6 ms·

On MacOS, the free "RansomWhere?" tool is a really nice thing to have, it warns if any app is hammering files and stops it until you approve/deny. https://www.

On MacOS, the free "RansomWhere?" tool is a really nice thing to have, it warns if any app is hammering files and stops it until you approve/deny. https://www.objective-see.com/products/ransomwhere.html https://www.objective-see.com/products/ransomwhere.html

vezycash 7y ago
Windows 10 now has in-built randsomware protection with Windows Defender.
- jermaustin1 7y ago
  Does it actually work? I haven't had a virus in decades to my knowledge, and I stopped running virus scanners back in 2005 or so. Windows Defender is on my computer, but I never run a scan. Maybe it does in the background, but I've never seen anything notifying me about a virus or ransomware or malware.
  - organsnyder 7y ago
    Windows Defender does background scanning unless you disable it (and Windows will show a nice warning icon in the tray if you do).
    - basch 7y ago
      and if you disable it it turns itself back on, it even says "i wont stay off for long"
      - xirdstl 7y ago
        You can disable it permanently, but I believe it requires registry editing to do so. I run Win 10 with real-time protection always turned off.
        striking 7y ago
        Not sure about the registry, but it's definitely something you can disable in Group Policy (though Group Policy is only available on Windows 10 editions greater than Home).
        xirdstl 7y ago
        I think you're right and I misremembered how I did it, since it had been so long. Thanks for the correction!
  - AdmiralAsshat 7y ago
    I believe Win10 recently added (or is adding) something equivalent to directory-level permissions, so that you can mark applications unable to touch certain directories (like My Documents) unless they've been whitelisted.
    - xurias 7y ago
      It's their ransomware protection. The last time I tried it months ago, it was really aggressive to the point that it made it uncomfortable to work with my computer. Maybe that's necessary to keep people safe, but I had to disable it because basic things like downloading files and opening them with another program simply didn't work. Maybe it's improved since then?
      - ticmasta 7y ago
        The same thing happened with the introduction of UAC.It may be necessary though it conditions people to blindly allow as their default reaction, which is really counter-productive to safety.
        xurias 7y ago
        It actually doesn't provide a prompt. It silently denies access (I think maybe it shows a notification in the bottom right?) and that's that. You have to navigate to the protection settings window in order to whitelist a program. Which I guess makes sense, since if you don't add friction, people will just blindly allow everything as you say. I had problems like stuff not working despite whitelisting, which is what really annoyed me. I would've left it on otherwise.
  - jmkni 7y ago
    Every now and again I see a '0 viruses found since last scan' message in the notification tray. Maybe check and see if there is anything like that in yours?
  - greggman2 7y ago
    It told me a driver I downloaded for my Razer had a virus. I have no idea if it did or didn't. I do know that Razer's website for driver downloads is http not https ¯\_(ツ)_/¯ http://drivers.razersupport.com//index.php?_m=downloads&_a=view&parentcategoryid=886&pcid=885&nav=0,350,885 http://drivers.razersupport.com//index.php?_m=downloads&_a=v...
  - Supermancho 7y ago
    The short answer is sometimes yes, sometimes no, like with a lot of software. It's not universal protection. For example, there if someone mails you an attachment that you open, there is a program that can find your dropbox and encrypt all your files....including on your local machine (whatever filesystem elements are linked to dropbox) and drop new virus vectors on your dropbox directories. Windows Defender didn't notice when it happened in our office. Of course you just revert your file folders in Dropbox (machines that are also linked to that dropbox that aren't the original vector, which should be quarantined) and lose all the work since the last synchronization, but you aren't dead in the water.
  - rightbyte 7y ago
    I have processing program I wrote that runs though hundred of thousand html-files on a Windows machine monthly and it is really slow unless I turn off defender, so I assume it's checking what my program does somehow.
    - retSava 7y ago
      You can turn off (preferably temporarily) the windows defender real-time protection (that's the setting name). That speeds up such things. That setting will after a while reset to the default (on) by itself. Also note that Windows is pretty slow on such operations, opening and reading of lots of files (eg a build). It may actually be quicker to set up a virtual machine running Linux for such a thing.
    - vezycash 7y ago
      Have you tried whitelisting your program in defender?
      - rightbyte 7y ago
        No, good idea I will try it.
aloknnikhil 7y ago
Second this. The only annoying thing about it is the number of false positives. When I leave a large build running overnight, it randomly triggers the check and halts the entire build.
- retSava 7y ago
  Sounds like a scenario easily foreseen since a build should work on lots of files... Can't you whitelist the binaries involved?
Wowfunhappy 7y ago
I am going to start using this immediately, thank you. I have long wondered why precisely this isn't built into all the major OS's. Edit: Although, reading more, I'm not sure I love how the logic works. For instance, it ignores all Apple apps. I understand the logic behind that, but there should be different thresholds: If any process on my machine, Apple or not, rewrites 10GB or more (to choose a somewhat arbitrary amount), I want to know about it ASAP. Otherwise, what if the ransomware finds a way to leverage Apple processes?
- tmikaeld 7y ago
  There's no need to monitor Apples own processes because MacOS already do that with "System Integrity Protection" which stops any modification of system files. See here: https://support.apple.com/en-us/HT204899 https://support.apple.com/en-us/HT204899
  - Wowfunhappy 7y ago
    I have SIP turned off. More importantly, I don’t necessarily trust it—someone could find a flaw.

