Reply to thread

Message

<blockquote data-quote="SeriousHoax" data-source="post: 895383" data-attributes="member: 78686">The thing is, WD didn&#039;t detect that ransomware by signatures or any behavioral module, it only blocked modification of protected folders which would&#039;ve happened for any programs that&#039;s not whitelisted, ransomware or not. Too late would mean that WD eventually detected the ransomware later but couldn&#039;t protect some files. So the term &quot;too late for desktop files&quot; is not accurate in this case. If it was a post infection based behavioral detection then the term &quot;too late&quot; would&#039;ve been correct. This is the reason some members had confusion about the outcome of that test. So, I just cleared that up in my initial comment that &quot;desktop&quot; is not part of protected folders anymore so it&#039;s normal for files to be encrypted in desktop or any other folders per se except protected folders. This is correct that Microsoft says that they whitelist trusted programs but in reality they don&#039;t and they should clear this out. Microsoft tries to play safe here because nowadays a lot malwares abuse trusted processes including lolbins to encrypt files and if those files were whitelisted by MS then protected folders would fail. Eg: if you check F-Secure&#039;s result on the hub, you would see quite a few times its protected folders failed to protect files from ransomwares because the abused file was trusted by F-Secure. This is the reason some AVs don&#039;t even include this protected folders function. There&#039;s basically two ways to do this, one is similar to F-Secure, whitelist trusted files and the second one is what Microsoft does, block everything except manually whitelisted. The later is definitely more annoying but far more secured approach.</blockquote>

[QUOTE="SeriousHoax, post: 895383, member: 78686"] The thing is, WD didn't detect that ransomware by signatures or any behavioral module, it only blocked modification of protected folders which would've happened for any programs that's not whitelisted, ransomware or not. Too late would mean that WD eventually detected the ransomware later but couldn't protect some files. So the term "too late for desktop files" is not accurate in this case. If it was a post infection based behavioral detection then the term "too late" would've been correct. This is the reason some members had confusion about the outcome of that test. So, I just cleared that up in my initial comment that "desktop" is not part of protected folders anymore so it's normal for files to be encrypted in desktop or any other folders per se except protected folders. This is correct that Microsoft says that they whitelist trusted programs but in reality they don't and they should clear this out. Microsoft tries to play safe here because nowadays a lot malwares abuse trusted processes including lolbins to encrypt files and if those files were whitelisted by MS then protected folders would fail. Eg: if you check F-Secure's result on the hub, you would see quite a few times its protected folders failed to protect files from ransomwares because the abused file was trusted by F-Secure. This is the reason some AVs don't even include this protected folders function. There's basically two ways to do this, one is similar to F-Secure, whitelist trusted files and the second one is what Microsoft does, block everything except manually whitelisted. The later is definitely more annoying but far more secured approach. [/QUOTE]

Verification