Petya/GoldenEye Ransomware

[karrstar]

Hi

I want to bring to your attention this article on Facebook etc. It does impact on your product. I am a subscriber to your Malwarebytes software and if you follow the instructions here:

http://www.iobit.com/en/tips-how-to-protect-yourself-from-petya/goldeneye-ransomware-101.php  Especially this: want to disable SMBv1? : then it disables malware services?

Thought you might like to know.

K

 

[Aura]

I doubt that disabling SMBv1 will prevent Malwarebytes from working properly. Did you try it?

[karrstar]

No did not want to risk it. But it came up on the command prompt so left alone.

[Aura]

Can you give us a screenshot of where you saw that disabling SMBv1 will disable the Malware Services?

[karrstar]

Yes I have. However, it is Winmgmt that is showing the stopping of the service no SMBV1 oops sorry.

 

K

[Aura]

I cannot read what's written in the command prompt as the screenshot is too small. Can you take a screenshot of the command prompt only? Or copy/paste its output here?

[karrstar]

Sorry having difficulty copying and pasting it. Just will not behave.

 

 

[Aura]

I would leave the WMI service running. From my understanding, WMI is used by NotPetya once it infects a system to retrieve admin credentials and move laterally across the network. But if you don't get infected in the first place (and disabling SMBv1 is enough for that), there's no need to disable WMI.

[karrstar]

Hi

 

Thanks for the response.

I have done as you suggested and disables SMBv1. The main reason I bought it to your attention was that I was aware of a long running dispute between malewarebytes and IObit and thought that they might be trying to undermine you with the WMI approach re disabling your service.

All good at my end though.

 

K

[Aura]

You're right about the dispute between Malwarebytes and IObit, though I doubt they would go that far, so many years after what happened. But someone from the Staff should still see this thread and see what it is about (like, if one of them can explain why Malwarebytes relies on the WMI service for instance).