not unusual Avast is always trying to make it better and filerep and Evo gen always are on toes detecting new samples as it did here so we should be protected.

Much appreciated.

Evjls · 2017-05-24T22:24:08.000Z

according to what I read from the testers, both were tested with internet connections, under a VPN in VMs:
Avast free: File-Web-Behavior Shields, PUP enabled → blocked | Bonus test: only file shield was disabled → failed to react, no notification, everything was encrypted
AVG internet security: was tested at least 5-6 hours after avast, similar conditions. Default settings, PUP enabled. Blocked almost instantly by IDP and nothing was encrypted

the AVG tester performed a bonus test WITHOUT the internet connection and AVG’s IDP failed to react. As soon as he turned on the internet, IDP blocked it. The 2 testers thought that IDP was cloud-based because of this. Moreover, they noticed, everytime they ran the same samples, they received different numbers from IDP

EDIT: the tester told me this, thank you:

Avast did detect it as Filerep so perhaps it was not analyzed thoroughly as of that time. This could explain why IDP did not get the “correct” answer from cloud or a confirmation of this file being malware.

AVAST: FileRepMalware - IDP did not detect.
AVG: Malware Gen - IDP detected.

BeSecure · 2017-05-25T10:56:54.000Z

Thanks@Evjls.

Alikhan · 2017-05-25T11:11:34.000Z

Just to be clear here:

Avast: Running the sample with internet connection with cloud enabled = IDP never reacted or reacted late?
AVG : Running the sample with internet connection with cloud enabled = IDP caught the sample immediately?

It’s also important that both samples were tested near the same time.

Evjls · 2017-05-25T11:26:59.000Z

Alikhan post:9:

Just to be clear here:

Avast: Running the sample with internet connection with cloud enabled = IDP never reacted or reacted late?
AVG : Running the sample with internet connection with cloud enabled = IDP caught the sample immediately?

It’s also important that both samples were tested near the same time.

Avast never reacted, AVG reacted and caught the ransomware immediately, I assumed because nothing was encrypted

AVG was tested/posted ~5-6 hours after Avast

Alikhan · 2017-05-25T11:34:33.000Z

Evjls post:10:

Alikhan post:9:

Just to be clear here:

Avast: Running the sample with internet connection with cloud enabled = IDP never reacted or reacted late?
AVG : Running the sample with internet connection with cloud enabled = IDP caught the sample immediately?

It’s also important that both samples were tested near the same time.

Avast never reacted, AVG reacted and caught the ransomware immediately, I assumed because nothing was encrypted

AVG was tested/posted ~5-6 hours after Avast

Thanks for that. I’ve just asked one of the devs behind the Behaviour Shield. The most likely reason is that the AVG test was conducted 5-6 later.the cloud.

Alikhan · 2017-05-25T11:51:42.000Z

Regarding the behavior shield being dependent on the cloud, that isn’t entirely true:

The cloud is just another layer, it checks the cloud for getting info, if the file is clean/bad etc.

The difference of these samples is because of the time between the two tests and that it meanwhile got classified.

Also, the behaviour shield is the last line of defence. Most of the time other mechanism should catch the malware which is why just testing the behaviour shield on it’s own isn’t viable.

Evjls · 2017-05-25T11:56:00.000Z

Alikhan post:12:

Regarding the behavior shield being dependent on the cloud, that isn’t entirely true:

The cloud is just another layer, it checks the cloud for getting info, if the file is clean/bad etc.

The difference of these samples is because of the time between the two tests and that it meanwhile got classified

The tester of AVG told me that he also tested AVG without the internet connection after the sample being blocked by IDP in the previous test. IDP didn’t react and everything was encrypted. Then, he turned on the internet and tested it again. IDP worked
Therefore, we agreed that without the internet, IDP won’t work properly

Lord_Ami · 2017-05-25T12:05:05.000Z

Alikhan post:12:

Regarding the behavior shield being dependent on the cloud, that isn’t entirely true:

Sure, it’s not. It has it’s own rules and goodies Overall I think this whole thing is kinda overblown in terms of Avast vs AVG (or such). Let me explain my understanding/point of view:

First: The test itself is far from perfect and does not mimic real world scenario.

