ShadowGuard provides you with the means to stop malware or ransomware from deleting your Windows shadow copies.

Shadow Copies are included in Microsoft Windows, they create backup copies or snapshots of files and volumes, it is implemented as a Windows service called the Volume Shadow Copy service.

Upon ShadowGuard making a detection, like the presence of ransomware that actively searches and deletes shadow copies, for instance, ShadowGuard will prevent those commands from execution and will terminate the application that initiated the commands. It works by attaching itself as a debugger to certain processes, filtering out any destructive commands prior to the process being created.

ShadowGuard actively maintains an allowed programs list that prevents those specific programs from being terminated; this will be essential for some backup applications which may use vssadmin.exe to manage volume shadow copies.

ShadowGuard is straightforward to use; you have three options selectable via a checkmark. Once you have made your selections, you can close out of the app as it doesn't need to be running to operate.

ShadowGuard can currently attach to:

powershell.exe
wmic.exe
vssadmin.exe

Similar:
What's the Best Antivirus and Is Windows Defender Good Enough?
How to Tell the Difference Between a Virus and a False Positive
Which Anti-Malware App Is Best and Can It Run Alongside My Antivirus
What to Do When Your Norton or McAfee Antivirus Expire

  Download