Possible crypto infection detected by cryptoprevent...?

[Win7fuser]

Hi, err, got a window warning popup two days ago, should I be worried or is this just to scare me?

If it is genuine, I can just boot the computer up scan the shit out of it to see for any infections and if all cleans it's good or should I try a more specialize route and let you malware removal experts tell me exactly what I should do? Rather than me scanning, finds nothing and reconnect to the net and off I go again suspecting it was a false positive?

I've attached a photo taken from my phone for obvious reasons.... https://i.imgur.com/tG6eXvM.jpg (apparently I can't upload 6MB jpeg files....

Kind Regards,
Win7fuser

Sent from my MSL950XL

 

[file3456]

Hmm, it may be that you have the start of ransomware on your computer. I would run Herdprotect portable and research everything it finds. Then you can run Autoruns and make sure there's nothing suspicious. But don't disable or delete anything you shouldn't. You can right click entries and scan them at Virus Total. There's another tool called Free Fixer. It's not snake oil crap. What it will do is list all the crap on your computer and give links to each entry for you to research with ratings (if there is any), etc.

Another tool worth looking into is Stream Armor which can help clue you into some malicious stuff, but it may report false positives and items that contain multiple streams may be hard to remove.

I would look into Sandboxie for your browser and/or Shadow Defender and Faronics Anti-executable. Scan all downloads at Virus Total.

Download Portable herdProtect 1.0.3.9 Beta

Stream Armor : Free Tool to Scan & Clean Malicious Alternate Data Streams (ADS) | www.SecurityXploded.com

FreeFixer

Autoruns for Windows - Windows Sysinternals | Microsoft Docs

 

[Win7fuser]

....so it's ok to boot the computer connected to the net or should I disconnect from the net whilst performing these steps?

Yeah wasn't quite sure on myself as I've not been hit with ransomeware before...good thing I had Cryptoprent installed to stop it - it did stop it right?

So a scan from Kaspersky Internet Security 2018 (KIS2018), Malwarebytes AntiMalware, Zemana AntiMalware(would have to connect because the scanner doesn't work offline as supposedly this is a cloud scanner), SUPERAntiSpyware and assuming I have this as I can’t remember and can’t look because the computer is turned as recommended by cryptoprevent tool and haven’t started it since, Spybot and Destroy – in that order is not good enough...?

...or should I take out the drive and do it on an isolated computer that's completely disconnected from the internet or home network so it doesn't spread the infection around....? Would have to buy(unless someone here has got some working spares and willing to donate or lend if you live closeby a msata adapter as well as I have no other computer who uses that connecter type....

I already do scan things(albeit sometimes as I would did miss fan mods of a game or the likes and just rely on the real time scanners I have running to pick up any malicious files or and events) with virustotal and sometimes jotti malware scanner if you have heard of them; just that they don't work on bigger files, like 1GB ones which I may download from the net...

I also do use sandboxie for my browsing needs when I think I'll be visiting a dodgy website...athough there was that one time when sandboxie crashed but the program I used it on continued running anyways and did not also crash or exit when sandboxie crashed...which means is was running out of sand box mode for while...I of course immediately exited the program but it may have been too late. I already reported this to support forums over there but they were adamant that no infection occurred as no file escapes sand box even if the program crashes and affected file still runs..they also asked for proof of a program crashing it but of course I didn't have any and any further attempts to reproduce the crash failed... So I guess I left it at that..this was like a year or two ago...

So fast forward back to today, could this be where this may have originated from because sandboxie failed to safeguard my computer from suspicious infected program file but just so happens it wants to start now then before and that the infection appears to have been hidden as none of that above security scanners I used picked anything up this announcing the computer to be free of viruses and or malware according to them?

Hmm, haven't heard of Shadow Defender and Faronics Anti-executable before, are they any good? What do they do that's different to sandboxie? Or perhaps they specialise in doing something specific that sandboxie doesn't. Do?

Thanks!

PS - speaking of proactive defences, there used to be a really good firewall and program guard called OnlineArmor which I quite like compared to ZoneAlarm's and Commodo's equivalent; however tall emu got bought and the new owners decided to depreciate the line before I even got to purchasing a professional lifetime license for it....��������

It was great - it would bug me every time anything starts(except the ones it has exclude because the program itself trust by default, for example Microsoft signed files, and I'm guessing as long as the hashes(because I'm thinking they whitelist by exe hashes) are the same, it won't change) and would allow me to trust it so that it wouldn't but ne ever again for that specific program even if it was doing something out of the ordinary, of course I would have to really trust the exe file to give onlinearmor the ok - but that would usually happen to legitimately bought games or and programs as I doubt they would infect their own products with malicious intent after receiving money from me...but I guess you never know, there could be a man in the middle said makes code to download does as they get to my computer...or maybe their site for hacked and I didn't know and were starving malware infected files...

