Trend Micro RansomBuster

It's very good of Trend Micro to make RansomBuster available for free, and its Folder Shield successfully prevents unauthorized changes to your documents. However, the behavior-based detection system needs work.

Folder Shield

Trend Micro RansomBuster doesn't have a main window as such, just an icon in the notification area and this screen where you select folders for protection by Folder Shield.

Just Two Folders

You can only choose two folders to protect in this free utility. However, if one of those folders is C:\Users, that should cover most of your important documents.

Program Blocked

When an unauthorized program attempts to modify protected files, RansomBuster asks whether to block its access or add it to the trusted list. If you do nothing, it automatically blocks the program after a short while.

Unblock Program

If you block a valid program by accident, or allow RansomBuster to automatically block it, you can dig into the logs to find and unblock it.

Suspicious Software

In testing, RansomBuster identified some ransomware samples as merely suspicious, but still logged them as ransomware.

Ransomware Blocked

In other cases, RansomBuster clearly identified and blocked ransomware, along with a list of the files that were changed before detection.

Ransomware Details

Clicking for more details in the ransomware notification gets you more information about the attack, including a clearer list of the files that were encrypted, and that RansomBuster recovered.