Anti-Ransomware Software Overview

There are two types of Anti-Ransomware software: those that protect the system in real-time against incoming threats, and those that disinfect the system after a successful ransomware attack.

The following overview of anti-ransomware programs looks at programs that have been designed specifically for the purpose.

It doesn’t include general purpose security software that includes ransomware protection as well. In addition, we decided not to include solutions for individual ransomware, e.g. removal tools that are designed to remove a particular ransomware from a system running Windows.

As far as prevention is concerned, there is more that users can do, for instance making sure they run up to date security software, do back ups of important data and keep the backups detached from the system, or use common sense.

Anti-Ransomware Software

The following programs are designed to protect against ransomware, and/or disinfect computer systems that are already infected.

The programs are sorted alphabetically, and a table at the end provides you with information on how they stack up against each other.

Bitdefender Anti-Ransomware Software

Bitdefender’s program runs silently in the background after it has been installed on a supported version of the Windows operating system.

It has been designed to protect the system against the CTB-Locker, Locky and TeslaCrypt crypto ransomware families.

According to Bitdefender, it will protect against known and possible future versions of these families.

CryptoPrevent

CryptoPrevent is a long standing program designed to protect the operating system in real-time against ransomware and other threats.

It displays options on first run to select a protection level which you may increase or decrease as you see fit. The higher the level the better the protection, but the more likely it is that false positives occur.

The program adds group policy objects to the Windows Registry that prevent executable files from running in certain locations on the system. It furthermore uses hash definitions, program filtering and logic based on certain attributes of executable files to determine whether it should be launched on the system.

HitmanPro.Alert

HitmanPro.Alert is on first glance an anti-exploit program which should help against certain ransomware attacks as well.

But instead of stopping there, it includes protection against CryptoGuard ransomware as well. The program requires a valid HitmanPro license.

Interestingly enough, its feature set makes it quite the unique tool even if you compare it against other anti-exploit software such as EMET or Malwarebytes Anti-Exploit.

HitmanPro.Kickstart

HitmanPro.Kickstart is a complementary software for HitmanPro that you can boot from to run HitmanPro to remove ransomware infections from the Windows operating system installed on the PC.

It has been designed specifically to remove lock screen ransomware from the computer system.

Kaspersky Anti-Ransomware Tool for Business

Kaspersky’s solution against ransomware is called Kaspersky Anti-Ransomware Tool for Business. While designed for businesses in particular, the program is available as a free download currently on Kaspersky’s website.

The anti-ransomware program runs in the background after installation monitoring the file system for suspicious activity. It comes with a signature database to detect known threats, and uses a cloud-based service on top of that.

The program supports rollback operations, and ships with options to trust certain applications.

Malwarebytes Anti-Ransomware (Beta)

Malwarebytes’ program is currently offered as a beta that is free to install. It is unclear right now if the program will remain free after the beta or may be integrated in the company’s other products.

Apart from preventing infections from known ransomware such as CryptoLocker, CryptoWall, CTBLocker and Tesla, it implements something the developers call proactive protection against ransomware.

Malwarebytes Anti-Ransomware uses advanced proactive technology that monitors what ransomware is doing and stops it cold before it even touches your files. It has no shot at encrypting. And it does not rely on signatures or heuristics, so it’s light and completely compatible with antivirus.

The program needs to run on the computer system to block ransomware from attacking the computer successfully.

RansomFree

RansomFree creates honeypots on the local file system, and monitors those for suspicious activity.

Folders and files that it creates are randomized, but placed always at the top of the directory structure based on the characters used for the names.

The main idea is that ransomware cannot distinguish between lucrative and honeypot files. This means that ransomware will usually go through the file listing from top to bottom, and if it does, RansomFree will block it from encrypting legitimate files.

The program works on Windows 7 and newer, and supports local and network drives.

SBGuard Anti-Ransomware

SBGuard Anti-Ransomware hardens the operating system against ransomware threats. It is not a a program that monitors the system for threats, but will modify certain settings on the system to make it harder for ransomware to attack the data on it.

According to the description, it injects around 700 Registry entries to force Windows Group Policy to use inbuilt software execution restriction capabilities in certain locations, and prevent certain file types from executing.

Trend Micro Anti-Ransomware Tool

Trend Micro’s program for Windows has been designed specifically for lock screen ransomware. It refers to ransomware that limits user access to the computer.

The company has released two versions of the program for home users. The first can be used if the ransomware blocks access to the operating system only, but not to Safe Mode with Networking.

You can run the tool in Safe Mode with Networking then to remove the threat from the system and restore its full functionality.

The second version of the program is provided as a bootable USB version which you can run if both Safe Mode and regular mode are blocked by the ransomware.

WinAntiRansom

WinAntiRansom is a commercial anti-ransomware software program that block ransomware threats on Windows systems. While commercial, it is available for a one-time payment of $29.95 with guaranteed lifetime updates and usable on up to 5 devices you own.

The program uses a layered approach, and mixes it up with all kinds of cool features. For instance, it protects important files using its SafeZone feature to prevent ransomware slipping by from manipulating files.

Other layers include network lockdown, which protects mapped drives, and Registry protection, which protects important Registry keys from being manipulated by ransomware.

While designed specifically for ransomware, WinAntiRansom will block other malware as well thanks to its layered approach.

Anti-Ransomware Software Comparison

Now You: Did we miss a program? Do you use special software to protect your system against ransomware?