PPS - sorry that post took a while to type out on my phone....

 

[file3456]

Try the programs I listed already. I don't know why people ignore what I write. I just unwatch the thread. If you want to know what Faronics Anti-executable is then look it up and read about it at their website. Same with Shadow Defender.

It might be beneficial to pull the plug from the Internet, but if you some how did contract ransomeware, it's more than like doing its thing. Your security software could have also saw a false positive.


If you want to do a non-boot scan there are many live so-called "rescue disks" that can do that. Bitdefender has one and so does kaspersky.


https://support.kaspersky.com/viruses/krd18

How to create a Bitdefender Rescue CD

 

[Win7fuser]

I didn't ignore what you wrote, I just wanted a bit more info before I got started....

If you want to know what Faronics Anti-executable is then look it up and read about it at their website. Same with Shadow Defender.

But I wanted your point of view of it and your personal experiences of it, which may differ from what they advertise......otherwise I would have googled it myself and not even bother posting that on here....

It might be beneficial to pull the plug from the Internet

Well, after going through with the six programs you suggested, some required an active connection to scan and or update, like HerdProtect and Bitdefender Rescue Disc....which had a database dating back to 2017 for a September 2018 download....:huh:

but if you some how did contract ransomeware, it's more than like doing its thing.

Well so far so good, haven't seen anything weird after that....

Your security software could have also saw a false positive.

I spoke to the guys who did CryptoPrevent and they said it was false positive, unless it was an unknown file - which isn't the case here....

So anyways, sorry for not replying back in a few days - had an electrician come in to fix some wiring and stuff bla bla bla:

1) Both Bitdefender and Kaspersky Rescue Disc scans came up clean
2) HerdProtect cloud scans came up clean after two runs as recommended by the program
3) For Autoruns, nothing seems to be out of the ordinary(

Spoiler

except a driver called SmartDashboard.sys which now of course no longer exists(I didn't even get the chance to delete it....hah.... According to DrWeb, it may have been a trojan; for services tab, PSEXESVC appears unknown to me so I have disabled that, since I don't play Fortnite, BattelEye service will be disabled and that's it, the rest should be clean though you're free to critize anything I overlooked...

), though I am able to share screenshots for your viewing pleasures which are attached on this post (apparently can not attach more than 4 files so have compressed and archive it all into a zip file...)
4) Freefixer didn't find anything that requires fixing, I have attached the log
5) StreamAromor found some "possible" malicious files which its log has been attached here for your viewing pleasure(the undeleted.png is the comparison screenshot of the ones that cannot be deleted) - I have since deleted a couple of the yellow and red highlighted ones, the rest wouldn't deleted, it would just say it failed to delete it....

So yeah....is there anything else I should do before announcing that my system is clean and conclude that it was a false positive or should I also scan through with my usual programs to double check?

Or have you unsubbed from this thread topic already....? :shock:

 

[file3456]

Thanks for doing everything I told you to do. Looking at your uploads and at this point it looks to be just that, a false positive. Another tool worth mentioning is TDsskiller. But I doubt it will find anything.


Just to let you know, Autoruns produces a log file too. Go to File and save the ARN file. In Autoruns you can in fact right click and entry and scan it over at Virus Total. But you have to accept the terms first. Once you do that you can scan entries.

I see a lot of Kaspersky crap all over your computer including a toolbar in IE and several modules in Firefox. I'm not a fan of Russian made products, but you might want to have a look at Bitdefender Free. This is a Romanian made anti-virus. I have put it on all the computers I work with and on my family's computers. It's light weight and cloud-based. Cloud-based is good so that any new virus definition out there can be used right away to minimize polymorphic attacks. Free Antivirus Software - Download Bitdefender Antivirus Free Also, Bitdefender Free messes with debugging which is good in terms of anti-virus protection, but not so good with game hacks and what have you. So there you go.

NoScrip was great in its day, but with so many websites using JS, it's become a burden. I stopped using it my self and just depend on Sandboxie. I see you use Sandboxie yourself, so if NoScript is too cumbersome you can probably uninstall it.

My opinion about Faronics anti-executable is that it's pretty decent. I have about 500 MB of malware and I threw several viruses at it including ransomware and Anti-executable alerted me as to whether I should run it or not.

