Can Antivirus Prevent Ransomware?

Eric C.
BY: Eric C.
Posted: October 28, 2018

Can antivirus really prevent ransomware? Yes, and no. It can prevent many types of ransomware, but it can’t stop it once it’s taken control of your system. However, antivirus programs are evolving to overcome the threat.

Ransomware works a lot differently than traditional viruses, attacking your important files by holding them hostage with encryption. The hackers try to extort money to set them free. These types of attacks are most commonly used against large businesses and individuals with valuable data, but anyone could potentially become a victim.

Hackers are interested in restricting your access to valuable data so education, government, energy and utilities, and healthcare continue to be the hardest hit industries. Some experts have described these attacks as the biggest current cybersecurity threat. In the last year alone, ransomware attacks grew by over 250% and cost businesses an estimated $5 billion.

Yet, these attacks cost more than just money. They also lead to the loss of important data, costly downtime, and decreased productivity.

Where Does It Come From?

Ransomware infects your computer like most viruses: opening an email attachment, downloading a suspicious file, or visiting a website that has already been infected. The only way to stop ransomware is to have an up-to-date antivirus.

However, the sophistication and evolution of ransomware viruses make them difficult to detect. With ransomware constantly changing, it’s difficult for some antivirus programs to pick them up until it’s too late.

Types of Ransomware

There are several common forms of ransomware. Each of them functions in the same way, with the major difference being their approach.

Locker ransomware is considered to be the first type ever discovered. As its name suggests, it locks users out of their computers and demands some form of payment. This is one of the most debilitating versions as it often requires a system wipe to remove. Unfortunately, paying the ransom doesn’t always save you; some hackers have embedded password-stealing software even once the ransom has been paid.

Crypto ransomware’s key difference is that payment is demanded in the form of a cryptocurrency. Hackers often lock the user’s files and demand payment through an anonymous cryptocurrency address.

Mac ransomware is a form of ransomware for Mac computers. The first known case of it, referred to as KeRanger, appeared in 2016. This version would wait three days before encrypting 300 files. At that point, it would create a text file demanding a single Bitcoin.

How Antivirus Detects Ransomware

Known forms of ransomware are often easy for your antivirus to detect. Why? It’s all based on how ransomware behaves. Typically, your antivirus will notify you when something is trying to encrypt files out of nowhere.

Your antivirus works by constantly asking you which programs are safe, telling you about suspicious ones, and learning from the orders you give it. When a file becomes encrypted, or if subtle, uncommon changes are made to a file, your antivirus will let you know. Because of this, known ransomware is fairly easy to detect.

However, when it comes to 2nd generation ransomware, it’s a bit more difficult. Hackers are starting to employ methods that are difficult for antivirus programs to pick up.

Here’s what Cisco had to say about it:

“Many ransomware operations also have development teams that monitor updates from antivirus providers so that the authors know when a variant has been detected and it’s time to change techniques. Adversaries rely on the cryptocurrency bitcoin for payments, so transactions are more difficult for law enforcement to trace. And to maintain a good reputation in the marketplace—that is, being known to fulfill their promise to give users access to their encrypted files after the payment has been processed—many ransomware operators have established elaborate customer support operations.”

The average computer user doesn’t have the resources to take on challenges like this. They rely on their antivirus to protect them, but what should they do when even that isn’t enough?

Stopping Ransomware Before It Infects

Being proactive is still the best defense against ransomware. New updates try to combat the known versions of ransomware. And while we can’t predict what the future holds, you can protect yourself by exhibiting safe browsing practices.

Still, that doesn’t mean you shouldn’t install an antivirus.

Some popular options include:

Many of these programs are capable of detecting known ransomware. It’s important that you take the right steps to reduce your chances of getting infected.

Remember, it’s easier to stop something before it starts. Once ransomware takes over your computer, removing it can be really difficult and result in data loss.

Other Ways to Combat Ransomware

We already know that antivirus is the best way to protect your computer. But we also know that ransomware doesn’t play by the same rules.

So, here’s what you really need to do:

Back up your files on an external hard drive, or in the cloud. This simple step is one of the easiest ways to overcome ransomware. If your files can be retrieved and installed on a new machine, hackers have no way to gain leverage over you. Problem solved.

Think about it like this: Would you rather pay a small fee for cloud storage each month, or risk a hacker demanding $5,000 to release your important files? Backing your files up on the cloud is a lot like buying insurance on your house or car. You may never need to restore your files, but you’re going to be really happy you did should that need arise.

The Best Defense against Ransomware Is You

Like any virus, you have to make a mistake for ransomware to infect your machine. So instead of clicking every link you see, you need to:

  • Think about the links you are clicking
  • Make sure you only browse safe websites
  • Keep your antivirus up to date
  • Change your antivirus if it doesn’t have ransomware protection
  • Back your files up using an external hard drive or in the cloud

Your antivirus will be able to protect you from basic, known forms of ransomware. With the rise in popularity of ransomware attacks, antivirus companies are working hard to increase detection and protection. But they have a long way to go before we can declare ransomware a thing of the past.

If you want to improve your security, practice safe browsing habits and take the necessary steps to keep your data safe and backed up.

About the Author

Eric C.
Eric C.

Eric is a professional copywriter with over 7 years of experience writing on marketing and tech topics. In recent years, he has focused heavily on the rapidly developing security, fintech, and cryptocurrency industries.