Avast detected Android Studio (the latest version) as ransomware.

Here is the message:

studio64.exe is trying to delete or change the file C:\ProgramData\Microsoft\Crypto\RSA\b42cc0c3858a58db2db37658219e6400_9205d3aa-d330-4b9c-977e-9d84ee659886...


By the way it was the first time i ran the software on a fresh windows 10, i ignored the warning and allowed it to change or delete the file.

Should i be worried about that or is that what Android Studio always does?

  • Why would you ignore the warning but trust what someone here tells you? How do you know ransomware gangs don't monitor popular forums looking for questions like these just to tell the people asking them not to worry? Nov 2, 2021 at 1:15
  • Did you try uploading it to VirusTotal as a second opinion?
    – user163495
    Nov 2, 2021 at 3:35
  • @PresidentJamesK.Polk True Nov 2, 2021 at 12:07
  • @MechMK1 Unfortunately i'd reinstalled Android Studio before trying VirusTotal, So the suspicious file was deleted. I just upload studio64.exe and it showed me previously done scan results. virustotal.com/gui/file/… Nov 2, 2021 at 12:12

1 Answer 1


This is a common problem. Anti-virus tools combine two different approaches to detect malware: signatures of known malwares and heuristics to detect suspect activity of still unknown softwares. And to avoid flagging legitimate use of those suspect activities like replacing a key library, they use white lists of legitimate software.

The last problem to solve is to maintain all those lists. I can remember that a signature file from McAfee once detected Excel as a malware (to be precise a DLL required by the main application) and quarantined it. It was of course fixed some hours later in the next signature file, but the support team had to consistently re-install Excel on all the Windows machines...

That being said, it could also be a real malware that managed to insert rogue code in a genuine application. So what to do? Asking here cannot really help (except for general advices like this one) because we cannot investigate on your system. Common practices are:

  1. reinstall the suspect application from a trusted source
  2. in a corporate environment control if other machines with same configuration have the same symptom. If not, the risk of infection of that machine is higher
  3. ask other anti-malware tools to test the suspect files. Virus total does combine a number of tools from various editors and is generally the first step.
  • If quarantined, why would one need to re-install? Just removing from quarantine would be enough, right?
    – kelalaka
    Nov 2, 2021 at 8:12
  • @kelalaka: I cannot remember the details. But even removing from quarantine on more than 100 machines did take some time... Nov 2, 2021 at 9:59
  • Thank you for the details. I removed the file from quarantine and reinstalled Android Studio but it didn't warn me about any unexpected behaviors. There would be a cached config file stored somewhere for the previous behavior (modifying keys) or that's a virus, Who knows! Nov 2, 2021 at 12:39
  • 1
    @kelalaka: some early implementations of quarantine simply move the file to a "quarantine folder", forgetting where the file originally was. Sometimes it takes less human time to re-install than to try to puzzle out exactly which folder that file should be returned to.
    – David Cary
    Nov 2, 2021 at 17:50
  • @DavidCary that is very bad programming, the quarantine action must have an exact undo.
    – kelalaka
    Nov 2, 2021 at 21:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .