I was recently asked to look at a Windows computer behaving strangely, and I found a "Your files have been encrypted" ransom note that had been left in several directories. I wasn't able to identify any actual encrypted files, except for one copy of the ransom note that had been encrypted by a different ransomware that left another note.
The ransom note was present in 3 formats: a plain text file, an HTML file, and a shortcut (.url
file) pointing to the payment web page.
I was able to read some of the files, but some of them (the second ransomware's note, and the first ransomware's HTML file) disappeared immediately on any attempt to open them. I was then notified by System Center Endpoint Protection that it had identified them and quarantined them. I had to restore them from quarantine and disable its real-time scanning to be able to read them.
This seems to me like a drastic action. It acted as if reading the note was going to cause further damage, when in fact the opposite is true: reading the note is the only way you will ever have a non-zero chance of decrypting your files!
It wasn't just treating them as "generally suspicious" - it specifically said they were Ransom:HTML/Tescrypt.A
and Ransom:HTML/Crowti.A
so it had enough information to make a better decision.
On the other hand, preventing the victims from reading the ransom notes could be seen as a hard "no negotiation" rule. If victims can't make contact, the crypto-ransom industry will be less profitable, and maybe that fact will deter future incidents, which would be a definite long-term benefit. As for the current victim, well, there was no guarantee the bad guy is really going to give up the decryption key after they get the money...
Is Shoot The Hostage an official policy in the anti-virus industry?