Reply to thread

Message: <blockquote data-quote="RejZoR" data-source="post: 579078" data-attributes="member: 57233"><p>Well, since this also relies on behavior analysis, it'll fall into my testing regime. I've already installed it on my host system and I already see what they are doing. It's a very primitive, but also very clever method. I'm sure ransomware writers will try to bypass it, but still. They place a honeypot on a root of the drive in a folder with randomly generated name so it can't be bypassed just like that, but it starts with characters that get listed before any folders or files with an alphabet name. When ransomware flies through the file/folder indexes and tries to encrypt files in the honeypot, RansomFree jumps on the file initiating it. It probably does other things in the background, but in a nutshell, this is it. Like I've said, primitive, but effective. Sometimes simple solutions are the best.</p></blockquote><p></p>

Top