Ransomware Test Program

[AtlBo]

Reading an article in the news feed, noticed this link:

How to find out if your PC is vulnerable to ransomware

Installed this ransomeware test program KnowBe4 Ransim linked on the page, and passed with Comodo HIPS/auto-sandbox, both kicking in and NVT ERP off and then with Comodo HIPS/auto-sandbox off with NVT ERP on. Ran the test last with Comodo HIPS/auto-sandbox both off and with NVT ERP off. AppCheck blocked 5 or the 10 tests before there was a blue screen. Not sure why the bluescreen. Maybe something to do with the test program testing MBR protection? IDK.

Qihoo 360 grabbed the startup file for the program at the end of installation, after the installer wanted to change a system key (I shouldn't have but I allowed this because I was recording with Comodo Programs Manager). I had to restore the startup file to run the program.

I don't know about this, even though I downloaded it from Major Geeks, which has been safe for me. Also, the linking page seems reputable in betanews. I managed to monitor the installation of the test program with Comodo Programs Manager, so I was able to remove it that way. There were over 400 registry keys.

The program analyzes drives to find pics/documents, so maybe that is why there are so many keys. Also tried to install this on a W10 32 bit computer with Emsisoft IS, but the installation fails, even as admin.

Posting this to see if anyone has ever run across it or might have an opinion. I can't recommend the test software myself since I know nothing about it or KnowBe4 software, who wrote the test and because of the 360 alerts. For sure it could be safely run in a VM with a duplication of someone's setup, if you REALLY want to know how you would do against ransomeware.

Screen captures of the results. Tried to get one from AppCheck, but I was a little bit too slow and then the bluescreen:

 

[Ikko]

Hello, blue screen issue while running RanSim was found in 2.0.0.17, and it's resolved since.
AppCheck 2.0.0.20 is currently newest available version. Do you mind try again with the newest version?
Here's the link.
https://www.checkmal.com/download/AppCheckSetup.exe

 

[HarborFront]

v2.0.0.17 has any new ransomware or still the same 10 ransomware? It's no use having the same 10 ransomware for it's just a matter of time those anti-ransomware will pass all the tests

 

[HarborFront]

Hello, blue screen issue while running RanSim was found in 2.0.0.17, and it's resolved since.
AppCheck 2.0.0.20 is currently newest available version. Do you mind try again with the newest version?
Here's the link.
https://www.checkmal.com/download/AppCheckSetup.exe

Hi

Has v2.0.0.20 solved the high resolution screen display issue? Also, does the MBR feature protects drive with GPT (for UEFI bootup) instead of MBR for BIOS bootup?

Still can't find changelog at your website

Thanks

 

[AtlBo]

Hello, blue screen issue while running RanSim was found in 2.0.0.17, and it's resolved since.
AppCheck 2.0.0.20 is currently newest available version. Do you mind try again with the newest version?
Here's the link.

Glad to rerun. Here are the results running only AppCheck:

No blue screen.

 

[_CyberGhosT_]

Thanks Ikko for the updated installer.

 

[Ikko]

Hi

Has v2.0.0.20 solved the high resolution screen display issue? Also, does the MBR feature protects drive with GPT (for UEFI bootup) instead of MBR for BIOS bootup?

Still can't find changelog at your website

Thanks

HarborFront,
High resolution support is not yet resolved, but I can assure you it's in our plan.
IMHO, I haven't seen GPT altering ransomware yet, can you kindly provide a sample if you have one?
And changelog is following URL, but it's all written in Korean. We will write in English as we renew our website for international.

www.checkmal.com/page/support/notice/?detail=read&idx=11

Thank you.

 

[Ikko]

v2.0.0.17 has any new ransomware or still the same 10 ransomware? It's no use having the same 10 ransomware for it's just a matter of time those anti-ransomware will pass all the tests

AppCheck is based on Context Awareness Ransomware Behavior Engine, which doesn't include a signature for detecting ransomware.

 

[_CyberGhosT_]

Here is the Official AppCheck Pro PDF from the site.
It's the english version for anyone interested.

 

[Like a Western!]

Dr.Web got
10/10 VULNERABLE !!!!

i don't like this program DrWeb was great against ransomwares for me :| now here got 0 ?!

LOL

 

[Ink]

Dr.Web got
10/10 VULNERABLE !!!!

i don't like this program DrWeb was great against ransomwares for me :| now here got 0 ?!

LOL

It's their word against Dr. Web, but the real test is how you deal with unknown sources on your PC.

 

[HarborFront]

HarborFront,
High resolution support is not yet resolved, but I can assure you it's in our plan.
IMHO, I haven't seen GPT altering ransomware yet, can you kindly provide a sample if you have one?
And changelog is following URL, but it's all written in Korean. We will write in English as we renew our website for international.

www.checkmal.com/page/support/notice/?detail=read&idx=11

Thank you.

Hi, thanks for the reply

Nope so far not heard of a ransomware attacking the GPT....not yet. However, GPT is newer and is appearing in many PC/laptops now.