Ransomware protection on networks

​I don't have a specific problem as much as a concern.

There has been a lot of media attention to Ransomware lately, including infecting all systems on a network.

We have several computers connected to a home network. All of the main systems run W10 (except for a couple of VM’s). All of the systems run Windows Defender, and most of the time with WD folder protection turned on. We also try to be internet careful, but there is always a possibility that one of the systems could get infected.

I am now running my main systems with Network Discovery turned off. This isn’t a problem because I can still access the other systems via I.P addresses.

I guess my question is: Do you think it’s possible for malware to jump to other systems on the network with discovery turned off, or am I being overly paranoid?

Its simple enough it scan everyhing in the local subnet and scan the registery for referances to other ips try a free network scan

Advanced IP Scanner - Download Free Network Scanner.

@Samuria Thanks for the input. There isn't any real protection then, except being very careful.

The main protection is permissions thatswhy MS set a lot of folders owned by system so nothing can write to the o/s folders if you share folders and give everyone rights the malware has rights as well.

One of the best security products is WinPatrol Security made easy! they do a anti ransomeware but there winpatrol is great its saved me many times and stopped things AV didnt catch. It monitors the registery and block any writes to it until you give perimmision most malware trys to write to it to run at start etc but winpatroll stops it

Samuria said:

It monitors the registery and block any writes to it until you give perimmision

Thanks again. Sounds good.

W. D. Folder protection stops everything from being saved to a protected folder, but doesn't give the user an option to say yes or no. The message flashes by so fast, I usually don't know what was actually blocked. WinPatrol sounds easier to work with.

Samuria said:

The main protection is permissions thatswhy MS set a lot of folders owned by system so nothing can write to the o/s folders if you share folders and give everyone rights the malware has rights as well.

Giving "Everyone" permission is a bad idea. When I share it's always to a specific username.

Garyw said:

​ I guess my question is: Do you think it’s possible for malware to jump to other systems on the network with discovery turned off, or am I being overly paranoid?

@Samuria

Its simple enough it scan everyhing in the local subnet and scan the registery for referances to other ips try a free network scan

Advanced IP Scanner - Download Free Network Scanner.

Seems to answer my question.

@Caledon Ken

Controlled access in WD is developing and will see further enhancements is 1809.

Last couple of pages of this thread. That said plenty of info in thread.

Add Protected Folders to Controlled Folder Access in Windows 10

With the possibility that CFA will actually become useful, I will mark this thread solved, and work with the above info. Thanks for the input.

Hi there

@Garyw

Hope you weren't too much in trouble with recent storm in Florida.

Ransomware these days isn't really the problem its made out to be

Here's a simple relatively NON GEEKY solution to deal with it -- doesn't cost anything either.

1) Download some Free backup software -- Macrium Free is liked by loads on this forum and its easy to use.

2) create on USB the bootable rescue media -- easily done from the menu of the backup program

3) Take an Image backup of your system on to an external HDD. (Take these regularly).

Now if you get ransomware do the following.

1) Power off computer immediately --- don't shutdown via windows -- hard power off via switch

2) if on a LAN disconnect the lan cable

3) power computer back on and boot from the bootable recovery USB you made in step 2) in the first part of the post.

4) restore the os / system.

Job done -- quick, easy no hours with virus cleansing software etc etc.

Golden rule with these things is NEVER PANIC - just go about the thing logically -- do not randomly type keys or whatever in an attempt to shut the program down -- just switch off entire machine immediately !!!

For me I've found WD more than adequate -- never needed anything else -- but that's another issue. The main thing is whatever you use is to take regular clean backups so in the event of any problems simply restore.

System restores can be done usually very much quicker -- especially if the backup is on an SSD even an SSD attached to computer via USB3-->sata connector than any amount of "Virus cleansing" and will be 100% reliable --you can never be 100% sure than any A/V cleansing process has actually totally fixed the machine.

Cheers
jimbo