Reply to thread

Message

<blockquote data-quote="ForgottenSeer 100397" data-source="post: 1036788">[USER=92939]@Shadowra[/USER] I appreciate your work. Keep it up. Thank you!I believe the malware could encrypt the files in the downloads folder because of a weak containment setting, &quot;do not virtualize access to the specified files or folders.&quot; It is not a Comodo containment bypass.From Comodo help files: <a href="https://help.comodo.com/topic-72-1-766-9169-Containment-Settings.html" target="_blank">Containment Settings, Containment Computer Security, Desktop Software | Internet Security</a>By default, contained applications can access folders, files, and registry keys on your local system, but cannot change them.The &quot;Do not virtualize...&quot; settings let you create exceptions to these policies if required.The rest is a .txt file encrypted on the desktop. If my memory serves well, there is a minor issue with the default config: ransomware could create the ransom note .txt file on the desktop or could encrypt a .txt file on the desktop, something like this. I guess [USER=7463]@cruelsister[/USER] could shed light on this.</blockquote>

[QUOTE="ForgottenSeer 100397, post: 1036788"] [USER=92939]@Shadowra[/USER] I appreciate your work. Keep it up. Thank you! I believe the malware could encrypt the files in the downloads folder because of a weak containment setting, "do not virtualize access to the specified files or folders." It is not a Comodo containment bypass. From Comodo help files: [URL='https://help.comodo.com/topic-72-1-766-9169-Containment-Settings.html']Containment Settings, Containment Computer Security, Desktop Software | Internet Security[/URL] By default, contained applications can access folders, files, and registry keys on your local system, but cannot change them. The "Do not virtualize..." settings let you create exceptions to these policies if required. The rest is a .txt file encrypted on the desktop. If my memory serves well, there is a minor issue with the default config: ransomware could create the ransom note .txt file on the desktop or could encrypt a .txt file on the desktop, something like this. I guess [USER=7463]@cruelsister[/USER] could shed light on this. [/QUOTE]

Verification