Frequently Asked Questions (FAQ)

This is a UI loading error. Follow these steps to resolve it:

• Open the web console in Incognito mode or another browser. Check whether the issue persists.
• Clear the browser cache and cookies.
• If the console still fails to load, check whether other administrators have the same issue.
• You can also try reinstalling Chrome.

The policy placed higher in the Priority Order takes precedence. When policies assigned to the same target have conflicting settings, Ransomware Protection Plus resolves the conflict based on this priority hierarchy.

Yes. The updated settings apply to all endpoints unless a higher-priority policy overrides those settings on an endpoint.

No. The default policy cannot be deleted.

The policy takes effect roughly 90 minutes after deployment. Until the policy syncs, the endpoint uses its previous policy settings.

The system automatically uses the next-highest policy in the Priority Order to determine which settings apply to the endpoints.

Follow the steps on this page to run the Ransomware Simulator.

Decoy files protect endpoints against ransomware and add a layer of protection. All managed endpoints contain a set of decoy files that serve as bait. Suspicious activity, such as decoy file encryption, triggers an immediate alert for a possible ransomware attack. Based on studies of ransomware attacks, we placed these files in selected folders across all managed endpoints. If the decoy files are encrypted, the administrator receives timely alerts to respond and mitigate the attack promptly. The bait files' names are "database.docx", "ME.txt", and "screenshoot.jpg".

Decoy/Bait file based detection is one of the several detection methods used by Anti-Ransomware. The core detection engine uses behavior-based ransomware motive detection and four patented layers that improve accuracy. For more information, see this page.

File-less attacks are difficult to detect because they leave little or no trace on the system. Anti-Ransomware's patented ML-assisted behavior detection technique can detect these attacks on the network.

No. Anti-Ransomware does not scan systems periodically. It analyzes and monitors systems in real time to detect and report ransomware attacks as quickly as possible.

Anti-Ransomware consumes no network bandwidth. Unlike other cloud-based EDR and Anti-Virus solutions, it does not need to fetch signature database files frequently. This reduces network traffic.

Anti-Ransomware uses anti-hook and anti-kill methods to prevent users from killing the agent.

Microsoft's Volume Shadow Copy Service (VSS) creates shadow copies of the data stored on your device every three hours. The recovered file comes from the most recent backup cycle and can be 3 hours old.

Backup files are stored on the endpoint's hard disk. Patented tamper-proof technology protects these files.

By default, 10% of the disk space is used by the Windows VSS Service for backup functions.

When Shadow Storage reaches its capacity, it deletes the oldest shadow copy to make room for the new one and optimize storage usage.

No major conflicts are expected. It is designed to coexist with other VSS-based applications, including backup solutions. The only enforced restriction is that other applications cannot reduce the VSS storage allocation below 10% on protected volumes.

You can restore files encrypted by ransomware if a backup is available, even if the incident did not trigger an alert.

All false positives are added as exclusions. These exclusions apply globally to all endpoints managed under Malware Protection. Learn More

Exclusion rules sync to the endpoint at the next agent refresh cycle (default: ~90 minutes).

If this error appears when marking an incident as a false positive:

1. Verify that the exclusion matches the detected executable. Record its hash, path, and settings.
2. If it doesn't match, delete the matching exclusion and re-create it with the same settings.
3. Try marking the alert as False Positive again. If the error persists, collect agent logs and contact support.