App Review Avast Free (Hardened Mode) vs Ransominator

[Tiamati]

And it can be mimicked with the existing Application Control by setting unknown applications to 'Untrusted'

There is anyway to create a rule for that or do i need to set unknown applications as 'Untrusted' individually. I couldn't find any way to create a rule that could set all unknow apps as untrusted by default

 

[The Ordynary]

Avast has security flaws, I don't expect it to stop a ramsonware that even kaspersky couldn't, lol kkk, it's a very weak antivirus.

 

[SeriousHoax]

There is anyway to create a rule for that or do i need to set unknown applications as 'Untrusted' individually. I couldn't find any way to create a rule that could set all unknow apps as untrusted by default

Open "Protection" components of Kaspersky. Click on Application Control. There in this page this option is available.

 

[DSD27]

Avast has security flaws, I don't expect it to stop a ramsonware that even kaspersky couldn't, lol kkk, it's a very weak antivirus.

Except it did.

 

[Tiamati]

Open "Protection" components of Kaspersky. Click on Application Control. There in this page this option is available.

Ty! I found it!

 

[Islam Gamal]

i tested this sample with Comodo internet security latest version with two different settings. the first one: i changed the auto containment to block unknown files and with this settings Comodo blocked it immediately. the second one: i kept the default settings (Run virtually Partially limited) and the sample contained in the sandbox and the text file appeared but the files didn`t encrypted and when i closed the text file, it disappeared from the sand box.

 

[harlan4096]

There is anyway to create a rule for that or do i need to set unknown applications as 'Untrusted' individually. I couldn't find any way to create a rule that could set all unknow apps as untrusted by default

 

[Moonhorse]

Avast has security flaws, I don't expect it to stop a ramsonware that even kaspersky couldn't, lol kkk, it's a very weak antivirus.

Its always been decent, they have large userbase, they have the cashflow for everything with all that bloat/ paid services

Its top product, its far from weak,,,,some people just dont like that they datamine so much , but that doesnt mean their antivirus is lacking against others

 

[Vitali Ortzi]

Did someone submit it or was this automatic?

Kaspersky was also super aggressive in my testing at the cloud having a reaction. I had to recompile my sample with a bit more obfuscation midway through testing because it started getting blocked statically on other VMs after I clicked the button saying to undo.

No other AV I tested did this -- I suspect they required more than one or two hosts detecting a binary.

Not in the endpoint version you can be patient zero with never seen malware on just one endpoint and get a detection super fast .
The speed of the Russians is incredible!
Good to hear the speed of the non endpoint protection is fast as well !

 

[SeriousHoax]

Did someone submit it or was this automatic?

Kaspersky was also super aggressive in my testing at the cloud having a reaction. I had to recompile my sample with a bit more obfuscation midway through testing because it started getting blocked statically on other VMs after I clicked the button saying to undo.

No other AV I tested did this -- I suspect they required more than one or two hosts detecting a binary.

Maybe both automatic and manual submission! I'm not sure because I found it here last night and I didn't submit it: https://opentip.kaspersky.com/C92E226D39B612785F8CE5074DA03DEEC6618E5C9AAEB4046AD153133B027805/
Now you would see in that report that in the extracted files category Kaspersky found one Adware but that wasn't there for some reason when I checked the first time. It appeared there later. You're maybe right about it requiring more than one host to detect a binary. I think most of the initial UDS based detection are hash based. KSN blacklists this suspicious items with hash as a first line of defense to protect other users. The detection here was "UDS:Hoax.Win64.FakeRansom.a" Here "a" surely refers to variants so if the sample is slightly modified then Kaspersky might not detect it at first launch on a new PC but later would create another UDS signature and maybe this time the variants would be different so something like "b" instead of "a". It may continue to be like this till a malware analyst personally analyze and create a proper signature. I've seen similar behavior for Microsoft for some other samples.
Interestingly Bitdefender and ESET has now created signature for this sample: VirusTotal
Even Microsoft but I ran it in sanboxie with Windows Defender installed and WD didn't stop the sample from executing instead waited for me to open Windows Security and then I had to manually chose options but by that time the sample already did its job. This is detected by their cloud as some not so dangerous PUP it seems.
Edit: WD now detects it with a different signature: "Trojan:Win32/Wacatac.C!ml"

 

[Fel Grossi]

i tested this sample with Comodo internet security latest version with two different settings. the first one: i changed the auto containment to block unknown files and with this settings Comodo blocked it immediately. the second one: i kept the default settings (Run virtually Partially limited) and the sample contained in the sandbox and the text file appeared but the files didn`t encrypted and when i closed the text file, it disappeared from the sand box.

Thanks for test Comodo.

So even in the default settings Comodo protected the system. As i suspected

 

[Islam Gamal]

Thanks for test Comodo.

So even in the default settings, Comodo protected the system. As i suspected

yes, Comodo protected the system even in the default settings.

 

[DSD27]

So... After these 4 pages... Do you prefer Avast Free, with its Hardened Mode and Behavior Shield, or Kaspersky Security Cloud Free with its System Watcher?

 

[dark_wielder]

So... After these 4 pages... Do you prefer Avast Free, with its Hardened Mode and Behavior Shield, or Kaspersky Security Cloud Free with its System Watcher?

Kaspersky with system watcher, trusted application and file protection module. This is just my opinion.

 

[bayasdev]

So... After these 4 pages... Do you prefer Avast Free, with its Hardened Mode and Behavior Shield, or Kaspersky Security Cloud Free with its System Watcher?

Neither, ESET IS, no performance impact at the cost of no protection at all

 

[DSD27]

Kaspersky with system watcher, trusted application and file protection module. This is just my opinion.

Neither, ESET IS, no performance impact at the cost of no protection at all

I'm talking about FREE only. @dark_wielder Do y ou have trusted application and file protection module in KSCF?

 

[Mariihh]

Has Avast already created 'don't sell my personal information' mode? LOL

 

[DSD27]

Has Avast already created 'don't sell my personal information' mode? LOL

Do you have state secrets? They all get your info/data, don't be naive… The difference is either you're aware or not, if they tell you about it or not and if someone found out or not. Windows does it, Facebook does it, Google... If you start caring for that you won't be able to get online.

 

[LDogg]

Looks like I maybe using Avast as my next AV after my subscription for F-Secure runs out. Is Avast light on a system at all? Haven't used it in ages. If one could provide an SS regarding the CPU & disk usage that would be great.

~LDogg

 

[bayasdev]

Looks like I maybe using Avast as my next AV after my subscription for F-Secure runs out. Is Avast light on a system at all? Haven't used it in ages. If one could provide an SS regarding the CPU & disk usage that would be great.

~LDogg

I remember Avast Free 2019 when installed with minimal components being really light not as ESET but lighter than anything else, what concerns me is their data oriented business model.