Shadow Defender is probably even better. If there is a virus on your computer, all you have to do is reboot and it's gone. I also tossed a bunch of malware at it and nothing stuck. The only issue with a virtualized OS is that you have to create several folder exclusions. Like the downloads folder, pictures folder, videos folder, music folder, even the recycle bin and your browser app data path. If you need to install a program or update a program, you need to turn off Shadow Defender and reboot not once but twice. I found this to be true with my testing.

To be honest, if you want total virus and security protection while surfing the net, you might want to check out Qubes. Qubes OS: A reasonably secure operating system

Edit-

Oh! I wouldn't worry about those multiple streams you found with Stream Armor. False positives more than likely. And like I said, they are a PITA to remove. I have found a tool to remove such things, but it too failed. Basically, consider Stream Armor as a tripwire that lets you know you've been compromised in which case you pull out your clone and clone your OS back. You do clone the machine every once in a while?

 

[Win7fuser]

Thanks for doing everything I told you to do. Looking at your uploads and at this point it looks to be just that, a false positive. Another tool worth mentioning is TDsskiller. But I doubt it will find anything.

Alright cool thanks!

So the next time I either get a false positive or an actual genuine one, I should run those five in that order and then the usual anti-virus and anti-malware programs I have to clean the rest up, yeah?

Just to let you know, Autoruns produces a log file too. Go to File and save the ARN file. In Autoruns you can in fact right click and entry and scan it over at Virus Total. But you have to accept the terms first. Once you do that you can scan entries.

Oh yeah there is too! I've attached a copy for your viewing pleasures...looks like there must be some false positives, because even Kaspersky stuff are being flagged....

I see a lot of Kaspersky crap all over your computer including a toolbar in IE and several modules in Firefox. I'm not a fan of Russian made products, but you might want to have a look at Bitdefender Free. This is a Romanian made anti-virus. I have put it on all the computers I work with and on my family's computers. It's light weight and cloud-based. Cloud-based is good so that any new virus definition out there can be used right away to minimize polymorphic attacks. Free Antivirus Software - Download Bitdefender Antivirus Free Also, Bitdefender Free messes with debugging which is good in terms of anti-virus protection, but not so good with game hacks and what have you. So there you go.

Is it because you're paranoid about them *possibly* spying on you? I've read a few articles on this when the USA decided to ban Kaspersky products all across their military computers and devices....dunno what they're using now, probably a USA company designed anti-virus and malware program....

Yeah, I once had a look at BitDefender a while back when I was choosing which brand to go with, according to various reviews and tests, Kaspersky top the most and so I naturally went with them.....there was one test I did myself - the eicar one, where I remember reading, if an antivirus program doesn't stop you right before saving the file, you should seek a new one; well it saved but Kaspersky immediately took action and quarrantined the file; that's probably not as proactive or fast enough as denying you the ability to save the file onto the drive though - basically stopping it at the roots......I've been meaning to get on their forums and query about that but kinda forgot about it.....until now.....

But yeah, I used to run a Linux build - Puppy Linux was the OS I believe and used BitDefender on that, because at the time there was no other antivirus programs for Linux, besides ClamAV which I was a bit skeptical on as I've not heard those guys before.....

I stopped running Linux after much frustration of using it as a daily beater and the fact that I couldn't play any (decent) games on it save for native built linux games...

So if I was running a program or game and wanted to debug it to find out causes for problematic issues, BitDefender would give me issues, huh? hmmm...

NoScrip was great in its day, but with so many websites using JS, it's become a burden. I stopped using it my self and just depend on Sandboxie. I see you use Sandboxie yourself, so if NoScript is too cumbersome you can probably uninstall it.

Yeah fair enough I guess - it does take a bit of work to find which scripts you need for the website to be functional and which you don't need that are junk, ads or whatever that's only there to slow your page loads down - I once seen a page where there was an endless amount of scripts and the scripts needed to function were so obscure that I had to temporarily enable each one to see if a certain function worked or not...eventually I gave up because I was overwhelmed by the amount of scripts to enable and disable.... hahaha

But the thing is I run Opera with Sandboxie rather than Firefox, because I use that as my main browser.....which itself isn't sandboxed as I would run opera if I had to visit a dodgy looking url link i guess...also the fact that firefox shares the same tabs I use on the unsandbox browser, so say if I was logged into my gmail account on my main browser, if I were to run a separate instance of firefox under sandboxie, it would pick that up and load that up too, granting possibly the hackers of reading my gmails....unless there's a way to isolate this in which case I could just use firefox alone altogether, sandboxed or not....?

My opinion about Faronics anti-executable is that it's pretty decent. I have about 500 MB of malware and I threw several viruses at it including ransomware and Anti-executable alerted me as to whether I should run it or not.

Nice, so it's like a program guard similar to how Online Armor used to function, minus the firewall aspect of it, and Kaspersky's Trusted Applications Mode - which isn't really all that great because it doesn't seem to remember the ones I explicitly let through and which I explicitly not let through...?

Shadow Defender is probably even better. If there is a virus on your computer, all you have to do is reboot and it's gone. I also tossed a bunch of malware at it and nothing stuck. The only issue with a virtualized OS is that you have to create several folder exclusions. Like the downloads folder, pictures folder, videos folder, music folder, even the recycle bin and your browser app data path. If you need to install a program or update a program, you need to turn off Shadow Defender and reboot not once but twice. I found this to be true with my testing.

Hmm...yeah having exclusions would reduce the protection, because what if a virus or malware got saved or stuck in those excluded zones?

To be honest, if you want total virus and security protection while surfing the net, you might want to check out Qubes. Qubes OS: A reasonably secure operating system

Oh is there another OS besides Linux, OSX and Windows, that's more virus/malware proof than all three combined?!

Edit-

Oh! I wouldn't worry about those multiple streams you found with Stream Armor. False positives more than likely. And like I said, they are a PITA to remove. I have found a tool to remove such things, but it too failed. Basically, consider Stream Armor as a tripwire that lets you know you've been compromised in which case you pull out your clone and clone your OS back. You do clone the machine every once in a while?

erm......no I don't really clone my machine once in a while.....or ever....I just move/copy stuff I wanna keep onto offline archival backup RAID1 system drives...is that enough...? I should probably setup a home server where I host these archival backups (of course keeping the originals offline still) but in read only so that no virus or malware can attach themselves to these accessible files and folders...so that I don't have to keep plugging them in if I wanna grab something out which may lead to possible infection since it'll be a direct connection to the drives themselves...

 

[file3456]

Yeah, I'm not seeing anything that sticks out in Autoruns. The one thing I would say is that you should go into those startup programs and prevent them from launching when you boot your computer. Like Ccleaner, SuperAntiSpyware, etc, etc. If you don't use Java, then uninstall it. That's one less attack vector. If you don't use Flash uninstall it, one less attack vector. In fact, Flash is dying a slow death and by 2020 it will be no more. A lot of websites now, including YouTube all use HTML5 in replace of Flash. So Flash is really not needed at all. Albeit, there may still be some sites that still use it.

A great alternative to bloat Abobe PDF reader is Foxit. Check it out and see what you think.

Alright cool thanks!

So the next time I either get a false positive or an actual genuine one, I should run those five in that order and then the usual anti-virus and anti-malware programs I have to clean the rest up, yeah?

It would help. But if it's ransomware which is polymorphic it can slip by and the damage may be done. That's why it's a good idea to just make a full clone of your computer to an external USB hard drive every so often.

Is it because you're paranoid about them *possibly* spying on you? I've read a few articles on this when the USA decided to ban Kaspersky products all across their military computers and devices....dunno what they're using now, probably a USA company designed anti-virus and malware program....

Mostly, and I think their program is largely bloat. Bitdefender Free is pretty simple and lightweight from my use.

Yeah, I once had a look at BitDefender a while back when I was choosing which brand to go with, according to various reviews and tests, Kaspersky top the most and so I naturally went with them.....there was one test I did myself - the eicar one, where I remember reading, if an antivirus program doesn't stop you right before saving the file, you should seek a new one; well it saved but Kaspersky immediately took action and quarrantined the file; that's probably not as proactive or fast enough as denying you the ability to save the file onto the drive though - basically stopping it at the roots......I've been meaning to get on their forums and query about that but kinda forgot about it.....until now.....

How long ago was that? Because when I ran an eicar test file past Bitdefender Free it quarantined it.

I stopped running Linux after much frustration of using it as a daily beater and the fact that I couldn't play any (decent) games on it save for native built linux games...

Yeah, you're limited to what works in Linux. But it's great in terms of anti-virus protection seen as how many viruses and what have you are made for Windows mostly. If you are just surfing the Internet and doing office oriented applications, then Linux is what you want. Qubes on the other hand is a major security/privacy orientated OS. It's not meant to game on or any of that.

