0

I use RansomWhere, a tool to protect from ransomware. I have OS X Yosemite.

As far as I understand, RansomWhere just warns me whenever an app tries to encrypt data. It's up to the user to judge whether they trust a process or not. (And whether the application is one which should need to encrypt data.) The user is given the choice of Allow or Terminate each time there is a warning. It has warned me about several apps I trust and that I figure did need to encrypt data, and I have simply clicked Allow.

However, just now I got a warning about a process I don't know what was. The message said "is encrypting data", so I figuredd I had to hurry, so I just clicked Terminate immediately after seeing that I wasn't sure what the process actually was. After clicking Terminate, the dialogue box disappeared, and I heard nothing more from RansomWhere regarding the issue.

Now, I want to know what this process actually was and what was going on. I don't remember the details given in the message, just that I wasn't sure which process it was. I wish I would have taken a second to take a screenshot before pressing Terminate, but unfortunately, I didn't.

How can I find out which process this was and what was going on?

Improve this question

1 Answer 1

Reset to default
1

According to RansomWhere's own site the data is stored in

  • /Library/RansomWhere/installedApps.plist - a list of applications already present on the system.
  • /Library/RansomWhere/approvedBinaries.plist - a list of binaries explicitly approved by the user.
  • /Library/RansomWhere/whitelist.plist - a list of safe binaries (that often legitimately create encrypted files).
  • /Library/RansomWhere/graylist.plist - a list of system binaries that are not explicitly trusted.

However, because an app that was terminated is by design not remembered, it will not appear in any list.

The following list summarizes the 'allow' and 'terminate' actions

  • 'allow' Tells RansomWhere? it's ok to let the process continue running. This will be persistently remembered; you'll never be alerted about this binary again.

  • 'terminate' Tells RansomWhere? to kill the process. As this action is a little more drastic, RansomWhere?, (by design) will not remember such actions. Thus if the terminated process is ran again, it will cause another alert.

You could check Console to see whether it generated an event at the time - I can't test that as I've never run RansomWhere.

Improve this answer
2
  • Should I search in console? Or look it up by time? In either case, how would I recognize the event?
    – Fiksdal
    Jul 16, 2016 at 7:05
  • You'd have to see what kind of trace RansomWhere leaves in console - if anything - then map it to the time you saw the dialog.
    – Tetsujin
    Jul 16, 2016 at 9:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .