Pause the attack. Bring your files back.
Ransomware scrambles your documents quickly — and that speed gives it away. MoLock's shield watches your folders and hidden decoy files, pauses the program as soon as the evidence adds up, locks MoLock and asks you: Kill or Allow, from the PC or your phone. With the guard service, rolling snapshots let you restore what changed. And one Security health page scores the whole PC from 0 to 100.
New in 3.1FreeFree on every plan · runs on your PC · snapshots use the guard service
Paused09:40:12
We paused a program that was encrypting your files
- InvoiceViewer.exeChanged 23 files to .locked and touched a decoy filePaused
- Where it came fromDownloads\InvoiceViewer.exeUnsigned
- Detected → pausedin our example420 + 180 ms
Kill itI trust it — Allow
MoLock locked, and the alert reached your phone and dashboard
6 items need attention · 2 fix themselves
Fix all- PC health87
- Ransomware shield85
- Privacy74
- Passwords62
- Network safety90
- Updates100
- Vault40
- Folders watched by default4
- Snapshot every4HOURS
- Snapshots kept7DEFAULT
- Security health areas7
01 / 09How it works
Notice. Pause. Let you decide.
The shield doesn't need to know a program's name. It watches for what ransomware can't avoid doing — and every step happens on your PC, even without internet.
- 01Step 1/4
It watches your folders
Documents, Desktop, Pictures and Downloads by default, plus any folders you add — with hidden decoy files that no normal program has a reason to touch.
- 02Step 2/4
It pauses the program
When renames, scrambled files, ransom notes or a touched decoy add up, the program and everything it started are paused — not killed — and MoLock locks.
- 03Step 3/4
You choose: Kill or Allow
“Ransomware stopped” reaches your phone, your bot, email and the dashboard. Kill ends it; Allow resumes it and remembers it. On the PC, the choice appears once you unlock.
- 04Step 4/4
Restore my files
With the guard service, rolling snapshots of your protected folders are waiting. Pick a time, preview, and restore to the original place or to a copy.
02 / 09What it does
Watches behaviour. Acts in seconds.
Antivirus tries to recognise a harmful program before it runs. The shield takes the other road: it watches what is happening to your files and stops whoever is doing it.
Hidden decoy files
Randomised hidden files in your protected folders. Changing, renaming or deleting one is enough to raise the alarm.
Behaviour, not names
Bursts of renames to a new extension, files turned into random data, ransom notes in several folders — no list of known threats needed.
Knows who did it
With the guard service, Windows' own file activity records show exactly which program touched which file.
Paused, not killed
The program and everything it started are frozen, so nothing is lost if it was innocent. Critical Windows processes are never paused.
MoLock locks
The decision waits for you, the owner — nobody else at the keyboard can wave it through.
Alerts everywhere
Push, email, your bot and the dashboard, with Kill and Allow buttons. A PC without an account can still alert your personal Telegram bot.
Trusted programs left alone
Backup and sync apps, built-in archivers, developer tools and photo apps — plus your own list — are never paused.
Three sensitivity levels
Low, Balanced or High decide how much evidence is enough. A touched decoy raises the alarm at every level.
Ransomware shieldOn
- Protected foldersDocuments, Desktop, Pictures, Downloads and more5
- Hidden decoy filesRandom names and places10
- Restore snapshotsEvery 4 h · last at 08:006 / 7
- Guard serviceKnows which program changes filesOn
Balancedsensitivity0incidents this month
03 / 09Snapshots & restore
Some files may change. Snapshots bring them back.
Even a fast pause can come after a few files are scrambled. With the guard service, MoLock keeps rolling snapshots of your protected folders, using the restore technology built into Windows.
- Every 4 hours, keep 7The default — or every 2, 4, 6, 12 or 24 hours, keeping anything from 3 to 30. Only MoLock's own snapshots are ever removed.
- Snapshot nowAsk for one right away, from the PC or from your dashboard — before a risky install, for example.
- Restore my filesPick a folder or single files, choose a snapshot by its time and preview what's inside before anything changes.
- Original place or a copyRestoring to the original place moves today's versions aside first, so a restore never destroys anything.
Snapshots6 / 7
- Today08:00Chosen
- Today04:00
- Yesterday24:00
- Yesterday20:00
What to restore
- Documents23 files changed today
- PicturesUnchanged
To the original place · today's versions are moved aside first
RestorePreview
04 / 09Security health
One page. One score for the whole PC.
Ransomware is one risk among several. Security health brings seven areas into a single score from 0 to 100 with a grade: A from 90, B from 75, C from 60, D from 40 and E below that.
- Seven areas, weightedPC health 25 · Ransomware shield 25 · Privacy 15 · Passwords 15 · Network safety 10 · Updates 5 · Vault 5.
- Fix allFixes what MoLock can fix by itself. The rest says plainly whether it needs you at the PC, because Windows must ask you there, or a decision on a paused attack.
- Ignore what you acceptMark an item you choose to live with and it stops counting. An area you haven't set up, like Passwords before MoLock Keys, is left out instead of scored as zero.
- Windows' own folder protectionMoLock shows whether Controlled folder access is on, in audit mode or off, counts it in the score and opens the right Windows page for you.
- Re-checked every 30 minutesA 30-day history, and the same picture in your dashboard, end-to-end encrypted on the way. Ask your bot for a one-line summary.