Avast in my test picked up the samples as FileRepMalware. This (as far as I know) is coming straight from the cloud or classification system(s). I say that because for example Windscribe VPN is blocking cloud access for some strange reasons. So while I did use Windscribe some time ago, detections from right click scan never showed “FileRep” or similar “cloud” detections.

Now onto AVG’s case: It was tested ~5 hours later. From the right click scan we can see this same file was now categorized as Malware-Gen - meaning it is deemed as malware and signature was created. So with Web/Behavior Shields on, IDP queried the cloud and since the file was 100% marked as malicious, it gave it random name and quarantined it…? Seems like so.

I don’t think Avast devs want to go into details on how their systems work. I don’t see a problem - the file was detected correctly in both cases and VM was protected.
However, IDP itself was not able to detect the file via behavior in both cases (in my opinion). So that’s where Devs need to work on.

Alikhan · 2017-05-25T12:05:30.000Z

Evjls post:13:

Therefore, we agreed that without the internet, IDP won’t work properly

That is not true. Without the cloud, you are just missing another layer. If you had the file shield enabled, it would get caught by file shield.

Ofcourse some IDP detections do come from the cloud (most come behaviorally) but that doesn’t mean Avast would fail to detect the sample since the File Shield would catch it.

bob3160 · 2017-05-25T12:46:11.000Z

The main thing to take away from this is that Avast does detect and protect.

BeSecure · 2017-05-25T13:05:20.000Z

bob3160 post:16:

The main thing to take away from this is that Avast does detect and protect.

Of course,but we want to improve the protection.

TrueIndian · 2017-05-25T18:13:03.000Z

@Alikhan and others I think we should be trimming off some the info on IDP over here since malware writers are watching too

IDP is somewhat helped by cloud not entirely though and vice versa to be short.

There are discussions still going on internally among Avast forum members and the respective employees let’s say we are trying

Evjls · 2017-05-26T07:11:10.000Z

Be Secure post:17:

bob3160 post:16:

The main thing to take away from this is that Avast does detect and protect.

Of course,but we want to improve the protection.

exactly. If there is a new variant of Jaff ransomware and it hasn’t been detected by cloud or signatures, avast would be bypassed
Perhaps, hardened mode would be able to stop it but many people don’t turn on HM

bob3160 · 2017-05-26T15:47:24.000Z

Evjls post:19:

Be Secure post:17:

bob3160 post:16:

The main thing to take away from this is that Avast does detect and protect.

Of course,but we want to improve the protection.

exactly. If there is a new variant of Jaff ransomware and it hasn’t been detected by cloud or signatures, avast would be bypassed
Perhaps, hardened mode would be able to stop it but many people don’t turn on HM

Some people still forget that there’s no such thing as a perfect AV; as much as we would love that tom happen.

Evjls · 2017-05-26T15:52:55.000Z

bob3160 post:20:

Evjls post:19:

Be Secure post:17:

bob3160 post:16:

The main thing to take away from this is that Avast does detect and protect.

Of course,but we want to improve the protection.

exactly. If there is a new variant of Jaff ransomware and it hasn’t been detected by cloud or signatures, avast would be bypassed
Perhaps, hardened mode would be able to stop it but many people don’t turn on HM

Some people still forget that there’s no such thing as a perfect AV; as much as we would love that tom happen.

yes I know this but there can be improvements. Avast cannot stop improving their products here. IDP falls behind at least 3 other competitors’ behavioral blockers
according to this post, I can see that avast should improve their IDP blocking method and it should be faster. It should not allow ransomwares to encrypt the files before there is a notification

bob3160 · 2017-05-26T16:05:13.000Z

@ Evjls
I can’t find anything posted here that want’s Avast to stop improving their product.

stibi · 2017-05-26T16:20:25.000Z

Be Secure post:17:

Of course,but we want to improve the protection.

Avast (and all the other AV companies) should always improve the protection
But nevertheless: if they detect this malware fast, they can also fail with new ransomware.
Nobody is perfect - no software too.
We must protect ourself with backups that are stored outside the computer.

Announcements