vezycash 7y ago

Windows 10 now has in-built randsomware protection with Windows Defender.

jermaustin1 7y ago
Does it actually work? I haven't had a virus in decades to my knowledge, and I stopped running virus scanners back in 2005 or so. Windows Defender is on my computer, but I never run a scan. Maybe it does in the background, but I've never seen anything notifying me about a virus or ransomware or malware.
- organsnyder 7y ago
  Windows Defender does background scanning unless you disable it (and Windows will show a nice warning icon in the tray if you do).
  - basch 7y ago
    and if you disable it it turns itself back on, it even says "i wont stay off for long"
    - xirdstl 7y ago
      You can disable it permanently, but I believe it requires registry editing to do so. I run Win 10 with real-time protection always turned off.
      - striking 7y ago
        Not sure about the registry, but it's definitely something you can disable in Group Policy (though Group Policy is only available on Windows 10 editions greater than Home).
        xirdstl 7y ago
        I think you're right and I misremembered how I did it, since it had been so long. Thanks for the correction!
- AdmiralAsshat 7y ago
  I believe Win10 recently added (or is adding) something equivalent to directory-level permissions, so that you can mark applications unable to touch certain directories (like My Documents) unless they've been whitelisted.
  - xurias 7y ago
    It's their ransomware protection. The last time I tried it months ago, it was really aggressive to the point that it made it uncomfortable to work with my computer. Maybe that's necessary to keep people safe, but I had to disable it because basic things like downloading files and opening them with another program simply didn't work. Maybe it's improved since then?
    - ticmasta 7y ago
      The same thing happened with the introduction of UAC.It may be necessary though it conditions people to blindly allow as their default reaction, which is really counter-productive to safety.
      - xurias 7y ago
        It actually doesn't provide a prompt. It silently denies access (I think maybe it shows a notification in the bottom right?) and that's that. You have to navigate to the protection settings window in order to whitelist a program. Which I guess makes sense, since if you don't add friction, people will just blindly allow everything as you say. I had problems like stuff not working despite whitelisting, which is what really annoyed me. I would've left it on otherwise.
- jmkni 7y ago
  Every now and again I see a '0 viruses found since last scan' message in the notification tray. Maybe check and see if there is anything like that in yours?
- greggman2 7y ago
  It told me a driver I downloaded for my Razer had a virus. I have no idea if it did or didn't. I do know that Razer's website for driver downloads is http not https ¯\_(ツ)_/¯ http://drivers.razersupport.com//index.php?_m=downloads&_a=view&parentcategoryid=886&pcid=885&nav=0,350,885 http://drivers.razersupport.com//index.php?_m=downloads&_a=v...
- Supermancho 7y ago
  The short answer is sometimes yes, sometimes no, like with a lot of software. It's not universal protection. For example, there if someone mails you an attachment that you open, there is a program that can find your dropbox and encrypt all your files....including on your local machine (whatever filesystem elements are linked to dropbox) and drop new virus vectors on your dropbox directories. Windows Defender didn't notice when it happened in our office. Of course you just revert your file folders in Dropbox (machines that are also linked to that dropbox that aren't the original vector, which should be quarantined) and lose all the work since the last synchronization, but you aren't dead in the water.
- rightbyte 7y ago
  I have processing program I wrote that runs though hundred of thousand html-files on a Windows machine monthly and it is really slow unless I turn off defender, so I assume it's checking what my program does somehow.
  - retSava 7y ago
    You can turn off (preferably temporarily) the windows defender real-time protection (that's the setting name). That speeds up such things. That setting will after a while reset to the default (on) by itself. Also note that Windows is pretty slow on such operations, opening and reading of lots of files (eg a build). It may actually be quicker to set up a virtual machine running Linux for such a thing.
  - vezycash 7y ago
    Have you tried whitelisting your program in defender?
    - rightbyte 7y ago
      No, good idea I will try it.

aloknnikhil 7y ago

Second this. The only annoying thing about it is the number of false positives. When I leave a large build running overnight, it randomly triggers the check and halts the entire build.

retSava 7y ago
Sounds like a scenario easily foreseen since a build should work on lots of files... Can't you whitelist the binaries involved?

Wowfunhappy 7y ago

I am going to start using this immediately, thank you. I have long wondered why precisely this isn't built into all the major OS's. Edit: Although, reading more, I'm not sure I love how the logic works. For instance, it ignores all Apple apps. I understand the logic behind that, but there should be different thresholds: If any process on my machine, Apple or not, rewrites 10GB or more (to choose a somewhat arbitrary amount), I want to know about it ASAP. Otherwise, what if the ransomware finds a way to leverage Apple processes?

tmikaeld 7y ago
There's no need to monitor Apples own processes because MacOS already do that with "System Integrity Protection" which stops any modification of system files. See here: https://support.apple.com/en-us/HT204899 https://support.apple.com/en-us/HT204899
- Wowfunhappy 7y ago
  I have SIP turned off. More importantly, I don’t necessarily trust it—someone could find a flaw.