Ransomware is one of the worst types of malware that can affect a computer, a computer virus that encrypts the computer's files and requires payment to the victim to receive the decryption key, which may not even work. Today's computer viruses, in fact, are no longer created only to ruin the victims' computers, they are instead much more subtle, often remain invisible and are designed to obtain tangible advantages, such as money or private information. Ransomware is a type of malware designed to block the computer from the outside, asking for a real ransom in real money (in cryptocurrency) to be sent to the person who created the virus. Usually, the ransomware encrypts the files to prevent them from being viewed, but there have also been cases of more malicious malware that simply delete the documents folder files from the victim's PC or delete backups making file recovery impossible.
Since this is a very dangerous type of virus, it is good news that Microsoft has added Ransomware protection to Windows Defender on Windows 10, which is disabled by default . Even if it is an important security measure, there is the problem that when choosing to activate an anti-ransomware protection such as that included in Windows Defender or any other, there may be limitations in the use of some programs that can be seen as false positives and some configuration work will be needed.
However, due to the permanent effects of this virus, the only security weapon is prevention, thus avoiding any possibility of being infected. My advice is therefore to activate the Ransomware protection in Windows 10 anyway (also because you don't have to install any new programs and it's free) and then arrange the configuration so that the safe programs are not limited. Furthermore, after activation, you can always deactivate Ransomware protection at any time should it block necessary operations.
Also keep in mind that having an updated and reliable antivirus may not be enough to protect yourself from Ransomware that can find a way to infect a PC with just a click in the wrong place, especially since the authors of these viruses use deception to bring error.
Controlled Folder Access protects some predefined folders which are the most important ones such as Documents, Pictures, Videos, Music, Desktop, Favorites. You can also extend the protection to multiple folders by clicking on the Protected folders link and then on " Add a protected folder ".
Once the Windows Defender Ransomware protection is correctly configured, the function will begin to monitor and block apps and programs that access protected folders and protected files saved within them.
As mentioned above, some programs that create files in protected folders may be blocked by Windows Defender even if they are fully legitimate. You will then have to use the option that creates exceptions for some programs .
Still remaining in the section of Settings> Update and security> Windows security> Virus and threat protection> Ransomware protection, press on the link Allow app through controlled folder access . Then find the program that we want to authorize to use these folders and insert it in the list of allowed apps. You can repeat this for all the programs and apps you are sure of. Keep in mind, for example, that if you try to save a new image in the Images folder, if it is protected with Ransomware protection, the action will be prevented and you must authorize the program with which you use to save the file in that folder.
In the Ransomware protection configuration screen you can click on the Block history link to see the programs to which Windows Defender has blocked access to files. If you see names of unknown programs or which should not have accessed that folder, you can then remove that program.
Finally, note that Windows 10 uses the Onedrive folder to create a safe backup copy of the protected folders so that you can recover everything even if your PC is infected with a ransomware.
READ ALSO: How User Account Control works in Windows (UAC).
In another article we have seen important folders and files to save on a Windows PC while in another updated guide, the best Free programs to make automatic backups
Hitman Pro Alert guarantees that every visited online shopping site, banks or others that contain secure data are legitimate, true and secure and that the information passages are encrypted.
Some malware and Trojans are indeed well designed to compromise and manipulate transactions and steal account credentials. These Trojans are very difficult to detect, even with an updated antivirus, because the attackers use effective obfuscation and concealment techniques to evade the detections in the first days of spread. In practice, a new Trojan can be difficult to intercept and block in the first 24 hours of life which can be enough for hackers to infect tens of thousands of computers and steal money from hundreds of victims.
HitmanPro Alert preventively protects against these threats by detecting changes on browsers or on the system. It also includes a feature called Cryptoguard which does not attempt to detect malware based on its static properties, but based on its behavior.
If therefore suspicious behavior is detected, the virus is immediately blocked and the malware is neutralized, without the need for any user intervention. No files will therefore be encrypted and taken hostage. HitmanPro Alert with its vaccination functions active and Cryptoguard works silently in the background at the file system level and takes up just 2 MB of memory.
Since this is a very dangerous type of virus, it is good news that Microsoft has added Ransomware protection to Windows Defender on Windows 10, which is disabled by default . Even if it is an important security measure, there is the problem that when choosing to activate an anti-ransomware protection such as that included in Windows Defender or any other, there may be limitations in the use of some programs that can be seen as false positives and some configuration work will be needed.
However, due to the permanent effects of this virus, the only security weapon is prevention, thus avoiding any possibility of being infected. My advice is therefore to activate the Ransomware protection in Windows 10 anyway (also because you don't have to install any new programs and it's free) and then arrange the configuration so that the safe programs are not limited. Furthermore, after activation, you can always deactivate Ransomware protection at any time should it block necessary operations.
