Avast: studio64.exe detected as ransomware

Question

Avast detected Android Studio (the latest version) as ransomware.

Here is the message:

studio64.exe is trying to delete or change the file C:\ProgramData\Microsoft\Crypto\RSA\b42cc0c3858a58db2db37658219e6400_9205d3aa-d330-4b9c-977e-9d84ee659886...

Ransomware

By the way it was the first time i ran the software on a fresh windows 10, i ignored the warning and allowed it to change or delete the file.

Should i be worried about that or is that what Android Studio always does?

Answer 1

This is a common problem. Anti-virus tools combine two different approaches to detect malware: signatures of known malwares and heuristics to detect suspect activity of still unknown softwares. And to avoid flagging legitimate use of those suspect activities like replacing a key library, they use white lists of legitimate software.

The last problem to solve is to maintain all those lists. I can remember that a signature file from McAfee once detected Excel as a malware (to be precise a DLL required by the main application) and quarantined it. It was of course fixed some hours later in the next signature file, but the support team had to consistently re-install Excel on all the Windows machines...

---

That being said, it could also be a real malware that managed to insert rogue code in a genuine application. So what to do? Asking here cannot really help (except for general advices like this one) because we cannot investigate on your system. Common practices are:

1. reinstall the suspect application from a trusted source
2. in a corporate environment control if other machines with same configuration have the same symptom. If not, the risk of infection of that machine is higher
3. ask other anti-malware tools to test the suspect files. Virus total does combine a number of tools from various editors and is generally the first step.