How to tell if your AV detects certain viruses

[glenimp617]

Hi all,

http://www.independent.co.uk/news/u...ty-council-pay-1-million-ransom-a6843261.html

I'm sure many in the enterprise sector will have heard the recent outage of Lincolnshire county council. We are putting the team together this morning to discuss our safety measures, which although we know are good, it never hurts going back over things.

My main question I'll be asking the team, is how do we know 100% that all our AV detection systems will identify "TeslaCrypt 3"

AFAIK we are protected by EOP, Exchange365, Fortinet antiGuard and Endpoint on the client

Is there a website that you can type in the virus name, and it tells you which AV and defs will detect it.

Thanks!

 

[glenimp617]

I had a feeling that may be the case. We have done this from time to time, especially on our rds platform.

The latest endpoint defs do have teslacrypt on it (aka crypt3) but I wondered if there was a general go to website.

How do we find the hash of the virus to stop it running?

defs = 1.213.5162.0

 

[glenimp617]

We are rolling AppV 5.1 out to our desktop estate, so perhaps white listing would be quite easy for us