What free AV's have ransomeware protection?

Would like to find good av with ransomeware protection that is free.

 

Technically all AV's should block ransomware, after all their sole purpose is to block malware which ransomware is. Some have specific modules for this which may, or may not, be marketing fluff. Top free AV's would be Kaspersky, Bitdefender, Microsoft Defender and Avast, just pick one and maybe supplement it with a secondary program such as Voodoo Shield or OSArmour, if you chose to run Defender in W10 or 11 you can use Configure Defender and/or Hard Configurator to jack up the protection a notch.

 

Avast One Free

 

Kaspersky-Microsoft Defender

 

Defender has two ransomware protection

1. Controlled Folder
2. A special setting for ASR Rules
https://learn.microsoft.com/en-us/m...de#use-advanced-protection-against-ransomware

 

Just bear in no antivirus which has ransomware protection, or even standalone anti-ransomware product will protect you against all ransomware. The best way to avoid ransomware is to not be click happy and be very careful about what files you open. The vast majority of infections happen when you manually open an infected file.

 

i have in mind that MS Defender is only able to fully detect ransomware when running an offline scan? is that still true? so if, why so? and why do offer other vendors antiransomeware without such behavior?
From my technical knowledge an offline scan is the only way to detect it before starting the OS. this means that eg Eset and others need to scan before the system starts (scan on boot or similar feature).

 

Giving Avast One Essential a try. Maybe be ok. I just noticed that on this system can't see difference between what I have read and not on this site. Wonder why? On other system fine.

 

CyberLock! https://www.cyberlock.global/

 

How about then, when you install a program, which seems to be legitimate one. After the installing procedure, it drops and run a .cmd .bat file, that uses legitimate 7zip or rar command line function to rapidly encrypt you %homepath% ?
That is why im not using standard environment variables, which mean, i do not save anything to "dowloads, music, documents etc" folders. I made my own folders for music, documents etc.

 

Oops, I forgot name change.

 

You can also use AppCheck Free, this tool uses behavioral monitoring, while many AV's rely mostly on cloud scanning. I believe Bitdefender Free also has behavior monitor, but I'm not sure if it's specialized to monitor for suspicious file activity like AppCheck.

https://www.tomsguide.com/reviews/bitdefender-antivirus-free-for-windows
https://www.softpedia.com/get/PORTA...---Antispyware/AppCheck-Anti-Ransomware.shtml

 

It's rare these days for an antivirus to not have behaviour monitoring.

 

I use the Malwarebytes AntiRansomware beta which is free. This works with Avast, BitDefender and Panda Dome and probably many others.

 

It appears that you can still get the free Kaspersky Anti-Ransomware Tool. You could pair that with any product.

 

Kaspersky:

https://www.kaspersky.com/free-antivirus#compare-table

Avast:

https://www.avast.com/en-ph/free-antivirus-download#pc

Bitdefender:

https://www.bitdefender.com/solutions/free.html

 

Yes, but they don't all work the same. I believe that AppCheck and HMPA constantly monitor the file system for ransomware like activity, I don't believe that all AV's do this. What most of them do is they send files to the cloud to get a verdict, but this is not the same as monitoring the file system for suspicious I/O activity.

 

They do both.

 

Correction: some report that Bitdefender free doesn't have ransomware protection.

https://www.pcmag.com/reviews/bitdefender-antivirus-free

 

It has ransomware protection, but not the rollback function like the paid one.
Many tests on youtube shows it have very good protection against ransomware...

 

AFAIK, Windows Defender doesn't monitor the file system for ransomware behavior, at least not in the same way as HMPA and AppCheck do. That's why I always recommend these tools, because they function as a second line of defense.

OK, so it can block ransomware from running, but if this ransomware somehow managed to still encrypt some files, then you are toast?

 

OSArmor might stop Ransomware.

 

This is incorrect. Please quit with the nonsense.

https://learn.microsoft.com/en-us/defender-endpoint/behavior-monitor
As @roger_m said:

 

It's not nonsense, you must have missed the part about me saying it doesn't do this in the same way as HMPA and AppCheck.

Win Defender AV (not the enterprise product) will always rely on the cloud for best protection against malware/ransomware, that's why it sometimes fails to block them, or fails to protect against partial encryption of files. Recently it failed to block a ransomware simulator as was seen on The PC Security Channel. HMPA's CryptoGuard (with rollback feature) is much more advanced and doesn't rely on the cloud.

https://www.pcmag.com/reviews/microsoft-windows-defender-security-center

 

It is absolutely correct. Defender's ransomware protection is only related to protected folders, it has to be enabled first and it is limited to certain folders and certain processes. It is not a real ransomware protection.

Code:

https://support.microsoft.com/en-us/windows/protect-your-pc-from-ransomware-08ed68a7-939f-726c-7e84-a72ba92c01c3

That is a behavior monitor for common malware, which virtually every other AV has as well, it is not a ransomware protection, just a random malware detection. The fact, that it does not work, speaks for itself.