RE: IFS share /QIBM and /QIBM/ProdData/OS400/DirSrv

I wonder if the trick to stopping ransomware is not trying to prevent the encryption but to trap for a pattern in the .exe (or whatever) file which indicates that file might be a ransomware program? So if user BUBBA gets an attachment labeled dontopenthisyouidiot.exe and runs it and it encrypts all the files on his PC and all the shares he is currently using it would have been stopped if any of the following would have detected that the particular exe file matched a ransomware pattern? The following being: firewall programs such as barracuda, antivirus programs attached to the email system such as Trend Micro's ScanMail for IBM Domino, or antivirus programs running on the PC itself. Some people will run all three (we do but other vendors than those mentioned). Some will use different vendors for the different levels on the hope that a "day 1" virus may be updated on a pattern file faster and you hope that either vendor A or vendor B is more on top of it. It's often that day 1 virus that gets you.

Just got an email from our antivirus package about someone in a different plant:

Control Manager (TRENDCONTROL) notification: Spyware/Grayware found action result.
A spyware/grayware from source N/A has been detected on <redacted>
Spyware/Grayware: PUA.MSIL.WebCompanion.AB
Action result: File cleaned
Infected file: webcompanion.exe File path: C:\program files (x86)\Lavasoft\web companion\application
Scan engine: 6.200.4014
Spyware/Grayware pattern: 0.022.63
Event date/time: 2/27/2020 12:04:36

A lot of times this is because someone brought in a thumb drive and it got scanned immediately upon being plugged in.
Sometimes they are caught when their PC is scanned on a periodic basis. Literally I can tell it's Thursday because of some of these I get. No joke.

Rob Berendt