- Oct 31, 2014
- 1,712
- Content source
- https://www.youtube.com/watch?v=0skXuCq9FPI
K7 Total Security vs CXK-NMSL ransomware
- Thread starter stefanos
- Start date
It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
Not surprising, K7‘s biggest weakness is Ransomware.
At least DataLocker safes you in 98% percent of cases (I‘ve seen it getting bypassed, too!)
I have a dozen related tickets submitted, they actually fixed the flaws for the samples (maybe families), but it seems very granular and therefore, new variants / other RW will bypass with a chance of 40-50%.
At least DataLocker safes you in 98% percent of cases (I‘ve seen it getting bypassed, too!)
I have a dozen related tickets submitted, they actually fixed the flaws for the samples (maybe families), but it seems very granular and therefore, new variants / other RW will bypass with a chance of 40-50%.
- Oct 31, 2014
- 1,712
The same 360 TS.
- Dec 27, 2016
- 1,480
If I'm not wrong, this hub sample was a similar variant @Der.Reisende tested - that was modified by CS.
It did fail against batch file there too. Though the exe was blocked.
In the video K7 says that it blocked an untrusted program (cmd) from modifying the protected folders but it could trash the rest apparently. Uhm.
It did fail against batch file there too. Though the exe was blocked.
In the video K7 says that it blocked an untrusted program (cmd) from modifying the protected folders but it could trash the rest apparently. Uhm.
It's K7 DataLocker protecting folders (by default Documents and Pictures; with multiple users, it autodetects the folders). It's not a part of the Behaviour Blocking mechanism. It's rather the last line of defense, which can also fail.
I removed dllhost.exe from, and added SoftMaker Office to the trusted list.
EDIT: K7 DataLocker will block write access for everything not in the list, and to protected folders.
It even blocks Snipping Tool from saving pictures to the same name folder, with same error message, if not whitelisted.
Similar threads
