How it works internally I wonder ? From my knowledge ransomware is form of a rootkit, which operates on low level by hooking APIs working with files and encrypting/decrypting doing there - meaning from windows everything looks pretty much normal, until hook is removed - only then encryption is visible, right ?
So this 'buster' is something like 'Unhackme' or similar software hooking itself even somewhere lower (as dangerous as it sounds, makes it pretty much rootkit itself!) or it is just 'monitoring' windows file API activities (as useless as it sounds for finding ransomware) ?

dex tarafından yorumlandı  –  Last year  –  Bu yorumu yararlı buldunuz mu? evet | hayır (-3)

Çevir

dex, Not all ransomware are rootkits; most of them run in the User Mode which makes all their malicious and encryption activity visible to the OS and other apps. The current CryptoBuster Beta can only monitor and respond to IO activities made to honeypots or other file types monitored by the File Extensions Monitor. When a malicious IO activity is detected, CryptoBuster will respond with a variety of actions configured by the user. Those actions aim to halt the ransomware encryption activity, thus minimizing the damage.

Please be informed that CryptoBuster is designed to work with other security apps, so it can't offer full protection against ransomware by itself.

We are working on a file system driver for CryptoBuster that will not only allow CryptoBuster to monitor and respond to malicious activities, but it would allow the app to intercept and prevent honeypot modifications and other IO activities at the Kernel level.

dex, Not all ransomware are rootkits; most of them run in the User Mode which makes all their malicious and encryption activity visible to the OS and other apps. The current CryptoBuster Beta can only monitor and respond to IO activities made to honeypots or other file types monitored by the File Extensions Monitor. When a malicious IO activity is detected, CryptoBuster will respond with a variety of actions configured by the user. Those actions aim to halt the ransomware encryption activity, thus minimizing the damage. Please be informed that CryptoBuster is designed to work with other security apps, so it can't offer full protection against ransomware by itself. We are working on a file system driver for CryptoBuster that will not only allow CryptoBuster to monitor and respond to malicious activities, but it would allow the app to intercept and prevent honeypot modifications and other IO activities at the Kernel level.
Save | Cancel

Smart PC Utilities tarafından yorumlandı  –  Last year  –  Bu yorumu yararlı buldunuz mu? evet | hayır (+17)

Çevir

See https://www.softpedia.com/get/Security/Security-Related/CryptoBuster.shtml for a positive review

It creates honeypot files to attract the bad guys. It places these files in folders the bad guys like to visit and checks if they are attacked.

That makes me wonder: if we know where the bad guys look for their targets, it is best to place your really valuable files elsewhere. And give them extensions the bad guys are not interested in.

krypteller tarafından yorumlandı  –  Last year  –  Bu yorumu yararlı buldunuz mu? evet | hayır (+16)

Çevir

System Requirements:

Windows 11/ 10 (32-Bit and 64-bit)

This means I cannot test it on a virtual W7 64 Pro, my first choice.

krypteller tarafından yorumlandı  –  Last year  –  Bu yorumu yararlı buldunuz mu? evet | hayır (+13)

Çevir

Once installed, is there a way to test it to see if it actually works?

Wahtsup tarafından yorumlandı  –  Last year  –  Bu yorumu yararlı buldunuz mu? evet | hayır (+10)

Çevir

Port 139 is utilized by NetBIOS Session service. Enabling NetBIOS services provide access to shared resources like files and printers not only to your network computers but also to anyone across the internet. Therefore it is advisable to block port 139 in the Firewall.

Block It tarafından yorumlandı  –  Last year  –  Bu yorumu yararlı buldunuz mu? evet | hayır (+9)

Çevir