|
|
|
Anti-Ransomware creates honeypot files on client computers. It stops the attack immediately after it detects that the ransomware modified the files.
The files are in these folders that Anti-Ransomware creates:
C:\Users\Public\Music
C:\Users\<User>\Music (MyMusic)
C:\Users\Public\Documents
C:\Users\<User>\Documents (MyDocuments)
C:\Users\Public\Videos
C:\Users\<User>\Videos (MyVideos)
C:\Users\Public\Pictures
C:\Users\<User>\Pictures (MyPictures)
You can identify these folders by the lock icon that is associated with the name of the folder. For example
The file names include these strings, or similar:
CP
CheckPoint
Check Point
Check-Point
Sandblast Agent
Sandblast Zero-Day
Endpoint
You can open and look at the files. They are real documents, images, videos, and music.
If a file is deleted, it is automatically recreated after the next system boot.
