Ransomware protection, explained

01What ransomware does in its first seconds

Ransomware rarely announces itself. It arrives as a file that looks like an invoice, a free copy of a paid game, a "driver update" or an attachment that asks you to enable something. Once you run it, it works with your own rights, so it can open everything you can open.

Then it hurries. A typical run goes through Documents, Desktop, Pictures and any connected drives. It reads each file, writes back a scrambled version that only the attacker's key can undo, and renames it with a new extension, so that report.docx becomes report.docx.locked. It drops a note in folder after folder explaining how to pay. Some variants write an encrypted copy and delete the original instead; some try to remove restore points first. A modern PC lets it get through a great many files in a few minutes.

That speed is the danger, but it is also the weakness. Antivirus tries to recognise a harmful program before it runs, which works well against known threats and less well against brand-new ones. A behaviour shield takes the other road: it does not need to know the program's name. It watches for the things ransomware cannot avoid doing, and acts within the first second.

You do not need the burglar's name to notice that every drawer in the house is being opened at once.

02How the shield notices

The shield watches your protected folders: Documents, Desktop, Pictures and Downloads by default, plus any folders you add. Within a short window of about ten seconds, it adds up signals like these:

• Hidden decoy files. MoLock places a few hidden files with randomised names in your protected folders. You never open them, and no normal program has any reason to. If something changes, renames or deletes a decoy, that alone is enough to raise the alarm.
• A burst of renames to a new extension. One document renamed to an unknown extension counts a little. Several files suddenly sharing the same new extension counts a lot.
• Files rewritten into random-looking data. When a file's familiar beginning is destroyed, or readable text turns into noise, that is what encryption looks like from the outside.
• Copies and deletions. Encrypted copies appearing as originals disappear, or a sudden storm of deletions.
• Ransom notes. Files with the typical names of ransom notes showing up in several folders, especially when their wording matches.

Knowing what is happening is only half of it; the shield must also know who is doing it. With MoLock's guard service, the shield reads Windows' own file activity records and knows exactly which program touched which file. Without it, MoLock works it out from which programs are suddenly reading and writing heavily, which ones hold the affected files open, and a few hints about risk, such as a program running from Downloads. The service also lets the shield pause harmful programs that run with administrator rights.

Sensitivity sets how much evidence is enough. Balanced is the default. High reacts on less evidence, which means sooner, with a slightly higher chance that a heavy but harmless job sets it off. Low waits for stronger evidence. A touched decoy file raises the alarm at every level.

03The first ten seconds, in our example

Here is how an incident unfolds, step by step. The timings come from our example, a test program called InvoiceViewer.exe; they are an illustration, not a promise, and real timings depend on the PC and on the program.

1. 0.00 s
   The first signal. InvoiceViewer.exe, opened from Downloads, renames a document in Documents to a new .locked extension. One rename is not an alarm, but the shield starts counting.
2. 0.42 s
   The alarm. More files take the same extension, their contents turn random and a hidden decoy file is touched. The total crosses the line: in our example, 420 milliseconds after the first signal.
3. 0.60 s
   Paused. In our example 180 milliseconds later, the program and everything it started are paused: frozen, not killed, so nothing is lost if it turns out to be innocent. Critical Windows processes are never paused.
4. 0.60 s
   MoLock locks. The screen locks, so the decision waits for you, the owner, and nobody else at the keyboard can wave it through.
5. seconds
   You are told, everywhere. "Ransomware stopped: InvoiceViewer.exe changed 23 files (.locked), touching a decoy file. Paused." The alert reaches your phone and your dashboard with Kill and Allow.
6. 10 s
   You decide. You press Kill on your phone. The program is ended, and for the 23 files it reached first, the snapshots are waiting.

04Kill or Allow: you decide, from anywhere

After the pause, the shield does not guess. It asks you. The alert, titled Ransomware stopped, says which program it was, how many files it changed, to which extension and which signals it saw. It goes to the channels you have chosen for your account: push notifications on your phone or browser, email, your Telegram bot and the dashboard at 7ot.app. On the PC itself, the same choice appears as soon as you unlock MoLock.

