Your antivirus or security suite really ought to protect you against ransomware, along with all other kinds of malware.
There might be an occasional slipup with a never-before-seen attack, but those unknowns rapidly become known.
Unfortunately, ex post facto removal of ransomware still leaves your files encrypted.
That's why you may want to add a ransomware protection utility to your arsenal.
The free CyberSight RansomStopper stopped real-world ransomware in testing, and the latest update handles ransomware that only runs at boot time.
RansomStopper is quite similar to Cybereason RansomFree, Trend Micro RansomBuster, and Malwarebytes Anti-Ransomware Beta.
All four are free, and all detect ransomware based on its behavior.
Since they rely on behavior, it doesn't matter whether the ransomware is an old, known quantity or a just-created zero-day attack.
Like RansomFree, RansomStopper uses bait files as part of its detection methodology.
However, RansomStopper hides its bait files from the user.
Getting Started
Installation went quickly in my testing.
After the download, I completed the process by entering my first and last name and email address.
Once I responded to the confirmation email, the product was up and running.
Unlike ZoneAlarm Anti-Ransomware and some others, it did require a reboot to be fully operational.
The product's simple main window reports that "You are protected from ransomware." Buttons across the bottom let you view security alerts, processes RansomStop has blocked, and processes you've chosen to allow.
Another button lets you check for updates, if you didn't select automatic updates during installation.
Simple!
CyberSight also offers a business edition.
Added features include email alerts, centralized administration, and detailed reports.
The business edition costs $29.99 for a single license, though the price drops to as low as $10 per seat with volume licensing.
Ransomware Protection
When RansomStopper detects a ransomware attack, it terminates the offending process and pops up a warning in the notification area.
Clicking the warning lets you see what file caused the problem.
There's an option to remove programs from the blocked processes list—along with a warning that doing so is a bad idea.
Waiting to detect ransomware behavior can sometimes mean that the ransomware encrypts a few files before termination.
When I tested Malwarebytes, it did lose a few files this way.
Check Point ZoneAlarm Anti-Ransomware($39.95 Billed Annually at ZoneAlarm) actively recovers any encrypted files.
In my testing, it did so for every ransomware sample.
However, RansomStopper stopped the same samples without allowing encryption of any files.
For a quick sanity check, I launched a simple fake ransomware program that I wrote myself.
All it does is look for text files in and below the Documents folder and encrypt them.
It uses a simple, reversible cipher, so a second run restores the files.
RansomStopper caught it and prevented its chicanery.
So far so good.
Caution, Live Ransomware
The only sure way to test behavior-based ransomware protection is by using live ransomware.
I do this very cautiously, isolating my virtual machine test system from any shared folders and from the internet.
This test can be harrowing if the anti-ransomware product fails its detection, but my RansomStopper test went smoothly.
Like ZoneAlarm and Malwarebytes, RansomStopper caught all the samples, and I didn't find any files encrypted before behavioral detection kicked in.
Cybereason RansomFree did pretty well, but it missed one.
I also test using KnowBe4's RanSim, a utility that simulates 10 types of ransomware attack.
Success in this test is useful information, but failure can simply mean that the behavior-based detection correctly determined that the simulations are not real ransomware.
Like RansomFree, RansomStopper ignored the simulations.
Boot-Time Danger Resolved
Keeping under the radar is a big deal for ransomware.
When possible, it does its dirty deeds silently, only coming forward with its ransom demand after encrypting your files.
Having administrator privileges makes ransomware's job easier, but getting to that point typically requires permission from the user.
There are workarounds to get those privileges silently.
These include arranging to piggyback on the Winlogon process at boot time, or set a scheduled task for boot time.
Typically, the ransomware just arranges to launch at boot and then forces a reboot, without performing any encryption tasks.
In my earlier testing, I found that ransomware could encrypt files at boot time before RansomStopper kicks in.
My own fake encryption program managed that feat.
It encrypted all text files in and below the Documents folder, including RansomStopper's bait text files.
(Yes, those files are in a folder that RansomStopper actively hides, but I have my methods…) It also missed a real-world ransomware sample that I set to launch at startup.
CyberSight's designers tested a number of solutions for this problem and released a new version that gets ahead of boot-time ransomware.
I tested it; it works, removing the one blot on RansomStopper's now-sterling test results.
RansomFree runs as a service, so it's active before any regular process.
When I performed the same test, setting a real-world ransomware sample to launch at startup, RansomFree also caught it.
Malwarebytes also passed this test.
RansomBuster detected the boot-time attack and recovered the affected files.
To further explore this problem, I obtained a sample of the Petya ransomware that caused trouble earlier this year.
This particular strain crashes the system and then simulates boot-time repair by CHKDSK.
What it's actually doing is encrypting your hard drive.
Malwarebytes, RansomFree, and RansomBuster all failed to prevent this attack.
RansomStopper caught it before it could cause the system crash—impressive! ZoneAlarm also prevented Petya's attack.
To be fair to the others, this one is not a typical file encryptor ransomware.
Rather, it locks the entire system by encrypting the hard drive.
Querying my contacts, I did learn that boot-time ransomware attacks, including Petya, are becoming less common.
Even so, I've added this test to my repertoire.
Other Techniques
Behavior-based detection, when implemented properly, is an excellent way to fight ransomware.
However, it's not the only way.
Trend Micro RansomBuster and Bitdefender Antivirus Plus are among those that foil ransomware by controlling file access.
They prevent untrusted programs from making any change to files in protected folders.
If an untrusted program tries to modify your files, you get a notification.
Typically, you get the option to add the unknown program to the trusted list.
That can be handy if the blocked program was your new text or photo editor.
Panda Internet Security goes even farther, preventing untrusted programs from even reading data from protected files.
Ransomware crooks need to take care that they'll be able to decrypt files when the victim pays up.
Encrypting files more than once could interfere with recovery, so most include a marker of some kind to prevent a second attack.
Bitdefender Anti-Ransomware leverages that technique to fool specific ransomware families into thinking they've already attacked you.
Note, though, that this technique can't do a thing about brand-new ransomware types.
When Webroot SecureAnywhere AntiVirus encounters an unknown process, it starts journaling all activity by that process, and sending data to the cloud for analysis.
If the process proves to be malware, Webroot rolls back everything it did, even rolling back ransomware activity.
ZoneAlarm and RansomBuster have their own methods for recovering files.
When the anti-ransomware component of Acronis True Image kills off a ransomware attack, it can restore encrypted files from its own secure backup if necessary.
Now a Winner
CyberSight RansomStopper detected and blocked all my real-world ransomware samples without losing any files.
It also detected my simple hand-coded ransomware simulator.
And it blocked an attack by Petya, where several competing products failed.
Earlier, RansomStopper exhibited a vulnerability to ransomware that only runs at boot time, but my sources say this type of attack is becoming less common, and CyberSight has since fixed this problem.
Other free products had their own problems.
RansomFree missed one real-world sample, and Malwarebytes let another sample irreversibly encrypt a few files before its detection kicked in.
RansomBuster fared worse, missing half the samples completely (though its Folder Shield component protected most files).
RansomStopper and Check Point ZoneAlarm Anti-Ransomware are our top picks for dedicated ransomware protection.
ZoneAlarm isn't free, but at $2.99 per month it's also not terribly expensive.
Still, RansomStopper manages full protection at no cost.
