eSecurityPlanet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Ransomware is everywhere these days, striking fear into the hearts of IT and business managers alike.
And studies support that perception, showing ransomware growing in both prevalence and effectiveness. Recent research by Positive Technologies looked at the cyber threat landscape during Q2 2021 and found that ransomware attacks reached “stratospheric” levels, accounting for 69% of all malware attacks, a huge jump from 39% in Q2 2020.
Attacks against corporate assets like servers and network equipment are growing. QNAP network drives, used to aggregate large amounts of data from companies and individuals, faced a growing number of attacks.
Email was the main method of spreading malware in organizations (58%), followed by compromise of computers, servers and network equipment (33%).
All this adds up to bad news for IT teams in just about every vertical. Employee training, patching and multiple layers of defense remain critically important. But more and more, organizations need to plan for the possibility that the worst may happen – and that involves ransomware-proof backups and ransomware removal tools and services. Here we’ll focus on removal tools; for services, see Best Ransomware Removal and Recovery Services.
Best Ransomware Removal Tools
We reviewed a large number of ransomware removal, blocking and prevention tools to come up with the following list. Many are enterprise-grade tools, but a couple are consumer-focused ones that may work well for smaller teams or remote branches, and in areas where IT support isn’t all it should be.
McAfee
McAfee – now under the Trellix name after merging with FireEye, although McAfee’s cloud products will become a separate company – applies various preventative pre-execution models and layers them over intelligence signals to prevent ransomware infections. Prevention typically also relies on blocking tools utilized in early stages of the infection cycles based on initial vector identification. In the event that ransomware does make it through, there are a number of behavioral and technique-based heuristics for early identification of ransomware as well as deception techniques that serve as a deterrence and minimize impact.
McAfee’s Key Features
- Ability to utilize a gamut of sensor signals from various vantage points, which include URL protection, exploit prevention, heuristics (static and dynamic), machine learning at the end point and in the cloud, as well as behavioral and deception based approaches
- Roll–Back Remediation, via MVISION Unified Cloud Edge (a unified CASB and SASE offering), as a mechanism to recover from ransomware infection
- Protect against cloud threats and misconfiguration
- Enforce data loss prevention (DLP) policies on data in the cloud
- Prevent unauthorized sharing of sensitive data
- Detect compromised accounts, insider threats, and malware
- Gain visibility into unsanctioned applications and control their functionality
- Audit for misconfiguration against industry benchmarks and automatically change settings
EnigmaSoft
SpyHunter by EnigmaSoft detects threats such as malware and ransomware on a system and claims to remove any traces of them. It even provides a free ransomware removal tool, although it comes with a few conditions that may tempt the user to opt for the paid version.
EnigmaSoft’s Key Features
- Free Remover allows one remediation and removal for results found
- Rapid malware scan for quick and easy detection of threats
- Enhanced multi-layer scanning with vulnerability detection
- Integrated one-on-one Spyware HelpDesk support
- Scan for, identify, remove, and block malware
- Adapt and update as malware continues to evolve and become more sophisticated to evade detection by antimalware/antivirus programs
- Can remove trojans, ransomware, worms, viruses, rootkits, adware, potentially unwanted programs, and other objects
- Scans to identify programs on systems that may contain reported vulnerabilities
Kaspersky
Kaspersky has a No Ransom site that offers the latest decryptors, ransomware removal tools, and information on ransomware protection (Europol also operates a free decryption tool site). These are available free. The company also offers a total security suite which includes these services and endpoint detection and response (EDR) functionality.
Kaspersky’s Key Features
- Protection against hackers, viruses and malware
- Payment protection and privacy tools that guard from every angle
- Free VPN with up to 300 MB of traffic per day
- Free Kaspersky Password Manager Premium
- Offers a long list of decryptors, including those for shade, rakhni, rannoh, CoinVault, wildfire, and xorist
- Blocks common and complex threats like viruses, malware, ransomware, spy apps, and other hacker tricks
- Locates device vulnerabilities and threats
- Blocks cyberthreats before they take hold
- Isolates and removes immediate dangers
TotalAV
TotalAV offers several tools with ransomware protection, including WebShield and the TotalAV Total Security suite. They provide a first line of defense against fake, scam, phishing and spoofed websites, created to harm devices, compromise security, and even steal personal information.
