Hi Could you please let me know if MS FEP has any signature to capture all versions of CTB-Locker Ransomware.

Regards

Vishakha Singh

Hi,

Please keep your FEP with the latest definition updates.

If it still cannot resolve the issue, you could submit a sample to Microsoft.

https://www.microsoft.com/security/portal/submission/submit.aspx

Best Regards,

Joyce

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator Wednesday, January 28, 2015 8:57 AM

Hi,

Please keep your FEP with the latest definition updates.

If it still cannot resolve the issue, you could submit a sample to Microsoft.

https://www.microsoft.com/security/portal/submission/submit.aspx

Best Regards,

Joyce

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator Wednesday, January 28, 2015 8:57 AM

Hi,

Please keep your FEP with the latest definition updates.

If it still cannot resolve the issue, you could submit a sample to Microsoft.

https://www.microsoft.com/security/portal/submission/submit.aspx

Best Regards,

Joyce

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator Wednesday, January 28, 2015 8:57 AM

That doesn't really say if it will detect it.  Can FEP detect it?  

Hi,

The blog below shows:

"Only few tools can remove ransomewares fully some of them i have
mentioned

• Microsoftsecurity essentials
• Windows defender
• Malwarebytes
• McafeeStinger"

Malware troubleshooting: recover your files damaged by CTB Locker Virus.

Best Regards,

Joyce

Microsoft anti-malware products may detect and remove actual version of CTB-Locker (aka Critroni) as: Ransom:Win32/Critroni, Ransom:Win32/Critroni.gen!A and/or Ransom:Win32/Critroni.B; but it can also be identified by another name/signature.

 It won't restore your encripted files though. Prevention and a secure backup system is your only defense against this threat.

Microsoft anti-malware products may detect and remove actual version of CTB-Locker (aka Critroni) as: Ransom:Win32/Critroni, Ransom:Win32/Critroni.gen!A and/or Ransom:Win32/Critroni.B; but it can also be identified by another name/signature.

 It won't restore your encripted files though. Prevention and a secure backup system is your only defense against this threat.

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator 1 hour 52 minutes ago

Microsoft anti-malware products may detect and remove actual version of CTB-Locker (aka Critroni) as: Ransom:Win32/Critroni, Ransom:Win32/Critroni.gen!A and/or Ransom:Win32/Critroni.B; but it can also be identified by another name/signature.

 It won't restore your encripted files though. Prevention and a secure backup system is your only defense against this threat.

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator Monday, February 02, 2015 9:54 AM

Microsoft anti-malware products may detect and remove actual version of CTB-Locker (aka Critroni) as: Ransom:Win32/Critroni, Ransom:Win32/Critroni.gen!A and/or Ransom:Win32/Critroni.B; but it can also be identified by another name/signature.

 It won't restore your encripted files though. Prevention and a secure backup system is your only defense against this threat.

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator Monday, February 02, 2015 9:54 AM

Why FEP can detect and remove Critroni, but too late when files are already encrypted/damaged ??? If FEP can detect them, it should block them with the real time protection no ?