Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 684272" data-attributes="member: 7463">Funny you should ask as I was screwing around with the bunch earlier this week with a specific focus on modified NotPetya variants. The most impressive result came from an application that I mercilessly mocked in the past, that being RansomFree. Not wanting to accept that either they improved or (God Forbid!) that I could have been wrong I also added on some other nasties and sadly got a very good (perfect for my malware set) result. As I misplaced my Ranstop credential so I couldn&#039;t test that one.So although both Ranstop and AppCheck have excellent backup options I question efficacy of AC due to the NP result; jury is still out on Ranstop until I can test it.That leaves Ransomfree and RansomOff. Once RansomOff comes out of RC status it may (will) have the greater utility due the HIPS, but the HIPS settings have to be optimized some way to prevent FP&#039;s. RansmomFree has improved and I guess can now be considered a viable option.</blockquote>

[QUOTE="cruelsister, post: 684272, member: 7463"] Funny you should ask as I was screwing around with the bunch earlier this week with a specific focus on modified NotPetya variants. The most impressive result came from an application that I mercilessly mocked in the past, that being RansomFree. Not wanting to accept that either they improved or (God Forbid!) that I could have been wrong I also added on some other nasties and sadly got a very good (perfect for my malware set) result. As I misplaced my Ranstop credential so I couldn't test that one. So although both Ranstop and AppCheck have excellent backup options I question efficacy of AC due to the NP result; jury is still out on Ranstop until I can test it. That leaves Ransomfree and RansomOff. Once RansomOff comes out of RC status it may (will) have the greater utility due the HIPS, but the HIPS settings have to be optimized some way to prevent FP's. RansmomFree has improved and I guess can now be considered a viable option. [/QUOTE]

Verification