TotalAV’s Key Features
-
Multi-device compatibility for Windows, Mac, iOS and Android devices
-
Blocks ads, pop ups, and notifications
-
Checks downloads, installs, and executables for viruses and threats
-
Scan scheduling
-
Monitors email addresses and notifies about potential compromise
Sophos
The Sophos Virus Removal Tool detects all types of malicious software, including viruses, spyware, rootkits, ransomware and Conficker and returns systems to a working state. It has direct access to virus data from SophosLabs, a global network of threat researchers, ensuring that even the latest viruses are detected and removed.
Sophos Key Features
- Free download that runs on the desktop
- Has more than 100 million global users
- Includes the same security features available in Sophos Enduser Protection
- User memory scanning and cleaning
- Kernel memory scanning and cleaning
- File scanning
- Identifies and removes malware from a single endpoint
Norton
Norton offers multiple layers of protection for devices and online privacy for small groups. It uses an annual subscription model. Products range from antivirus protection that also picks up ransomware, to full security suites that bundle in AV, ransomware protection and a lot more.
Norton’s Key Features
- Real-time threat protection against existing and emerging malware threats to devices
- Secure VPN to enable browsing anonymously and securely with a no-log feature
- Bank-grade encryption to help keep information like passwords and personal details secure
- Dark web monitoring
- Password management that stores and manages passwords, credit card information and other credentials
- Automatic, secure 50 GB cloud backup
BitDefender
Another one that is way more than a dedicated ransomware removal tool. It is a suite of security tools and remedial actions that is good for a team of up to 10 people. In addition to malware detection and removal, it offers unlimited VPN traffic and priority support.
BitDefender’s Key Features
- Detection to stop sophisticated cyber threats
- Multi-layer ransomware protection to keep files safe
- Unlimited, secured VPN traffic for online privacy
- Minimal impact on system performance
- Real-time data protection
- Network and advanced threat protection
- Web attack prevention
- Anti-phishing, spam and fraud prevention
Malwarebytes
Malwarebytes Endpoint Detection and Response fights ransomware at every stage of the attack chain with a blend of signature and signature-less technologies.
Malwarebytes Key Features
- Proactively detects and blocks attempts to compromise application vulnerabilities and remotely execute code on the endpoint
- Leverages machine learning, which has been deployed with a new aggressive anomaly detection model to identify suspicious executables
- Ransomware Rollback technology winds back the clock to negate the impact of ransomware by leveraging just-in-time backups
- Risk exposure information, including the basic steps to protect a business from ransomware through education
- Offers best practice recommendations to keep ransomware from harming systems
- Linking engine remediation
ID Ransomware
This tool identifies which ransomware has encrypted the data. This service is strictly for identifying which ransomware type may have encrypted your files. It will attempt to point you in the right direction, and let you know if there is a known way of decrypting your files. This one won’t necessarily remove everything, but it helps in discovering what is going on and who is behind the attack.
ID Ransomware Key Features
- Uploaded files are immediately analyzed against the database of signatures
- If results are found, they are immediately deleted
- If no results are found, the uploaded files may be shared with malware analysts to help with future detections or identifying a new ransomware
- Data is uploaded to the server over SSL, meaning the connection cannot be intercepted by a third-party
WatchGuard
WatchGuard’s endpoint security platform delivers protection with minimal complexity via an endpoint protection platform (EPP) and an endpoint detection and response (EDR) approach. The company acquired Panda Security more than a year ago and has integrated its endpoint security products into the WatchGuard Cloud management and visibility platform.
Watchguard’s Key Features
- WatchGuard Total Security Suite, available with all Firebox appliances, provides defenses against malware and ransomware
- Security controls such as WebBlocker, APT Blocker and Host Ransomware Prevention detect and prevent common methods of ransomware attacks
- DNS filtering
- A range of firewall appliances that include ransomware protection
Further reading:
Best Backup Solutions for Ransomware Protection
Could You Be a Ransomware Target? Here’s What Attackers Look For
