RansomFree by Cybereason

Is it a good or useless protection? What do you think Rasheed?

 

Better to ask (pref PM) a tester like @cruelsister. She doesn't rate the 'honeypots' method.

 

It is a sub-optimal solution.

 

It isn't rated very highly, but you probably already noticed this. But based on everything that I've read, it's not useless, it's able to block certain ransomware variants, but there are better options available. And it's still not clear if RF is able to protect multiple partitions.

 

As a behavior blocker, it blocks a threat based on what malicious software does. RF, like other other anti-ransomware is not 100%. There will always be something that can get through.

 

Cybereason RansomFree v2.3.0.0 Released (28 June 2017)

Code:

https://ransomfree.cybereason.com/download/

Protection against Petya Ransomware has been added:

 

RansomFree v2.3.0.0 should be able to block it

 

Yeah but as a 1-day, after the fact apparently.

The World should be grateful for the vaccine identified by a Cybereason tech, but not necessarily for its RansomFree.

 

Why not? The fact that a Cybereason security researcher came up with a vaccine does not in any way diminish RF in my view. RF is free, is non intrusive, plays well with other security apps in a layered approach. Is it perfect? No. But then what security is fail safe. I, for one, use and appreciate it.

 

hawki agrees he was too harsh on RansomFree for the reasons @aztony stated.

hawki's knee jerked.

Sorry

 

Does it protect all partitions? I've checked out AppCheck, but it generates too many I/O writes, which might be bad for SSD drives. So I may give RF a try.

 

I sent an email to RF support to ascertain that some days ago. I haven't received a reply back so far. As soon as I do I will post their reply.

 

OK thanks. But I remember that in the past they claimed they protected all drives, but according to some members it still failed. I don't expect 100% security from these kind of tools, but if it can only protect one drive that's a big flaw.

 

RF support reiterates that claim.

 

LOL!

 

OK thanks for letting me know, hopefully someone can test it.

 

Also, this latest release has MBR protection, in that it backup the MBR and restores it if compromised.

 

When my computer starts up Cybereason RansomFree shoots a error message telling me I need to restart my computer. Anyone else have this problem?

 

After you uninstall RF, hawki assumes you will, you need to check running processes. On my rig the RF uninstaller left one of the two processes RF installs behind -- not nice.

I reinstalled it and "uninstalled" again with iObit Uninstaller using "powerful uninstall" which checks for registry remnants, app data, and such -- same result = incomplete uninstall.

RF has two "running"components. CyberReasonRansomFree.exe AND CyberReasonRansomFreeServiceHost.exe. The latter got left behind requiring further user action to remove.

 

BTW, I read that after uninstall, it may also leave a disconnected drive behind, is this correct? Based on what I've read, I decided not to install, at least for now.

 

Cybereason RansomFree v2.4.0.0 Released (07 Aug 2017)

Code:

https://ransomfree.cybereason.com/download/

 

Is it fixed in the meantime?

However, RansomFree disabled automatic WLAN connection on some computer, sorry had to uninstall it finally.

 

newbie here..be gentle

i just installed ransom free about 2 weeks ago. last night i was looking to free up space on my C drive and noticed at the top and bottom of the directory list were strange folders with weird files in. when i tried to delete them ransom program said activity has been detected and do i want to stop it. i said yes of course. and windows explorer closed. but the folders reappeared again no matter what i do!

are these the honeypots you guys are talking about ? that the cyberreason program is creating these folders and i shouldnt worry. i ran norton/kaspersky/malwarebytes/tdsskiller all with no detection. the only thing malwarebytes has been getting for the past week is PUP no drives and it does reappear every reboot even after quarantine.

the files in the directories were things like PEM MDB along with word and excel and text files, SQL and JPG as well.

 

@luckyguyinpa

After using the RansomFree Uninstaller you should check your Program Files (don't recall if it's PFs or PFs86x). On my rig, the RF uninstaller does not do a complete job. It leaves a sub-program in a CyberReason Folder that initiates a process that will show up under a list of running processes. IIRC it has a DNS tag so no sense leaving it hanging around. The program does not show up in the Windows installed programs list. It has to be "uninstalled" manually by deleting the Program Folder's contents and then the folder.