Also keep in mind that having an updated and reliable antivirus may not be enough to protect yourself from Ransomware that can find a way to infect a PC with just a click in the wrong place, especially since the authors of these viruses use deception to bring error.
How to activate ransomware protection in Windows Defender on Windows 10 PC
Ransomware protection in Windows Defender protects important folders on your computer from program action and also provides protection against malware. To enable it, follow this procedure:- Open the Start menu, click on the Settings button (gear button) and then go to the Update and security section.
- From the left pane, click on Windows Security and then on the Virus and Threat Protection row.
- Scroll down to locate ransomware protection and click Manage Ransomware protection .
- On the screen that appears, activate the Controlled folder access option.
- In the next pop-up you will be asked for permission to make changes on the PC. Press Yes to proceed.
Controlled Folder Access protects some predefined folders which are the most important ones such as Documents, Pictures, Videos, Music, Desktop, Favorites. You can also extend the protection to multiple folders by clicking on the Protected folders link and then on " Add a protected folder ".
Once the Windows Defender Ransomware protection is correctly configured, the function will begin to monitor and block apps and programs that access protected folders and protected files saved within them.
As mentioned above, some programs that create files in protected folders may be blocked by Windows Defender even if they are fully legitimate. You will then have to use the option that creates exceptions for some programs .
Still remaining in the section of Settings> Update and security> Windows security> Virus and threat protection> Ransomware protection, press on the link Allow app through controlled folder access . Then find the program that we want to authorize to use these folders and insert it in the list of allowed apps. You can repeat this for all the programs and apps you are sure of. Keep in mind, for example, that if you try to save a new image in the Images folder, if it is protected with Ransomware protection, the action will be prevented and you must authorize the program with which you use to save the file in that folder.
In the Ransomware protection configuration screen you can click on the Block history link to see the programs to which Windows Defender has blocked access to files. If you see names of unknown programs or which should not have accessed that folder, you can then remove that program.
Finally, note that Windows 10 uses the Onedrive folder to create a safe backup copy of the protected folders so that you can recover everything even if your PC is infected with a ransomware.
Prevention against Ransomware
Obviously, to avoid getting hit by ransomware, you need to protect your PC from viruses properly. Other important recommendations and solutions to be adopted are the following.Anti-Exploit
In Windows 10, as explained in another article, it is also possible to activate protection from Exploits in Windows Defender, which means being protected from threats still unknown.Keep User Account Control active.
User Account Control, also called UAC, is that function of Windows that blocks the execution of files until the user intervenes to confirm it. This is that request message to allow that app to make changes to the system, which appears when you run a new program or file. Disabling UAC loses control over any malware attempting to automatically run on your computer. By keeping it active, on the other hand, any action of dangerous or unrecognized files can be blocked in the bud.READ ALSO: How User Account Control works in Windows (UAC).
Always have a backup
This is something crucial to avoid crying after a ransom virus. In fact, if all the computer files have been saved on another hard disk in a backup copy, we do not care that malware blocks them on the computer. Once the virus is removed and encrypted files are deleted, they can be restored from the backup.In another article we have seen important folders and files to save on a Windows PC while in another updated guide, the best Free programs to make automatic backups
Other anti-ransomware programs
That of Windows Defender is a very effective protection, but if you wanted an external program, I could recommend installing one of the best Anti-Ransomware against Ransom or Crypto virus .Ransomware Protector
One of the best is free for personal use is Ransomware Protector which guarantees strict security for PC data with the double encryption methodology. It is basically a powerful backup tool that keeps all your data safe and sound. Therefore, if the system is hit by any type of cyber attack, the data will still be stored on a secure cloud server.HitmanPro Alert
Among these, the HitmanPro Alert program is very good, free only for 30 days, which in version 3 also includes one of the most accurate malware removal tools.Hitman Pro Alert guarantees that every visited online shopping site, banks or others that contain secure data are legitimate, true and secure and that the information passages are encrypted.
Some malware and Trojans are indeed well designed to compromise and manipulate transactions and steal account credentials. These Trojans are very difficult to detect, even with an updated antivirus, because the attackers use effective obfuscation and concealment techniques to evade the detections in the first days of spread. In practice, a new Trojan can be difficult to intercept and block in the first 24 hours of life which can be enough for hackers to infect tens of thousands of computers and steal money from hundreds of victims.
HitmanPro Alert preventively protects against these threats by detecting changes on browsers or on the system. It also includes a feature called Cryptoguard which does not attempt to detect malware based on its static properties, but based on its behavior.
If therefore suspicious behavior is detected, the virus is immediately blocked and the malware is neutralized, without the need for any user intervention. No files will therefore be encrypted and taken hostage. HitmanPro Alert with its vaccination functions active and Cryptoguard works silently in the background at the file system level and takes up just 2 MB of memory.