• Kill ends the paused program and everything it started.
• Allow lets it carry on and adds it to your allowed programs, by its publisher's signature or, for an unsigned program, by that exact file's fingerprint, so a modified copy is not allowed by mistake.
• No answer keeps the program paused until you decide. If you prefer, choose to end it automatically after 10 minutes without an answer.

A PC with no MoLock Account but with a personal Telegram bot still gets the alert, sent by the PC itself.

Allowed programs are never paused. Backup and sync apps, built-in archivers, developer tools and photo apps legitimately rewrite many files at once, so MoLock recognises them by their publisher or by where they are installed and leaves them alone; a burst of activity from one of them is simply noted as harmless. Your own additions join that list. Programs are added on the PC, because MoLock needs the program itself; from the dashboard you can remove entries.

05Snapshots and Restore my files

Even a pause within a second means some files may already have changed: 23 in our example. That is why the second half of the shield is recovery. With the guard service, MoLock keeps rolling snapshots of your protected folders, using the restore point technology built into Windows. By default it takes one every 4 hours and keeps the last 7; you can choose every 2, 4, 6, 12 or 24 hours and keep anything from 3 to 30. When the oldest one rolls off, only MoLock's own snapshots are ever removed. You can also ask for a snapshot right now, from the PC or from your dashboard.

The Restore my files wizard walks you through it. Pick a folder or individual files, choose a snapshot by its time, preview what is inside, then restore either to the original place or to a copy. When you restore to the original place, today's versions are moved aside first, so a restore never destroys anything: if you picked the wrong snapshot, today's files are still there.

06Folders, sensitivity and Windows' own protection

• Folders. The four default folders cover most people. Add others on the PC, such as a work folder on a second drive, and exclude folders where a legitimate tool churns through files all day.
• Responses. Choose whether the shield pauses the program by itself or only warns and locks, whether it locks MoLock on detection, and whether decoy files and snapshots are on. Turning decoys off removes them from your disk.
• Controlled folder access. Windows has its own feature that stops unknown apps from changing protected folders. It is strong, and it sometimes blocks apps you meant to use. MoLock shows whether it is on, in audit mode or off, counts it in Security health and takes you to the right Windows page; switching it on is done at the PC, because Windows asks you there. Both protections can run side by side.

07One Security health page

Ransomware is one risk among several, so MoLock 3.1 brings everything to one page: Security health. It gives the PC a score from 0 to 100 with a grade: A from 90, B from 75, C from 60, D from 40, and E below that.

Each item is marked fine, worth a look or needing attention, with a plain explanation. Fix all fixes what MoLock can fix by itself; the rest are marked either "needs you at the PC", when Windows must ask you directly, or "decide", when an attack is waiting for Kill or Allow. You can ignore an item you have chosen to live with, and it stops counting. An area you have not set up, such as Passwords before you start using MoLock Keys, is left out of the score rather than counted as zero.

The page re-checks itself every 30 minutes and keeps a 30-day history, and the same picture appears in your dashboard, sealed with end-to-end encryption on its way there. Ask your bot for a summary and you get one line, such as "Security score 78/100 (B), 6 items need attention".

08The honest limits

• No tool stops everything. A careful attack that works slowly, or one that does its damage before the signals add up, can get further. The shield is a strong layer, not a guarantee, and it is not an antivirus: keep Windows Security on.
• Some files may change before the pause. That is exactly why snapshots exist.
• Snapshots need the guard service. Without it, detection and pausing still work, but there are no snapshots, the shield is less exact about which program is responsible, and it cannot pause programs that run as administrator.
• Snapshots are not a backup. They live on the same PC. A failed, lost or stolen disk takes them along. Keep an offline backup too, for example on an external drive that you unplug when the backup is done.
• False alarms can happen. An unfamiliar tool that rewrites many files at once can look like an attack. Allow it once, and it is remembered.

09Questions people ask

Do I have the guard service?

MoLock's standard setup installs it, as described in Safer installs. If it is missing, Security health says so and shows you how to fix it.

What happens if I am away when it fires?

The program stays paused and MoLock stays locked until you decide, from the PC or from your phone. If you chose to, it is ended after 10 minutes without an answer.

Where should I start?

Open Security health, press Fix all and work down the rest. Then set up an offline backup; everyday privacy habits has a short plan for the bad day. Everything about the shield is on one page at ransomware shield.