CryptoGuard, the World's First Anti

CryptoGuard, the World's First Anti-Ransomware

The exclusive Risk Reduction features of HitmanPro.Alert include behavior-based protection against high-impact crypto-ransomware, a prolific threat that slips by web filters and antivirus defenses every day. This type of infection—also generalized as cryptolocker—goes after images, documents, and other personal and critical data on local disks and networked drives. Cryptolocker malware encrypts the computer files of its victims victims and demands ransom money for the decryption key.
The signature-less operation of HitmanPro.Alert’s CryptoGuard technology universally prevents spontaneous encryption of data by cryptolockers. Even when trusted files or processes are hijacked for unsolicited encryption—as observed in cryptolockers "VaultCrypt", "CryptoWall" and "CTB-Locker"—it is stopped and reverted by HitmanPro.Alert, without interaction from users or IT support personnel.


CTB-Locker Ransom Note
CryptoWall 3.0 Ransom Note

So how do you prevent your files from being held hostage?

Since malware authors are very creative with code packers and polymorphic engines we see that new, early-life or zero-hour versions of ransomware cannot be timely detected using just antivirus signatures. We've also seen ransomware use code injection and hollow process techniques to hide inside legitimate processes. Think of Explorer.exe or Winword.exe encrypting your documents and files for ransom money.

Update: Crypto-ransomware has adopted these techniques to bypass static group policies-based preventions. The following prevalent crypto-ransomware abuses legitimate trusted processes to maliciously encrypt your documents, pictures and other data:

CTB-Locker performs encryption from C:WindowsExplorer.exe
CryptoWall 3.0 performs encryption from C:WindowsSystem32svchost.exe
VaultCrypt performs encryption from C:WindowsSystem32cmd.exe

HitmanPro.Alert introduces CryptoGuard

We''ve designed our CryptoGuard technology to stop prevalent and future crypto-ransomware. It does not try to detect this malware based on its static properties, but it detects crypto-ransomware based on its file system behavior. If suspicious behavior is detected, it is then blocked (the encryption of the files) and the malware is neutralized, without the need for any user intervention. The benefit of this solution is that it is much harder for a malware-author to radically change its behaviour (taking the files hostage) than it is to change its static properties, i.e. where it is located and how the physical code is structured. CryptoGuard offers a more universal and future proof solution.

CryptoGuard works silently in the background at the file system level, keeping track of remote computers and local processes that are modifying your documents and other files.


Download Now




After installing HitmanPro.Alert, CryptoGuard is automatically enabled to protect your data.
If you want to change any settings regarding CryptoGuard, follow these steps:

Open HitmanPro.Alert
Click on the gear icon on the top right corner
Select Advanced interface
Click on the orange tile called Risk Reduction
Select CryptoGuard

What do you see when your files are under attack?

When CryptoGuard intercepts an attack on your personal files, it displays an Attack Intercepted message as shown below:



When the above alert is displayed, the malicious process is neutralized. It can no longer harm your files.

The Technical details can show you how the attack took place. The Process Trace in the example screenshot shown above reveals that a file called fax-message674-109-802.scr was responsible for attacking your data through the legitimate Windows file C:WindowsSysWOW64svchost.exe. HitmanPro.Alert also records this event, including the technical details, in the Windows Event Log.

Kết quả (Việt) 1:

CryptoGuard, của thế giới đầu tiên Anti RansomwareSử dụng các tính năng giảm nguy cơ độc quyền của HitmanPro.Alert bao gồm các hành vi dựa trên bảo vệ chống lại ảnh hưởng cao crypto-ransomware, một mối đe dọa prolific phiếu bởi bộ lọc web và chống vi-rút bảo vệ mỗi ngày. Đây là loại nhiễm trùng — tổng quát cũng như cryptolocker — đi sau khi những hình ảnh, tài liệu và dữ liệu cá nhân và quan trọng khác trên đĩa và ổ đĩa mạng. Phần mềm độc hại Cryptolocker mã hóa các tập tin máy tính của nạn nhân nạn nhân của nó và yêu cầu chuộc tiền cho chìa khóa giải mã.Chữ ký-ít hoạt động của HitmanPro.Alert của CryptoGuard công nghệ phổ ngăn ngừa tự phát mã hóa dữ liệu bằng cryptolockers. Ngay cả khi tập tin đáng tin cậy hoặc các quá trình đang bị tấn công để mã hóa không được yêu cầu — như quan sát thấy ở cryptolockers "VaultCrypt", "CryptoWall" và "CTB-Locker" — nó dừng lại và trở lại khách sạn là HitmanPro.Alert mà không cần tương tác người dùng hoặc nó hỗ trợ nhân viên.CTB-Locker tống Tống CryptoWall 3.0Vậy làm thế nào làm bạn ngăn chặn các tập tin của bạn được giữ làm con tin?Kể từ khi tác giả phần mềm độc hại là rất sáng tạo với mã packers và bướu chúng ta thấy rằng phiên bản mới, cuộc đời hay 0 giờ của ransomware không thể kịp thời phát hiện sử dụng chữ ký chỉ cần chống vi-rút. Chúng tôi cũng thấy ransomware sử dụng tiêm mã và rỗng quá trình kỹ thuật để ẩn bên trong quá trình hợp pháp. Hãy suy nghĩ của Explorer.exe hoặc Winword.exe mật mã hóa các tài liệu và tập tin của bạn cho tiền chuộc tiền.Update: Crypto-ransomware has adopted these techniques to bypass static group policies-based preventions. The following prevalent crypto-ransomware abuses legitimate trusted processes to maliciously encrypt your documents, pictures and other data:CTB-Locker performs encryption from C:WindowsExplorer.exeCryptoWall 3.0 performs encryption from C:WindowsSystem32svchost.exeVaultCrypt performs encryption from C:WindowsSystem32cmd.exeHitmanPro.Alert introduces CryptoGuardWe''ve designed our CryptoGuard technology to stop prevalent and future crypto-ransomware. It does not try to detect this malware based on its static properties, but it detects crypto-ransomware based on its file system behavior. If suspicious behavior is detected, it is then blocked (the encryption of the files) and the malware is neutralized, without the need for any user intervention. The benefit of this solution is that it is much harder for a malware-author to radically change its behaviour (taking the files hostage) than it is to change its static properties, i.e. where it is located and how the physical code is structured. CryptoGuard offers a more universal and future proof solution.CryptoGuard works silently in the background at the file system level, keeping track of remote computers and local processes that are modifying your documents and other files.Download Now After installing HitmanPro.Alert, CryptoGuard is automatically enabled to protect your data.If you want to change any settings regarding CryptoGuard, follow these steps:Open HitmanPro.AlertClick on the gear icon on the top right cornerSelect Advanced interfaceClick on the orange tile called Risk ReductionSelect CryptoGuardWhat do you see when your files are under attack?When CryptoGuard intercepts an attack on your personal files, it displays an Attack Intercepted message as shown below:When the above alert is displayed, the malicious process is neutralized. It can no longer harm your files.The Technical details can show you how the attack took place. The Process Trace in the example screenshot shown above reveals that a file called fax-message674-109-802.scr was responsible for attacking your data through the legitimate Windows file C:WindowsSysWOW64svchost.exe. HitmanPro.Alert also records this event, including the technical details, in the Windows Event Log.