What ransomware does
Ransomware is malicious software that encrypts documents, photos and other files on a computer and demands money to unlock them. It most often spreads through fraudulent attachments, fake installers or links in e-mails.
What to do in advance
The most reliable defence is a backup that an infected computer cannot reach. Protection against the attack itself is always only a complement.
- Back up important files to an external drive or to a cloud that keeps older versions of files.
- Disconnect the external drive after the backup. A permanently connected drive can be encrypted by ransomware as well.
- Keep Windows and your programs updated, especially the browser and the e-mail client.
- Do not open attachments and installers from unexpected messages.
Controlled folder access
Windows Security includes a feature called Controlled folder access (under Virus & threat protection → Ransomware protection). It prevents unknown programs from changing files in protected folders. It can occasionally block a legitimate program too, so try it first and allow access for that program if needed.
How BirdGuard helps
BirdGuard watches decoy files and mass file changes and alerts you to suspicious behaviour. It has no scanning engine and recognises most things only after the fact, which is why backups remain the most important thing.