The ransomware guard
A continuous job watches its own changes. When they look like ransomware, it stops saving, keeps the last good backup, and asks you what happened.
On this page
Ransomware encrypts your files and renames them, often within minutes. A backup that keeps saving every few minutes would save the encrypted copies too. The ransomware guard stops that: it looks at every point before saving it, and when the changes look like an attack, the job holds. Nothing of the attack is saved, the last good backup is kept, and GBM AI asks you what happened.
The guard is part of continuous protection (Pro and Server). It is on for every continuous job: Watch for ransomware on the Schedule step. See Continuous protection.
Knowing it is on#
The guard works quietly, and says so where you look:
- Home, under how your jobs are doing: Ransomware guard watching 2 jobs.
- The job lists on Home and Jobs: a small shield beside the name of each job it watches.
- The job's page, in Health: Ransomware guard: Watching. Every save is checked before it is kept. It says Holding while it holds the job, and Off when the job's guard is turned off.
- The wizard's last step and Genie's summary of a job: Ransomware guard: On.
When the Pro trial ends on Home or Free, a continuous job is saved every 15 minutes (hourly on Free) and the guard does not watch it: its row says Needs Pro. It watches again with Pro.
What it looks for#
Before each point is saved, the guard compares what changed with what this job usually sees:
| Sign | What it means |
|---|---|
| Far more changes than usual | More files changed within 10 minutes than ten times this job's busiest usual moments over the last week, and at least 200. After a time the job could not save (paused, its destination away, the PC asleep or off), the first point holds all that time's changes, so the limit grows with that time; a quiet time with nothing to save does not raise it. |
| Many files renamed to one new extension | At least 50 files, such as report.docx becoming report.docx.xyz. An extension added to the whole name is how ransomware works, and counts as a strong sign. |
| An extension ransomware uses | At least 10 files ending in one of about 60 extensions known from ransomware (.wncry, .locky, .lockbit...). A strong sign. |
| Ransom notes | One new file named like a note (HOW_TO_RESTORE.txt, RECOVER_FILES.html, DECRYPT.txt...) in at least 5 folders. Strong when its name says decrypt, or names a ransomware family (RyukReadMe.txt, akira_readme.txt). A plain README is not counted; one written like a shout (!!!READ_ME!!!.txt) is. |
| Documents turned into unreadable data | Documents changed in place whose start no longer matches their type (a PDF that does not start as a PDF, a Word file that is not a Word file), text files that became random bytes, and encrypted copies under an added extension (report.pdf.xyz). Many of them is a strong sign. Files that are new under their own names (a folder put back, a download) are not read. |
The job holds on one strong sign, or two others. A busy day does not hold it: importing hundreds of photos, extracting a large zip, or switching branches in git are normal changes.
When it holds#
- Saving stops for that job, and the changes wait. Nothing the attack wrote is saved.
- The last good backup is kept. Thinning and retention leave it alone until you decide.
- You are told: an alert in the GBM AI window that stays until you answer it on the card, a Windows notification, and an email and a webhook event (
ransomware.suspected) when those are set up. They follow Settings ▸ Notifications ▸ When files change like ransomware, on by default, whatever the failure switches and quiet hours say. The email names the signs, what to do first and the backup kept. While nobody answers, you are told again once a day (ransomware.reminder). - The job says Paused (Paused: changes look like ransomware when you point at it in the jobs list), in amber, and its page's Ransomware guard row says Holding, with the time of the backup it kept. Activity shows the point that was not taken as Held, with how many files changed and the card's two buttons. A hold is not a failure: it is not counted on the Activity badge or under Failures.
- Run now and Run as full (and Back up now in the notification-area menu) are off for the job until you answer: no backup of it is taken, a full one neither.
- The job stays held after a restart of the PC, until you decide.
Home and the job's page show a card: Files in Work changed in a way that looks like ransomware (Work being the job's name), with each sign on its own line and two buttons.
While the job holds, GBM AI keeps looking at the changes, without saving any of them. The card's counts follow, and it says whether files are still changing: Files are still changing: last change 1 min ago in red, then No changes for 12 minutes. That second line is the moment to put files back.
The card names a folder when its own changes look like ransomware: the files you go on working on elsewhere are not counted, and a folder made since the backup is named by the job's folder it is in. If nothing waiting to be saved looks like ransomware any more (you put the files back yourself, say), the hold ends by itself and the job saves again.
If it was ransomware: Put back…#
First, deal with the attack itself: disconnect the PC from the network and stop the program changing the files (run your antivirus, or ask your IT support). Wait until the card says No changes for a few minutes: a folder put back while the attack goes on is encrypted again. Then:
- Click Put back Documents… on the card (it names the folder the changes are in). When they are in several folders, Put back… asks which one first.
- The backup as it was before the changes opens at that folder, with its put back dialog open.
- In the dialog, Also move out the files added since is already ticked: the encrypted copies and the notes are files added since, and they go into a folder beside it, Documents (moved aside ...). Nothing is deleted.
- Click Put back.
When every folder the changes are in is back, the hold ends and the job looks at its files again. With changes in several folders, the hold stays until each is back, and the card names those still to do (Put back Photos…). If other folders still look wrong after that, it holds again and tells you; put those back too. Once you are sure, delete the moved aside folder. The guard leaves that folder out, and while the job held, its points leave it out too, so the attack's copies are never saved with your files.
See The restore timeline for everything Put back does.
If you made the changes: It was me#
Encrypting a folder yourself, converting a batch of documents, or renaming hundreds of files can look like an attack. Click It was me, then Yes, it was me. The next point saves the files as they are now, and the backup kept apart is treated like any other again.
It was me lets one point through. If you are still encrypting or converting files, tick For the next hour too: every change until then is saved as it is. After that, if the same thing happens again, the guard holds again.
If you switch Watch for ransomware off while a job is held, the hold ends and the job saves its changes as they are.
Turning it off#
Edit the job, and on the Schedule step untick Watch for ransomware. A job without the guard saves whatever changes, encrypted files included; its older points still let you go back.
What the guard cannot do#
The guard protects the backups, not the PC: it does not stop ransomware or remove it. It also cannot spot an attack that changes only a few files, slowly. Keep your antivirus on, and for a copy that nothing on this PC can reach, add a second copy or a bucket with Object Lock.