AVG Ransomware prevents modifying or moving ANY file

AVG Protection
10

Hello Ian,

We regret for the inconvenience caused.

We could see that you have contacted us before for the same issue. We have escalated the case and solved your issue previously.

Now, you are facing the same issue again in the updated version. So, please provide us the screenshot and the system log files to escalate the case to our senior team. We have sent you an email to collect those files, please provide those information to proceed further.

1

G'day,

So after the AVG debacle with RAR files, you'd think I'd not be foolish enough to stay, particularly as even after reporting it to AVG, when it was fixed, there was no courtesy extended to letting me know it had been addressed.

Well, more the fool me, guess what I did? I decided to take up the 50% discount to renew, and that is exactly what I did…FOR TWO MORE YEARS!

Ok, everything went well for a start, but then, after updating and reinstalling video drivers, I can create a new file by copying an existing one, but I cannot rename or edit or move a file. The error coming up was a Windows one, asking me to try again and saying I needed administrator privileges (which I have). At first I thought I needed another reboot, but after the restart, no change. I still could not do anything. Then on one of the alerts, up popped an AVG alert telling me that AVG had protected me from a threat. Mind you, the file was created earlier in the day, and all I was trying to do was rename it! The alert also said it was the 7+ taskbar tweaker that caused it, even though all I was doing was renaming it in Windows Explorer. I added the 7+ Taskbar tweaker app to the allowed apps list and tried again, but no luck.

I then thought I'd disable Ransomware, and no problem, I could rename, copy, edit, move, and anything else, even delete it.

So, the problem is not with Windows as the alert tries to indicate, but with AVG and its Ransomware function.

I spent the best part of half an hour in a chat session with AVG. I was asked to allow remote access, however I have information that is subject to a NDA and allowing remote access is specifically prohibited under the NDA. I generally do not like allowing remote access because where I have been able to do it in the past, I have ended up with an unusable system anyway because the app was made to work, never mind all the other software then not working.

So, now I have been asked to send screen shots of me renaming a file with and without the Ransomware module. I fail to see how a screenshot of a file that has been renamed successfully can be obtained, and I can bet that because the alert is a Windows Explorer generated alert that it gets blamed as a Windows issue, even though disabling Ransomeware in AVG resolves the issue.

So, has anyone else come across this, and is there a relatively simple solution other than wearing the loss of a 2 year licence and going with another IS package?

Thanks.

2

The only other option is a file sharing host, but will AVG the accept that!

8

This isn't the usual behavior of Ransomware shield, Ian. 
Would you be so kind to share us the screenshots (https://support.avg.com/SupportArticleView?urlname=How-to-create-a-screenshot) of the protected files/folders listed in Ransomware shield & the windows message that you recieve for better clarity?

4

I have no apps in the blocked list. I was asked to clear out the protected folder list, but AVG re-populates it.

7

I have uploaded it.

This is a lot different because previously it was just files with a .RAR extension that was blocked. With this issue it is ANY file whatsoever, and while the popup alert is Windows generated, it is as a result of AVG blocking the action.

You can create a new file, but then you cannot alter it. So, you can Ctrl C a file and Ctrl V it to create a filename - copy file, however you cannot rename any files, including the one just copied, you cannot move it, and you cannot delete it. You can copy it to another drive or folder, but not move, rename or delete it.

3

Ian, we appreciate your efforts.

We have received the system logs from you.

We have escalated the case to our senior team. They will examine the issue and contact you through email as soon as possible.

Your patience is appreciated.

5

I have just sent it as 2 parts, however, it may still fail because the server limit is not stated as before or after MIME encoding. Just received the bounce because even after setting the split sixe to be 20 MB, this was still too much because of the 8 bit to 7 bit encoding where the file size can grow by around 30%. So, the size limit of 26214000 is AFTER MIME encoding meaning the limitation is actually closer to 19.23 MB BEFORE MIME encoding.

So, I have had to set the split below this and this means 3 parts to be sure, but the archive name has to be the same and now there will be the confusion of the main part being part of a 2 part split archive and of a 3 part archive.

I'd have thought that a limit size of the capability of the logs (seeing as I could not see a way of flushing logs) would have been more appropriate.

So, yet another try and hope this gets through.

6

So far the 34 MB attachment has not bounced.

9

But I sent that previously.

I will send it again.