Ransomware / wannacry


AV works usually after main virus spreading because definitions are upgraded in quite significant intervals contrary to purely automatic virus infections. I found most AVs more effective in looking for politically-incorrect programs than real viruses. They're detected as "generic malware" usually.
A few examples:
- My own program in WinAPI to run another program with clock's date changed back for a very short moment (typical behavior of crack, this time I cracked TIP with a full blessing of manufacturer :) ).
- Original driver for keypad (this is quite wtf, but it works in all its versions).
- Package for programming in ladder logic for an old system, obsolete according to manufacturer - I wonder how much money AV companies got to classify it as virus and make people buy a new drivers/software...
- A few EXE patches and updates of my make to modify resources in existing programs.

I think it's better to have some good network firewall and process monitor which asks about what a new process starts to do.
 
I'd go so far to say, the typical victim of those attacks wouldn't have your problems with AVs - especially at a workplace pc. :D
 
Back
Top