MBAE

[TJPhillips]

Hi All,

I have had the unfortunate task of trying to locate and remove Ransomware from a network, the only application that found the Ransomware and Quarantined it was Malwarebytes Ransomware Beta (I was unaware of MBAE)

The ransomare attacked all server shares on the LAN and although i had Kaspersky for Windows Server with its Anti-Cryptor module active and watching the shares, the ransomware infected without KAV doing a thing.

All my scans, KAV Removal Tool, Malwarebytes, Hitman Pro found nothing, only when i loaded the Malwarebytes Ransomware Beta did it get detected.

The source of the Ransomware did seem to come from a workstation, will MBAE protect my server shares from attack over a LAN (What KAV was meant to be doing), basically prevent the Ransomware from infecting my server shares before any damage is caused or does it only keep an eye for Exploits while online?

Any info or suggestions would be appreciated

Regards

TJP

 

 

 

 

 

 

 

[pbust]

Hi TJP.

MBAE is a pre-infection preventative protection mechanism. It will prevent a ransomware infection if it is exploit-driven (drive-by, exploit kit, etc.) or when it is delivered via some social engineering attacks like Word Macros.

Anti-Ransomware Beta is a post-infection detection and blocking mechanism. It monitors the behavior of ransomware on the machine and prevents files from being encrypted.

The best approach, which is the one we recommend, is a layered approach. Install MBAM + MBAE + Anti-Ransomware to have the most effective protection against modern malware.