Ransomware Protection - FAQs

Ransomware refers to malicious software that can encrypt important files on your PC to make them inaccessible and then threaten to publish or delete your files until a sum of money (ransom) is paid. Even after paying the ransom, there is no guarantee that you can recover your files.

Ransomware Protection secures your personal photos, documents, and other files from being modified, deleted, or encrypted by ransomware attacks. This feature scans for and automatically secures folders that may contain personal data and allows you to specify other folders you want to protect from untrusted applications. Additionally, you can specify which applications are allowed to modify the files in your protected folders and which applications are always blocked. Ransomware Protection is enabled by default when you install Avast One.

Ransomware Protection automatically secures folders where you might store personal data, such as the Documents and Pictures folders. To manually add other protected folders:

1. Select Explore ▸ Ransomware Protection ▸ View protected folders.
2. Click + Protect a new folder, then select a folder and click OK.

To remove a folder, hover your cursor over the relevant folder's panel, click the X icon that appears, then click Yes, stop protecting.

Yes. Some common file types are automatically protected by Ransomware Protection, but you can change these settings and specify additional file types for protection.

1. Select Explore ▸ Ransomware Protection ▸ View protected folders.
2. Select the Advanced Settings tab.
3. Untick the box next to a file type to deselect it, or type a file extension into the text box below the list of protected file types.

Your changes are automatically saved.

To specify how Ransomware Protection handles attempts to access files in your protected folders:

1. Select Explore ▸ Ransomware Protection ▸ View protected folders.
2. Select the Advanced Settings tab.
3. Under the heading Select your preferred mode, choose from the following options:
   • Smart Mode (default and recommended setting): Ransomware Protection refers to a list of commonly used and trusted applications to determine which programs can modify files in your protected folders. If any applications that are not in this list attempt to modify files in your protected folders, you are notified and asked for permission.
   • Strict Mode: you are notified and asked for permission each time a new application attempts to modify files in your protected folders. Selecting this option may result in frequent and potentially annoying alerts.

To specify which applications Ransomware Protection allows or blocks:

1. Select Explore ▸ Ransomware Protection ▸ View protected folders.
2. Select the App permissions tab.
3. Click + Add application then select an app using either method below:
   • Select from list: Click Add next to the application you want to block or allow.
   • Select by location: Click Select app location, then locate the application on your PC and click Open.

The application is added to the app permissions list and the status is set to Blocked. To change the status to Allowed, click the red (Blocked) slider next to an application in the list so that it changes to green (Allowed).

To remove an application from the list, tick the box next to the relevant app, then click Remove app.

To learn more about how to use Ransomware Protection, refer to the following article:

• Ransomware Protection - Getting Started