Hot answers tagged

2

Many file-encrypting ransomware viruses add some "unique" file extension to the name of the affected file and leave a "manual" of how to decrypt the files in the affected directories. This is one of the easiest ways to detect them. On windows file servers you can set up the file server ressource manager to look for those files and block the creation or ...


2

My answer would require writing some code. I'm only posting this answer because you mentioned a programming related solution in your question. Ever since Window Vista, the windows kernel raises an event for basically every single thing that happens on your computer. Microsoft provides a library called TraceEvent for .NET that makes it absolutely trivial to ...


1

You can detect it by monitoring free space (very easy) or file writes (not that easy). The screenshots must be stored somewhere so files will have to stack up to a not-so-obvious location. This is the method I used, and I managed to locate and eliminate a multi-logger just by using a simple file manager.



Only top voted, non community-wiki answers of a minimum length are eligible