The behavior shield and the ransomware shield need improvement.

https://www.youtube.com/watch?v=8NuJc_-qqcc

Obviously the one making the video doesn’t realize that the Avast protection is based on multiple shields.
Some of them interact and are a part of the other. Simply turning shields off at random, will get you some unwanted and unexpected results.

Nothing “interacts”. That’s why these are INDIVIDUAL shields which can be enabled or disabled INDIVIDUALLY.

The “interaction” thing is the usual excuse to justify failure…

I agree with you.

You have that right even if it’s not correct. :slight_smile:

Why “exactly” it’s not correct?
Which shields " interact and are a part of the other"???
If they are part of each other, how come you can disable them , one by one, ore even decide to uninstall them???

I understand that you are in love with Avast!, but this shouldn’t affect common sense.

That is the point. Why do you have switches to turn shields off it they depend on each other?
When is Avast going to stick to doing a good job of its Anti-virus, Keyloggers, Malware and Ransomware and leave out all the other gimmicks that do not work. Get the things that should work working and forget about programmes that are out of date that Avast can’t update most of the time anyway. Get the job you are supposed to be doing done and do a good job at it, be the best and drop all the gimmicks.

If you don’t like the added features simply use a custom install.
Which you should actually do any time you install any program.
Avast happens to do an excellent job. One of the reasons it’s my AV of choice since 2003.

From Topic: The behavior shield and the ransomware shield need improvement.
Yes it(BS) need improvement(basically on fast encryption of Ransomwares).No doubt about that and Avast needs to be more active on development of CyberCapture because the option on the settings:Allow me to decide is a flop. :frowning:
Hope avast team is read this post.

Hi bob.
You are partly correct.They call it behavior shield because it is not rely on any other shields(File/Web).

I strongly suggests you read Bob’s first reply here again.

Obviously the one making the video doesn't realize that the Avast protection is based on multiple shields.

And that guy really didn’t test the ransomware shield at all.
First mistake he made was not disabling the build in ransomware protection in Windows.
Second huge mistake is not explaining how the ransomware shield is supposed to work.

Sure I can run a test and say it failed or succeeded.
But no mater what I say, it doesn’t mean anything if the readers doesn’t know what exactly has been tested and how/why.

And what has “Got talent”(?) got to do with the testing ?
Is Simon Cowel ransomware ?

Hmm.You got points.But no matter what avast needs improvements for sure.

Avast BB needs to be more sensitive. My opinion.

Actually the behaviour shield is linked with the File Shield in some aspects. I can’t go into much detail but I’ll give an example. Most of the time zero day malware is already classified in the cloud (old malware is also classified in the cloud). Now here comes the important bit, malware is executed and IDP (behaviour shield) checks the cloud and gets a result that the file is classified as malicious but IDP does this check “asynchronously”. This means that the behaviour shield would not block the malware immediately since the File Shield which does the check “synchronously” would have already removed the threat before IDP got involved. File Shield does this query synchronously, e.g. it will block the malware process creation immediately while the query result gets back from the cloud. This is why sometimes some files get encrypted by ransomware before IDP reacts.

Another example would be CyberCapture being linked to the Web Shield.

I’ll need to see why the Ransomware Shield didn’t react, did the person making the video reboot after enabling the ransomware shield? The default mode for Ransomware Shield is “smart” mode so any trusted applications which are trusted via the cloud will be allowed to make changes such as Word etc. Any unknown programs will require user intervention.

To avast!'s defense, he didn’t actually have the folder he was testing in protected. Of course avast! failed to prevent encryption if it wasn’t even designated to protect that folder.

To the defense of the tester however, the way how avast! protects folders is nothing short of idiotic. It just randomly picks some folders with an excuse of “performance costs”. Protect the whole damn Music, Pictures, Documents and Videos folders. No buts or excuses. It’s absurd to expect regular Joe’s to protect the folders themselves because avast! has a bad mechanism for doing that automatically.

In all short, crippling an AV an run tests on it afterwards is nonsense.

Pretty much what I said in reply #1 but who’s counting. :slight_smile:

Well, see it as acknowledgement/reassurance. :wink:

Not necessarily!

A lot of antiviruses would advertise various “shields”: Web protection, Exploit protection, Malware protection, Ransomware protection, Behavior blocker, Heuristic, Machine learning , etc and all kind of other gimmicks , in order to inspire confidence.

In fact, 99% of detection is still signature based, and when somebody tries to test a specific shield , the answer is " is nonsense"

To illustrate better, see here :

https://support.emsisoft.com/topic/27503-new-anti-ransom-module/

Emsisoft changed the name of their “behavior blocker” (formerly known as Mamutu" to Anti_Ransomware module strictly for commercial reasons

In fact, that module has nothing to do with ransomware.

Well, feel free to dream on…