Sniper Posted November 21, 2016 ID:1073588 Share Posted November 21, 2016 Hi, We tested your product in our test server after being hit by a ransom ware virus a couple of days ago. The product says it is running and protection is on. we ran the downloaded zip from the offending scam email and it proceeded to encrypt the test files we had on the machine and when it was complete windows defender detected it which was too late of course,but the malwarebytes had no idea it was running and gave no alerts and picked up zero in quarantine:( Regards Tony Link to post Share on other sites More sharing options...
biteater Posted November 21, 2016 ID:1073595 Share Posted November 21, 2016 39 minutes ago, Sniper said: Hi, We tested your product in our test server after being hit by a ransom ware virus a couple of days ago. The product says it is running and protection is on. we ran the downloaded zip from the offending scam email and it proceeded to encrypt the test files we had on the machine and when it was complete windows defender detected it which was too late of course,but the malwarebytes had no idea it was running and gave no alerts and picked up zero in quarantine:( Regards Tony Ooops, this is a bad thing. I was trying to find what this MBARansom does, how it works (like in a black box); this is bad news!! Link to post Share on other sites More sharing options...
1PW Posted November 21, 2016 ID:1073603 Share Posted November 21, 2016 Hello Sniper and Does a possibility exist that you are not using Malwarebytes Anti-Ransomware for Business edition on your test server and that instead, you may have been using the Home/Consumer Beta8/development program version? Also, that unique variant of ransomware, your test server encountered, may not be widely known yet. I strongly recommend you browse to the Malwarebytes' File Detections sub-forum and carefully read the 2nd locked/pinned topic there, followed by a submission of the ransomware scam email for expert analysis. Thank you for your interest in Malwarebytes' Anti-Ransomware offerings. Link to post Share on other sites More sharing options...
Sniper Posted November 22, 2016 Author ID:1073896 Share Posted November 22, 2016 no I am not using the business one just the normal home beta I assume. Link to post Share on other sites More sharing options...
Sniper Posted November 22, 2016 Author ID:1073898 Share Posted November 22, 2016 I just tried the link again to the infected zip download and windows defender blocked it before I could download it so it looks like defender has updated its definitions and is now detecting it. The strain of virus is Trojan:JS/Jesigat.A!cl Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now