But the thing is I run Opera with Sandboxie rather than Firefox, because I use that as my main browser.....which itself isn't sandboxed as I would run opera if I had to visit a dodgy looking url link i guess...also the fact that firefox shares the same tabs I use on the unsandbox browser, so say if I was logged into my gmail account on my main browser, if I were to run a separate instance of firefox under sandboxie, it would pick that up and load that up too, granting possibly the hackers of reading my gmails....unless there's a way to isolate this in which case I could just use firefox alone altogether, sandboxed or not....?

I don't know if I'd trust Opera. Their VPN withen the browser goes through China and they more than likely see what's going through their servers. A Chinese-based company now owns Opera last I read. Not saying FF is any better though. I've read Mozilla will pass all your DNS queries through their own CloudFlare DNS one day. And I really don't like what Firefox has done to the browser. I use Pale Moon myself, but it too has its flaws. Mostly with the default user agent. So I forge it to make it look like I'm using Firefox so websites that sniff the UA don't act up. It seems a lot of websites sniff the UA and if you're not using Firefox, Chrome or Edge, they give you crap. Total BS. It shouldn't be like that. And banks do this all the time.

Hmm...yeah having exclusions would reduce the protection, because what if a virus or malware got saved or stuck in those excluded zones?

Yep.

Oh is there another OS besides Linux, OSX and Windows, that's more virus/malware proof than all three combined?!
erm......no I don't really clone my machine once in a while.....or ever....I just move/copy stuff I wanna keep onto offline archival backup RAID1 system drives...is that enough...? I should probably setup a home server where I host these archival backups (of course keeping the originals offline still) but in read only so that no virus or malware can attach themselves to these accessible files and folders...so that I don't have to keep plugging them in if I wanna grab something out which may lead to possible infection since it'll be a direct connection to the drives themselves...

Not really. All can be hacked/infected at certain levels. Mac might be better in terms of gaming and relative security, but then again, you're limited to Apple software.

Malware like worms can craw through a network.

 

[Win7fuser]

Yeah, I'm not seeing anything that sticks out in Autoruns. The one thing I would say is that you should go into those startup programs and prevent them from launching when you boot your computer. Like Ccleaner, SuperAntiSpyware, etc, etc. If you don't use Java, then uninstall it. That's one less attack vector. If you don't use Flash uninstall it, one less attack vector. In fact, Flash is dying a slow death and by 2020 it will be no more. A lot of websites now, including YouTube all use HTML5 in replace of Flash. So Flash is really not needed at all. Albeit, there may still be some sites that still use it.

...what so you reckon nothing should run on startup...for performance reasons...?

I was gonna use java for MineCraft, but haven't yet gone about it...so I guess I should uninstall it until I do go about it?

Some of the flash game sites require flash to play their "awesome" games.... But I guess I might uninstall this because I haven't used that since my sister wanted to play fireboy and watergirl.....which was a while ago....

A great alternative to bloat Abobe PDF reader is Foxit. Check it out and see what you think.

Yeah the installer is pretty big, about 300MB or more when extracted...used to be smaller...not sure what they've done to it.....

It would help. But if it's ransomware which is polymorphic it can slip by and the damage may be done. That's why it's a good idea to just make a full clone of your computer to an external USB hard drive every so often.

So what can one do about polymorphic ransomeware or other similar types?

And what type of cloning software do you recommend?

Mostly, and I think their program is largely bloat. Bitdefender Free is pretty simple and lightweight from my use.

Hmmm, yeah fair enough I guess. I liked their 2013 and older UI better, now it just looks...flat....but does the job I guess.... It stopped an incoming malicious connection at one point.

How's Bitdefender's Internet Security variant? Any good or just as bloaty as Kaspersky's?

How long ago was that? Because when I ran an eicar test file past Bitdefender Free it quarantined it.

Oh no this was Kaspersky, and I was like a while ago, maybe a few months ago...never tested the eicar one yet before on a bitdefender though...or if I did, I can't remember...hahaha

Yeah, you're limited to what works in Linux. But it's great in terms of anti-virus protection seen as how many viruses and what have you are made for Windows mostly. If you are just surfing the Internet and doing office oriented applications, then Linux is what you want. Qubes on the other hand is a major security/privacy orientated OS. It's not meant to game on or any of that.

Yeah, so really you need a dedicated device for each specific task, like for one for only web browsing, one for only office offline work where security is of upmost importance, one for gaming where you don't really care if it gets a virus or not - or well I guess you would care somewhat if your save files aren't sync'd to their servers or if it's one where there is no cloud syncing for it which had a lot of hrs worked on it, and one for malware testing; rather than an all-in-one device that does it all for you.....as what it seems to be the trend nowadays....

