Panda Dome Ransomware and Data Protection

Start by separating five different data-protection jobs

“Data protection” is too broad to configure safely. Data Shield restricts which applications may modify selected folders and file types. Decoy Files are bait that helps behavioral detection notice destructive patterns. Protected Shadow Copies may give you local earlier versions. File Encryptor makes selected content unreadable without its key. File Shredder attempts to remove a selected local copy. Only a separate backup lets you rebuild after losing the endpoint.

This distinction prevents two dangerous assumptions: that an encrypted file can't be encrypted again, and that a local previous version survives every attack. It also explains why our broader Panda Dome review scores the suite separately from this operational guide.

Anti-Ransomware starts with Advanced, while encryption starts with Complete

Panda’s current consumer plan matrix places Anti-Ransomware and advanced-threat protection in Advanced, Complete and Premium. File encryption and sensitive-data deletion begin with Complete and carry into Premium. The current Panda Dome Complete page presents those tools together, but purchasing the larger bundle doesn't make every feature available on every operating system.

The workflows on this page are for Windows. Panda’s encryption page explicitly lists Windows, and the relevant data controls in the plan matrix carry Windows boundaries. A multi-device subscription can cover Macs and phones while exposing a different feature set on each. Don't tell a Mac user to hunt for a Windows-only Data Shield switch or assume that an Android subscription protects desktop project folders. Our Microsoft Defender review explains the Windows-native layer that remains present around a third-party suite.

Plan names, billing terms and regional availability can move. Our Panda plan comparison handles purchasing intent; this page assumes the Windows app already recognizes an eligible license. If a control is missing, verify the signed-in account, subscription tier, app version and OS before reinstalling or paying for an upgrade. Use the Panda activation and device guide when entitlement, seat assignment or account recognition is the real problem.

Open Anti-Ransomware and verify the state instead of trusting the plan name

An eligible subscription isn't evidence that the feature is active, healthy or protecting the intended data. Open Panda Dome on the Windows PC, confirm the dashboard shows current protection and updates, then enter the Anti-Ransomware/Data Shield area. Panda’s current Data Shield help documents the activation flow, protected folders, protected extensions, application permissions and the action for unknown applications.

Record the initial state before changing it: whether Anti-Ransomware is on, the current folder list, extension categories, allowed and denied programs, the “Allow safe applications to access protected data” choice, and whether an unknown app is denied or prompts. Take screenshots that contain no private filenames. That baseline gives you a rollback when an accounting tool, editor or backup client later fails.

Don't generalize a reviewer’s old first-run result into an August 2026 default. Fresh installs, upgrades, regional builds and imported settings can differ. Verify each PC. If the app can't update, the service won't start or the subscription is misidentified, solve that health problem first using our Panda installation and setup guide; policy tuning on a broken client produces misleading tests.

Inventory valuable data before choosing folders

Begin with the consequence of loss, not with Windows folder names. List family photos, tax records, creative projects, browser-exported archives, local mail, accounting data, password-vault exports, research notes, virtual-machine files and recovery codes. For each item, record its live path, file types, owning application, backup destination and acceptable data-loss window. A folder that changes every hour needs a different backup rhythm from a tax archive changed once a year.

My Documents is a useful default but it isn't a data map. Developers often store repositories elsewhere; photographers use secondary disks; accounting products may keep databases under ProgramData; mail clients and note tools may use hidden profile paths. Cloud-sync folders deserve care: synchronization can rapidly propagate encrypted or deleted files, while version history may or may not retain an earlier copy long enough.

Don't add an entire system drive just to feel covered. Very broad scope increases prompts and makes poorly understood processes part of every decision. Select meaningful data roots, then pair them with the exact applications that need write access. If you're preparing a new Windows machine, our Windows 11 antivirus guide covers the surrounding OS protections that remain relevant beside Panda.

Protect data roots, then test a harmless file in each one

Panda says My Documents is included by default and allows additional folders. Add the smallest stable root that contains a coherent dataset: for example, a client-project directory rather than the whole user profile. Include secondary internal volumes and attached data disks only when the current build exposes them and you understand their availability. A removable disk that's absent during configuration still needs its own backup plan.

For every protected root, create a harmless text file named clearly as a test, edit it with the normal application, save a second version and confirm the change. Then try a different nonessential application that shouldn't have write access. You're testing both halves: allowed work must continue, while an unapproved writer should be stopped or prompt according to policy. Never use live business data as the first experiment.

Revisit the scope after application migrations, drive-letter changes and cloud-client moves. A folder rule pointing to an old path can remain technically present while the real data now lives elsewhere. Keep a simple protected-data inventory outside the affected machine—preferably with the recovery documentation—so you can compare expected scope during an incident.

