I'm sorry you've had such a roller coaster of an experience with this ransomware. If it's any consolation, you aren't alone, thousands of people are victims of this everyday.
The situation with this type of malware, was pointed out above, to where you have to have prevention in place BEFORE you get the virus. And you can't do this with a DAT based scanner. Detecting it with a DAT, happens AFTER we get a sample, and add detection. (for the most part) (I don't want to belittle the hard work that goes behind the scenes to proactively detect unknown samples, but it's VERY difficult to do, without creating false detections that can sometimes be worse than the virus)
All that said, we do want you to submit any samples that aren't detected, but understand it will be after the affects of the malware in your environment.
To get ahead of it, you have to stay on top of any preventative measures you can take. There are many moving parts to this, including: Access Protection rules to prevent certain registry/file based actions from happening.
Blocking unknown network traffic with a firewall (both end point and network based firewall).
User education!! This one is one of the best ways, but least reliable. If your users don't click on random stuff they get via email, or web popups, you will drastically reduce your infection rates. You might consider our webprotect product (previously Siteadvisor), that can help dissuade users from clicking on stuff they shouldn't. (I'm sure there is a free version, as well as paid, but I'm no salesman.)
Remember, the malware authors test their viruses against current AV companies, to ENSURE they aren't detected before they try to "deploy" it to the world, so traditional DAT based AV, is limited in what it can do for these rapidly changing variants of ransomware.
Hope that helps, at least a little.
- David
