Windows 10: Ransomware Protection?

Been visiting a website that discusses ransomware and all of the nasty things that can happen, starting to make me paranoid. Data files are backed up and stored offline, but still...So, I am looking for a quality anti-ransomware software package. As I am new to this concept, I don't even know what the best packages out there are, and I don't see a lot of posts on this topic on the forum. Any suggestions?

I do have Malwarebytes Premium, but not their Beta Anti-Ransomware product. Visiting their website, the last update seems to be 18 March, which is quite awhile ago for a beta product. Is it worth downloading in its current beta state?

Or, maybe Windows 10 is impervious to any ransomware attack! *Think

:)

 

modules on C:\ users\scott\App Data\ local etc failing to load

I think that your files got encrypted by a ransomware called Apocalypse.

See

• Emsisoft releases a Decryptor for the ApocalypseVM Ransomware
• Decryptor for the Apocalypse Ransomware released by Emsisoft
• Apocalypse (.Encrypted) Ransomware Help Topic - *filename*.How_To_Decrypt.txt

 

Ransomware

It's important to know which extension your files have to identify with which ransomware you're infected.

Please read
http://www.bleepingcomputer.com/forums/t/608858/id-ransomware-identify-what-ransomware-encrypted-your-files/

This is the site which might help in identifying your ransomware:
https://id-ransomware.malwarehunterteam.com/

For further help and information, it's best to ask for free expert help here:
http://www.bleepingcomputer.com/forums/f/239/ransomware-tech-support-and-help/

 

Based on many previous threads posted in this forum, false positives appeared to be prevalent.

I would stay away from the beta version at least for now.

If you want to read what had been said about this subject from our forum, just scroll up to the top of this page > top right, in the white search box, type anti-ransomware > Enter

You will have a list of threads to choose from.

 

Hi.
No, W10 is not impervious to a Ransomware attack. There are several options available to you; one you're already implementing: Keeping a backup offline. Some others to consider:

HitmanPro.Alert
CryptoPrevent

I have heard that the Malwarebytes Beta Anti-Ransomware may not yet be ready for prime-time, but have not tried it myself, and the evaluations I am referring to are several weeks old. This feature will eventually be rolled into their paid product.

Malwarebytes Antiexploit is another good little program to have installed, protecting your browsers against zero-day exploits.

As always, the best defense is the person between the keyboard and the screen. However, even the safest surfer can be hit by an exploit kit on a compromised site, (which is recently another method of attack for the ransomware), so it's important to be protected with a layered approach.

Hope that helps. *Smile

 

Appreciate the replies! The comments I've seen on the Malwarebytes beta are a few months old, and then nothing. I agree that I will wait until it is ready for primetime.

Oh, I do have Malwarebytes anti-exploit installed. Seems like a good idea, and it is unobtrusive.

Simrick, I will check out the 2 options you mentioned. Cost is not a driving concern, protection is. Yes, I do try to be careful, but things can happen. I freely admit I have been naively ignorant, but am interested in getting a good protective system in place.

Thx again.

 

Here is an article from Malwarebytes.

https://forums.malwarebytes.org/topi...ti-ransomware/

On my systems I have Malwarebytes Premium and Malwarebytes Anti-Exploit. I also use Macrium Free to image my drives to an external disk. If I get hit with ransomware I can just clean off the drive and do an image restore in 15min.

I would not run Malwarebytes Anti-ransomware Beta on your main system. They still have lots of false positives and can really screw up your system.

Jim *Cool

 

Quite the opposite, virtually all ransomware uses Windows inbuilt powershell to infect systems. *Rolleyes

New Cerber Ransomware Variants Morph Every 15 Seconds
PowerWare Ransomware Uses PowerShell for Fileless Infections

I disable WSH and remove powershell, that prevents ransomware and majority of other malware as well.

A closer look at the Locky ransomware

reg add "HKCU\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f
reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f

Take ownership and delete folders
C:\Program Files (x86)\WindowsPowerShell
C:\Program Files\WindowsPowerShell
C:\Windows\System32\WindowsPowerShell
C:\Windows\SysWOW64\WindowsPowerShell

CryptoWall, Locky, and Cerber Are Todays Top 3 Ransomware Threats

If you need powershell, you can restore it using SFC scan and to enable WSH, you will change value from 0 to 1.

 

@Phone Man is correct.
The application is in beta testing.
The technology will eventually be merged into their core application, MBAM.
Some folks have had no issues with it. Others have had serious problems. This is to be expected for new, beta software.

But, as the product announcement page at the MBARW-BETA forum clearly states (formatting and font from their site*Wink):

As this is the very first beta we do encourage beta users to install the product in non-production environments for testing purposes only.
Cheers,
MM

 

*Shock While my statement about Windows 10 was in jest, I never knew it actually had built in functionality that helped enable ransomware! This is something I will definitely investigate. Thank you!

 

There is always something new to learn.
One of the benefits from participating in forums.

 

Some other software which are actually quite good at preventing ransomware getting on your computer would be Appguard, VooDoo Shield and NoVirus Thanks, in fact they will prevent almost any type of malware from being installed on your computer and are highly rated by security experts. Basically they are either an anti-executable or use a software restriction policy and many people use them in place of an anti-virus. I suggest you do some research and see if they are something you would like to use.

 

I use cruelsister's config of Comodo Firewall except I do allow notifications. Video Review - Comodo Firewall 8 2 0 4508 Setup and Test Part 2 | MalwareTips.com Nice and light and no impact on download speed. It's what she uses and she tests all sorts.

 

I tried Malwarebytes Anti-Ransomware and it uninstalled Word 2016 from my computer. It is (or was) a well known bug. For me it was kinda annoying, so I decided not to use it. I´ll try it again when it leaves its beta state. I haven´t tried other anti-ransomware software though.

 

I'd recommend to turn off macro in MS Office and install Malwarebytes Antiransomware or Bitdefender Crypto-Ransomware Vaccine.
And you must must keep backups of all your important information somewhere other then on the computer you are backing up.