Ransomware is a type of malicious program that encrypts many of your documents, such as text documents, photos, and videos, makes them inaccessible, and demands payment to provide a decryption key or a program to remove the Ransomware from the infected computer. If you are sitting in front of your PC, you will usually notice an infection quickly because a payment request to decrypt your files is typically displayed. If you run WebSite-Watcher 24/7 on a server or a separate PC, you may not immediately notice that something is wrong.

With the "Ransomware Detection" feature, WebSite-Watcher regularly checks whether a specific reference file has been changed or deleted. If this happens, you can receive a notification. This feature works only while WebSite-Watcher is running.

How does it work

When WebSite-Watcher starts, a unique RTF file is created on your hard disk. As long as WebSite-Watcher is running, this file is monitored for changes. If this file is changed or deleted, the following actions occur:

• WebSite-Watcher stops all running tasks, for example checking Bookmarks or sending emails.
• WebSite-Watcher locks and protects as many important files in the WSW folder as possible to reduce the risk of encryption. These files remain locked as long as WebSite-Watcher is running, for example Bookmark databases, configuration files, and AutoBackups.
• A window is displayed on top of all other applications.
• Optional alert by email. The message is sent immediately without being saved in an Outbox on your hard disk.
• Optional alert via Pushover. The push message is sent immediately without being saved in an Outbox on your hard disk.
• If you use the WebSite-Watcher App and check the special Bookmark WSW-for-Windows, you also receive a notification that your PC was infected with Ransomware.

How to test this feature

The "Ransomware Detection" configuration includes a button named "Test this feature...". When you click this button, the reference file is deleted after you close the program configuration. An alert should appear after a few seconds.

How secure is it

There is no guarantee that WebSite-Watcher can detect all types of Ransomware infections using this technique. WebSite-Watcher can detect an infection only if the reference file is changed, for example encrypted, or deleted, and only while WebSite-Watcher is running. WebSite-Watcher cannot stop the encryption of documents on your hard disk or prevent infection with Ransomware. If the RTF reference file is not encrypted or deleted, or if WebSite-Watcher is not running, the infection cannot be detected.