weird file in device with TRAPS

[Marivi]

Hello,

We have devices with TRAPS and we has found files with strange names as !!!!!!!!* and zzzzz*.

I we try to modify or execute we get anti-ransomware alert.

this files are normal? could be a bug? 

[BPry · Accepted solution]

@Marivi,

This is not a bug and they are supposed to be present. These files aid in Trap's ability to detect Randsomware, which is why you are getting the alert when you attempt to touch them. 

[Harshit · Accepted solution]

@BPry is correct,

these solution make random files that are first and last in directories and any modifidcations to them is considered a ransomware activity, you can hide these files from display  by not showing hidden files in the explorer.

~HTH

[Marivi]

hello, please could you help me with this doubt? i would like to know if this files should be hidden or is normal that an user with provileges from powershell can see them.

[BPry]

@Marivi,

You would be able to see these files from PowerShell if your doing an ls action or something similar. 

[Marivi]

thanks, but them is normal that an user is able to see them o must be hidden?

[BPry · Accepted solution]

@Marivi,

PowerShell by default will see hidden files; users by default will not see hidden files. See below

[bartpl]

Hi

Working with Docker Desktop the weird files are NOT ok, bad behavior.

If you step into the windows containers with PowerShell you see the weird files, and not at all manageable.

https://github.com/docker/for-win/issues/5132

Bart