Thanks, I already suspected this was possible, but I've read so many articles that I didn't know what to think anymore LOL. But it seems like you don't even need DoublePulsar, or perhaps I'm completely misunderstanding. But either way, it's clear that this malicious thread inside lsass.exe is apparently capable of running the ransomware payload completely in-memory so without ever dropping it to disk. No wonder that a lot of advanced tools will fail to protect, but it's clear they need to step up their game. Would be cool if RO could tackle it though.
Cool Have fun also seeing which of those set a higher order on jumping up "first" to intercept via alert and such. I'm still pleasantly amazed how quickly Ransom0ff jumped up at a couple of safe apps that I know to be 100% innocent but after the Virlock execution, penetrated and recoded them to call out like it did. Very clever try but the Ransom0ff ALERT prompt clearly made that extinction. Extraordinary! So my thanks boredog for making mention of that baddie
Just wanted to say Thanks for RansomOff and all the devs and all their hard work ! Running VS (Pro),Malwarebytes 3.1.2 (lifetime premium),WinDefender and current beta RansomOff-no problems or conflics.Job well done folks!!
Installed this app yesterday to try it out. Upon completion of installation it asked to add all installed security programs to its exempt files. But after reboot one or more Avast shields failed to activate, MBAE service failed to load, System Explore took forever to load. I rebooted again, with the same result, along with another issue of not having network access. After removing the app system returned to normal.
Thanks for the report. Did you reciprocate with the multiple AV's on your system to exempt RansomOff? It is a two way street when dealing with security software. We've tested with Avast in the past and had issues with it. Haven't tested with more recent RO versions but will test out again to see if it's still causing issues.
I don't run Avast, but FWIW I have no issue with RO and System Explorer, or (only) Exploit Protection ticked as part of MB3 (as opposed to MBAE standalone), which runs a single Malwarebytes service.
I'm having a problem running MS Office 365 apps when RO is installed. I get a pop-up from Office saying the program was unable to start. No pop-up from RO. I uninstalled RO and Office worked fine. Reinstalled RO and got same error. I'm running latest beta of RO 5.2017.156.2734 on Windows 10 Home 64 bit. Anyone else seeing this? Edit: Forgot to say Office 365 is the click to run version.
FWIW I get something somewhat similar depending on exactly what desktop program I happen to be using at the time. I do a lot of desktop portables and some of those don't/won't open up (undoubtedly on-top window setting by default) (and also connected with AppData/Temp (as usual) so my guess (and that's all it is) is that Ransom0ff is protecting against this on some of them. I often do get an alert on windows taking focus (that's an easy switch 0ff) But when a window doesn't come up for me I simply uncheck from Ransom0ff's context menu ransomware protection which also incidentally disables Folder Protection and the program(s) opens normally again.
Greetings/Salutations, Just wondering if you test RO with F-Secure Safe? And give feedback? Kind Regards,
My bad. Duh. Been too busy hammering with ransomware lately to use what's included that let's those certain programs open. REMEDY: Simply Add to Ransom0ff EXEMPTIONS either file/folder. I need a rewire myself sometimes.
We've never had issues with Office in our testing. We've never tested with Click To Run but that shouldn't make a difference. Can you copy the exact error message that Office gives you? That might help us understand what might be going on.
As EASTER mentioned, folder protection relies on the ransomware protection to be enabled. If you turn off ransomware protection, it turns off folder protection. But turning off folder protection does not turn off ransomware protection. Also, portable type apps are more difficult to judge as EASTER also mentioned. They exhibit characteristics of malware and you can't just rely on digital signatures because, while rare, there are malware samples that have a valid signature. So RO is more likely to apply a bit more protection to these programs which could cause compatibility issues. It's something we are constantly working on to make better.
I did try adding Office folder to exemptions, didn't work. It's kind of pointless to have ransom protection if you have to turn it off to be able to run common office apps.
You probably already uninstalled RO but if not, if you could do us a favor it'd help out immensely. First disable all your other security software (based on your signature AppGuard, Comodo and Zemana) but keep RO enabled. Then run Office. If it doesn't work then that's an issue. If it does, then start enabling the other solutions one at a time trying Office between each enable. If something fails after you re-enable another solution then there is a compatibility issue between RO and that solution. Because by themselves, RO and Office get along fine.
Ok, I did further testing. I uninstalled all my other security apps (AppGuard, Comodo and Zemana), Office apps were still not starting. I installed the previous beta of RO (5.2017.144.10111) Office loaded fine even with all the other security apps. So it looks like a change made in the latest beta is causing the problem. Hope this helps.
Moose World said: ↑ Greetings/Salutations, Just wondering if you test RO with F-Secure Safe? And give feedback? Kind Regards, We never have tested with F-Secure. Are you currently using F-Secure or just curious? Yes! I am using F-Secure Safe! And I remove Zemana AntiMalware!!! Also, I am pretty sure that I remove Eldos Callbackfilter in which was causing major headaches with RO. Anybody else have any suggestions? For removal of Eldos? I use Freefixer to delete 3 entries. I will try to reinstall RO very shorty. After you test F-Secure Safe!!!! Along with Eassos System Restore, if you would be so kind!
@HeiDef Would be curious whether RO can stop this sample (WhyCry RW): Malware Analysis Report: Removed per policy. Online-scanners results: Removed per policy. Screenshot taken from here: https://twitter.com/struppigel/status/874876541058109440 It's a combination of Screenlocker & Ransomware, completely bypassing AVG when I tested it yesterday.
Hey Dreams, The first image is with the top-most window detection turned on. As you can see RO alerts that a window is blocking the screen and gives you options to terminate, unblock or minimize. After turning top-most detection off, the ransomware crashed shortly after showing the message but didn't touch any files yet. This was on a Win10 x64 VM.
This is very nice, only this po-up message is not very clear to me . Will this "Unblock" stop Ransomware window or RansomOff window (same for "Minimize")?
Unblock simply makes the window not top-most anymore which means you'll be able to access the desktop or other programs. One caveat to this is that some ransomware sets the top-most flag in a loop so even if it gets unset it will quickly get reset. The minimize button simply minimizes the window to the taskbar so you can again, access the desktop or other windows. Like the top-most flag, ransomware can also constantly set the maximized flag which would negate the minimization. In cases of ransomware, terminating is obviously the solution. At the point you see the popup, the process is suspended so no encryption is occurring.
