0

I understand that in order to encrypt terabytes of data, a ransomware must work hard for hours on HDD and perhaps for under an hour on SSD.

So it has to leave obvious signs of doing so.. right?

Would a ransomware be visible in Windows Resource Monitor on Disk usage tab? Are all of them behaving similar in this regard or not?

EDIT: This is nothing as the proposed "duplicates". This question specifically is asking - if a particular type of malware expected to use disk in a way that can be detected in Resource Monitor Disk tab.. Under whatever name or disguised under whatever.. OR it uses some tricky access to disks that cannot be seen by Windows..

Stevoisiak
  • 13,555
  • 39
  • 101
  • 154
Boppity Bop
  • 2,237
  • 7
  • 30
  • 45
  • well, yes and no... Yes it would show up, but you'd have to be actively looking for it all the time, and there's no telling what it may have already done by the time you catch on. Additionally, it may pretend to be a different program, or try to run itself under svchost, making it very difficult to detect – Blaine May 14 '17 at 14:36
  • this is not a duplicate. asking if all programs show in process tab is not the same as disk activity in Resource monitor.. Completely different question. see the edit. – Boppity Bop May 17 '17 at 10:17

0 Answers0