I don't know if I'd trust Opera. Their VPN withen the browser goes through China and they more than likely see what's going through their servers. A Chinese-based company now owns Opera last I read. Not saying FF is any better though. I've read Mozilla will pass all your DNS queries through their own CloudFlare DNS one day. And I really don't like what Firefox has done to the browser. I use Pale Moon myself, but it too has its flaws. Mostly with the default user agent. So I forge it to make it look like I'm using Firefox so websites that sniff the UA don't act up. It seems a lot of websites sniff the UA and if you're not using Firefox, Chrome or Edge, they give you crap. Total BS. It shouldn't be like that. And banks do this all the time.

Oh really?! Didn't know Opera was that sinister....hahahaha How about Google Chrome? Is that any good?

Websites still complain about useragents??! I read sometihng like that last year or something for the reason why it's so long and it was back in the old days where web browsers would compete with each other, but it's still going to this day...?!:shock:

Not really. All can be hacked/infected at certain levels. Mac might be better in terms of gaming and relative security, but then again, you're limited to Apple software.

Malware like worms can craw through a network.

Yeah I suppose... I tried a mac once for school and didn't like their one mouse click thing and how their mouse is shaped, it was so weird and felt uncomfortable! The keyboard was so ....stiff....like typing on a laptop's keyboard on a desktop/tower computer! Not to mention the extra crap it puts on onto external drives, which yes are hidden from view, but if you have show hidden files and folders enable, you would see some gunk about that you have the urge to delete.....

I don't think there is anything I liked about using a mac at the time.....bah it's probably me being so used to using windows that anything else feels strange and uncomfortable to use.......see I would rather run a server on a windows server operating system than a linux one if given the opportunity, actually I do have a game server box that runs windows, but not windows server(because holy crap their server licenses are so expensive!!! ...I wonder if I can run pirated windows server...? hee hee hee....:devil: Because I do have a few older windows servers older than 2008, so kinda abandonware in a way), just standard windows 7(coz I had a spare legit key lying around that wasn't used), with zero protection on.....lol ...and hasn't been updated since maybe 5 or so months ago....hah!

Anyways, enough of my ramblings...

 

[file3456]

Mostly performance reasons and the fact it's just good common sense because thoe autorun programs can give you issues while trying to do another task.

Just use Bitdefender Free. It's all you need. You don't need the bloat. But it's definition-based so there's that. Check out Sandboxie for your browser. Read about it and learn how to use it. It's free for the browser, but after 30 days when you launch it the registration pop up shows for 5 seconds and then you can launch your browser. Small price to pay for free.

AOMEI is good to make a clone to an external USB HDD. It's simple to use, although owned by the Chinese. But I haven't had any issues with it.


Chrome has its flaws since that's Google and now they require you to sign in which is BS. I use Pale Moon, but in large part it suffers from a UA sniffing issue with websites. So I use the add-on UAControl to mitigate that. So far so good. Or just use Firefox which is no better than Chrome these days.

 

[Win7fuser]

I remember why now I needed java - was for accessing my server box via a java applet.......

What about Kaspersky's safe money equivalent in BitDefender Internet Security which is called safe online banking? Is that just a gimmick? And what about vulnerability assessment which looks like it's Kaspersky's vulnerability scanner? What about their firewall? Unless they're both just piggy backing onto windows default one and just rebranding it as their own? Not sure what anti-theft is, bu I'm guessing it'll be similar to Kaspersky's on-screen keyboard, Network monitor an Application activity tools....

The rest of BitDefender's Internet Security features, I can go without....oh yeah what about online support? What if a virus got pass the free version and I report it only to be shutdown because I'm just a freeloader and not one of their subscribers? hahahaha

Besides, I bought like 20 or so extra KIS keys from a sale........each lasting 2 years.....so 40 years of Kaspersky licences........I would feel bad if all these keys were to go to waste.....because I switched teams....

yeah I already got Sandboxie...I bought 5 lifetime keys for it......which would fit five computers fittingly.......

Yeah I'll check out AOMEI thanks!

Oh do you need to sign in now to use google chrome? huh....

So what can one do about polymorphic ransomeware or other similar types?

 

[file3456]

If you already bought keys then the obvious conclusion would be to just use what you have.

To mitigate polymorphic malware, Sandboxie should help with that. Or go full blown Shadow Defender.