6 items need attention · 2 fix themselves
Fix all- PC health87
- Ransomware shield85
- Privacy74
- Passwords62
- Network safety90
- Updates100
- Vault40
05 / 09Privacy
Decided on your PC. Sealed on the way out.
Every detection, pause and restore happens on your PC and keeps working without internet. What reaches your dashboard — the score, the shield status and recent incidents — is end-to-end encrypted with your account key.
Detection stays local
The shield reads activity on your PC. Your documents are never uploaded to be checked.
A sealed dashboard copy
Score, areas, shield status and the last incidents are encrypted before they leave, and opened only in your signed-in browser.
Snapshots stay home
Snapshots are made and kept on your own PC, with Windows' own restore technology.
Reaches your dashboard
- Score, grade and the seven areas
- Shield status: folders, decoys, snapshots
- Recent incidents and your decisions
Stays on your PC
- Your documents and their contents
- The snapshots themselves
- The names of the files that changed
To deliver alerts and answers
- The short alert you chose to receive: program and file count
- Your Kill or Allow answer, passed on to the PC
- That the security page updated, and when
06 / 09Dashboard & bot
Kill or Allow. From wherever you are.
The security page in your dashboard mirrors the PC, and the alert carries the decision with it. The PC acts on your answer as soon as it receives it.
- “Ransomware stopped”: Kill or Allow from the dashboard, your bot or a push notification. The program stays paused until you answer — or ends after 10 minutes, if you chose that.
- Snapshot now: ask the guard service for a fresh snapshot from the dashboard, before a risky install for example.
- Change sensitivity, decoys, the snapshot schedule and what happens without an answer. Allowed programs can be removed online; adding one happens on the PC.
Paused09:40:12
We paused a program that was encrypting your files
- InvoiceViewer.exeChanged 23 files to .locked and touched a decoy filePaused
- Where it came fromDownloads\InvoiceViewer.exeUnsigned
- Detected → pausedin our example420 + 180 ms
Kill itI trust it — Allow
MoLock locked, and the alert reached your phone and dashboard
07 / 09Limits
Exactly what it does. And what it doesn't.
A strong layer, not a guarantee
A slow, careful attack can get further. The shield is not an antivirus — keep Windows Security on.
Some files may change first
The pause comes once the evidence adds up, so a few files can already be scrambled. That is what snapshots are for.
Snapshots need the guard service
Without it, detection and pausing still work, but there are no snapshots, attribution is less exact and programs running as administrator can't be paused.
Snapshots aren't a backup
They live on the same disk, so keep an offline backup too. And a harmless tool that rewrites many files can look like an attack: Allow it once and it is remembered.
08 / 09Read more
In-depth guides. In plain words.
Ransomware protection, explained
Ransomware is fast, but it is also noisy. Here is what it does to a PC in its first moments, how MoLock notices the noise and freezes the program, and how you get your files back, with the limits stated plainly.
A password manager done right: inside MoLock Keys
Most accounts are not lost to clever hackers but to one password used in too many places. Here is how MoLock Keys fixes that habit without asking you to trust anyone with your passwords, and where its limits are.
Safer installs: Program Files and a launch password
A security app is only as strong as the place it lives in and the door that opens it. MoLock 3.0 moves into a protected folder, checks every update, and puts a password on its own front door.
09 / 09Questions
Ransomware shield & Security health
What does MoLock's ransomware shield do?
It watches your protected folders and hidden decoy files for what ransomware does: mass renames to a new extension, files turned into random data, ransom notes. When the evidence adds up, it pauses the program, locks MoLock and alerts you with Kill and Allow; with the guard service it also keeps rolling snapshots so you can restore what changed. It is free on every plan — the details are on the ransomware shield page.
Will the shield stop my backup or sync app?
No. Backup and sync apps, built-in archivers, developer tools and photo apps are recognised by their publisher or install location and are never paused. If the shield pauses a tool you trust, choose Allow: it resumes at once and joins your allowed programs — by its publisher's signature, or by that exact file's fingerprint when it is unsigned.
What happens if I'm away when the shield fires?
The program stays paused and MoLock stays locked until you decide. “Ransomware stopped” reaches the channels you chose, and you can Kill or Allow from the dashboard, your bot or a push notification — or on the PC once you unlock. If you prefer, have it ended automatically after 10 minutes without an answer.
Do I need the guard service?
Detection and pausing work without it, but the guard service is what makes snapshots, knows exactly which program touched which file from Windows' own records, and can pause programs running as administrator. MoLock's standard setup installs it; if it is missing, Security health tells you and shows how to fix it.
Are the snapshots a backup?
No. Snapshots live on the same disk, so a failed or lost drive takes them along. They are ideal for bringing back the few files that may change before the pause, but keep an offline backup too — for example on an external drive you unplug afterwards. And the shield is not an antivirus, so keep Windows Security on.
How is the Security health score worked out?
It combines seven weighted areas — PC health 25, Ransomware shield 25, Privacy 15, Passwords 15, Network safety 10, Updates 5 and Vault 5 — into a score from 0 to 100 with a grade from A to E. An area you haven't set up is left out rather than counted as zero, and an item you choose to ignore stops counting. Fix all repairs whatever MoLock can fix by itself.
Free · no ads
Try it on your PC today.
Windows 10 & 11 · works without an account; the dashboard is optional and free