Fabian Wosar

Emsisoft Employee
  • Content count

  • Joined

  • Last visited

  • Days Won


Fabian Wosar last won the day on January 31

Fabian Wosar had the most liked content!

Community Reputation

400 Excellent


About Fabian Wosar

  • Rank
    Forum Veteran
  • Birthday

Contact Methods

  • Website URL
  • Skype

Profile Information

  • Gender

System Information

  • Operating System
    Windows 10
  • Firewall or HIPS Software
    Emsisoft Internet Security

Recent Profile Visitors

45185 profile views
  1. We are not affected by cloudbleed. While we do use Cloudflare, only our static pages are routed through it. All shop transactions etc. are not going through Cloudflare. So even if data from our websites was exposed due to leaks, those would have been just page data that is available publically anyway. That being said, none of our data has been found in any of the search caches of the major search engines and our websites don't contain the invalid HTML code that triggers the bug to begin with.
  2. Many different reasons. Most likely: It didn't do anything malicious because your system didn't meet the requirements or it was unable to talk to its C2 server. Not necessarily. We will discuss it internally.
  3. All applications running within the user context are being monitored by default. So as long as a user started it or a process that the user started started it, it is being monitored. When a process isn't being monitored, the process doesn't exist for the BB. No data is being gathered or processed for said process. Therefore, nothing will be detected by the BB.
  4. In general: The smaller the files you use, the better. Otherwise the verification of the keys will take longer the bigger the files are. Best results can be achieved with about 100 - 500kb files.
  5. @gostevie, I just published a new version. Would you mind checking that new version? EDIT: Just tested it with your files. The correct key should be "4:2:Z_h_r_H_t_D_S_t_F_n_". Used the PF_2_File_001.jpg files you provided for the comparison. Results in 4 keys. The third one decrypts all the files you provided.
  6. It doesn't look like Globe to me. The PDF file in particular looks fully encrypted while Globe only encrypts the first 64 KB. Are there any ransom notes or anything else left that could give a clue? If not, it is likely Spora or alternatively PCLock. Could also be something entirely new as well.
  7. It is FenixLocker. They switched to TEA and generate the key in a secure way now. Given that the RSA key they used to encrypt the generated keys are large enough to make brute force impractical, there is unfortunately nothing we can do in your case.
  8. The file you provided is for Spora, not MRCR. Are you sure it's the correct file?
  9. To trigger the scan. I think we can argue about adding a way to quarantine selected processes from that screen. However, it is unlikely that we would do automatic quarantine in that particular case, because it would legitimately add nothing to the user's protection. Because they would have to have the screen open permanently for that, to trigger constant reputation checks of all processes.
  10. It a purely informational screen. There isn't supposed to be functionality in there. The purpose is for the user to look up the status on the running processes. We aren't Emsisoft Anti-CPU Hog. CPU usage is not a malicious behaviour. If we quarantined your video encoder or your browser while watching an 8k video on YouTube you wouldn't be happy either.
  11. We could. But what good would such a function be? It would only be enabled if you have the screen open. That is why it makes no sense. What would make sense is to just check every process in the background permanently, but that is too big of an invasion of privacy for us to do.
  12. Which triggers the reputation check. Reputation is checked in exactly two situations: You go to the BB overview, which queries the running processes or an application shows malicious behaviour, which triggers a cloud lookup as well. Only in the latter case there is an auto-quarantine.
  13. They don't trigger a reputation check. You trigger it manually. If those files had triggered it, they would have been quarantined. Which both doesn't qualify it as malicious behaviour, warranting an automatic cloud check and quarantining them. Yes, simply because they didn't do anything malicious yet. They are no longer functional because their C2 server are taken down. We don't know they are malware yet. To do that, we would have to look up every process indiscriminately via the cloud, which is something we don't want to do.
  14. It's their shitty user application that does it. And no, NVIDIA doesn't sign all their components. That's why you get that autostart alert during every update. Because the component that does that isn't signed for example.
  15. A ton of applications do excessive DNS lookups. Your graphics card driver for example if you are a NVIDIA user. For some reason they think it's a good idea to resolve LOCALHOST several hundred times per second on some systems. So no, the number of DNS requests definitely isn't a good indicator for maliciousness.