Malicious Software Found by Anti-virus Software

[i2w8am9ii2]

Hello,

I started a Ninjatrader backup, then had to attend to other things. When I got back to my computer, I saw that my anti-virus software had a message that it had blocked malicious software in Ninjatrader.

The name of the malicious software is: LockyEnc.A.gen!Camelot

It was located in the following directories:

C:\Users\****\Documents\Ninjatrader 7\DB\TICK

Anyone know anything about this?

Screenshot attached,

[NinjaTrader_Brandon]

Hello i2w8am9ii2,
Thanks for your post.
I am not familiar with this infection and these files look normal. It may have been a false positive however you can delete these files.

[i2w8am9ii2]

Hi Brandon,

Okay, thanks.

[sledge]

Looks like one of those Ransomware viruses.

https://virustotal.com/en/file/8d11f57a904ac7a2b7b5ea1b067ebc79a53fa83d0c242226fbe99c70465f8063/analysis/

You should definitely run a full system scan if you have already.

If you haven't already deleted them, are the system file timestamps old or "recent"?

We all turn off antivirus to these folders to avoid market replay issues.

[i2w8am9ii2]

Hi Sledge,

Thanks for your reply.

I did run a Malwarebytes anti-malware scan. I did not run a anti-virus scan.

My anti-virus software said that it blocked and quarantined the malicious items, so I think it is okay.

I already did delete the quarantined files.

[i2w8am9ii2]

I am still getting the anti-virus notifications that it blocked a malicious software. But it mostly tells me that it blocked the malicious software from Google Chrome.

I reported it to Google.

Screenshot attached,

[sycogrim]

Hey. Today, there are many different types of ransomware (Cerber, Lokcy, Cryptolocker, Petya, Osiris and others). Lokcy is one of the most spread out ransomware, he is the most dangerous.
Here is an article that describes how ransomware acts http://myspybot.com/jaff-file-virus/