Ransomware Protection

Ransomware Protection prevents the unauthorized modification or encryption of files on OfficeScan agents by "ransomware" threats. Ransomware is a type of malware which restricts access to files and demands payment to restore the affected files.

You can configure Behavior Monitoring to detect a specific sequence of events that may indicate a ransomware attack. After Behavior Monitoring matches all of the following criteria, OfficeScan terminates and quarantines the offending program:

  1. A process not recognized as safe attempts to modify, delete, or rename three files within a certain time interval.

  2. The process attempted to modify a protected file extension type


OfficeScan cannot recover the first files affected by the ransomware process.


To reduce the chance of OfficeScan detecting a safe process as malicious, ensure that the OfficeScan agent has Internet access to perform additional verification processes using Trend Micro servers.