topic weird file in device with TRAPS in General Topics

weird file in device with TRAPS

Marivi — Fri, 27 Apr 2018 12:06:26 GMT

Hello,

We have devices with TRAPS and we has found files with strange names as !!!!!!!!* and zzzzz*.

I we try to modify or execute we get anti-ransomware alert.

this files are normal? could be a bug?

Re: weird file in device with TRAPS

BPry — Fri, 27 Apr 2018 13:28:03 GMT

@Marivi,

This is not a bug and they are supposed to be present. These files aid in Trap's ability to detect Randsomware, which is why you are getting the alert when you attempt to touch them.

Re: weird file in device with TRAPS

Harshit — Fri, 27 Apr 2018 20:24:30 GMT

@BPry is correct,

these solution make random files that are first and last in directories and any modifidcations to them is considered a ransomware activity, you can hide these files from display by not showing hidden files in the explorer.

~HTH

Re: weird file in device with TRAPS

Marivi — Thu, 03 May 2018 14:50:28 GMT

hello, please could you help me with this doubt? i would like to know if this files should be hidden or is normal that an user with provileges from powershell can see them.

Re: weird file in device with TRAPS

BPry — Thu, 03 May 2018 14:51:47 GMT

@Marivi,

You would be able to see these files from PowerShell if your doing an ls action or something similar.

Re: weird file in device with TRAPS

Marivi — Thu, 03 May 2018 15:04:41 GMT

thanks, but them is normal that an user is able to see them o must be hidden?

Re: weird file in device with TRAPS

BPry — Thu, 03 May 2018 15:06:49 GMT

@Marivi,

PowerShell by default will see hidden files; users by default will not see hidden files. See below

Re: weird file in device with TRAPS

bartpl — Sun, 01 Dec 2019 21:04:51 GMT

Working with Docker Desktop the weird files are NOT ok, bad behavior.

If you step into the windows containers with PowerShell you see the weird files, and not at all manageable.

https://github.com/docker/for-win/issues/5132

Bart