Default extension categories miss unusual but valuable formats

Panda’s help says Office documents, images, audio and video are included in the default extension categories. That covers common personal files, not every valuable format. Database files, CAD drawings, source trees, scientific datasets, raw camera formats, proprietary project bundles, email stores and virtual disks may use extensions outside the obvious groups.

Map extensions from the inventory, not from a generic list. Ask the owning application what it creates, then sample the real folder with Windows search or a file inventory. Include companion files when a project depends on several formats. A video editor may need project metadata and cache references as much as the exported MP4; an accounting database may be useless without its journal or index files.

More extensions aren't automatically better. Protecting executable, temporary and cache formats across a broad tree can create noise without saving recoverable user data. Prioritize irreplaceable content and the files necessary to open it. After adding a type, save, rename, export and autosave through the normal program. A setting that blocks autosave silently isn't a finished configuration.

Application access should follow the signed executable and its task

Data Shield permissions answer which program may modify protected data. Treat the full signed executable path and publisher as the identity, not merely the product name. An editor, database engine, synchronization client, backup agent and command-line automation may each need different scope. A helper process can perform the actual write even when the visible desktop app initiated it.

Panda’s “allow safe applications” option reduces interruptions by relying on the vendor’s classification. That's a usability tradeoff, not a proof that every allowed process is incapable of abuse. Keep application inventory current, remove software you no longer use and review broad permissions after major updates.

Deny unknown is stricter; Ask me is easier to diagnose

Panda documents two actions for an unknown application: deny it or ask the user. Deny limits unattended modification but can break a new, niche or freshly updated program without an immediate human decision. Ask exposes the decision at the moment of access, which helps learning and troubleshooting, but a hurried user can approve a malicious or misleading process.

Choose based on who operates the PC. A managed workstation with a stable application set can tolerate deny-unknown better than a family PC where new tools arrive weekly. An attentive technical user may prefer prompts during an initial learning period, then move stable workflows to explicit allow rules. Whichever mode you choose, a prompt isn't a reputation certificate: inspect path, publisher, requested action and whether you intentionally launched the program.

A Panda user discussion in r/antivirus describes aggressive deny-unknown behavior as useful but restrictive. That's directional usability evidence, not a controlled protection test. The practical lesson is to expect friction and document exceptions, not to turn a community preference into a universal default.

Decoy Files are behavioral tripwires, not copies of your documents

Panda’s Anti-Ransomware overview says Decoy Files are bait files. When a process modifies one, the event goes to the behavioral engine, which combines that signal with other detection technologies to determine whether the process is ransomware and stop the threat.

That wording matters. A decoy isn't a duplicate of your spreadsheet, not a restore point and not a promise that it will always be touched before a real document. Don't clean unfamiliar bait files manually, move them to tidy a folder or exclude them because they look odd. Let Panda manage its own artifacts. If you suspect they're damaged, use official repair/update paths rather than bulk-deleting hidden files; Panda Cloud Cleaner is a separate second-opinion/remediation workflow, not a decoy-file manager.

Decoys complement Data Shield: access control tries to stop unauthorized writers, while tripwires add behavioral evidence. They also complement ordinary malware detection, which looks at files, behavior, reputation and other signals. No single layer should carry the whole ransomware threat model.

Shadow Copies offer local rollback, with 10 percent as Panda’s documented default

Panda says it leverages operating-system technology to create and protect Shadow Copies, storing differences rather than a full new copy for every change. The same help page exposes a configurable disk-space percentage and documents 10 percent as the default expected to be sufficient in most cases. Treat that percentage as capacity to monitor, not a magic recovery score.

High-change workloads can consume local history quickly. Large media edits, virtual machines, databases and repeated ransomware rewrites may age older versions out. Check free disk space and test recovery of a harmless file after setup and periodically afterward. A recovery control you have never exercised is only an assumption. Increasing the allocation can preserve more history but competes with normal storage needs; a nearly full system volume creates other failures.

Most important, these copies live in the same device’s risk domain. Disk failure, filesystem damage, administrator-level deletion, loss of the laptop or an attack that defeats local protection can remove both the current file and its history. Shadow Copies can be a convenient first recovery source after containment, never the only source.

Build the backup architecture Panda can't replace

The current CISA StopRansomware Guide recommends offline encrypted backups, regular integrity testing and recovery exercises because accessible backups are frequent ransomware targets. For personal data, CISA also advises disconnecting an external backup drive when it isn't actively in use. That's the boundary Panda’s local features can't create by themselves.

Use at least three logical copies for critical data: the working copy, a versioned backup on separate storage or credentials, and another copy that's offline, immutable or otherwise not continuously writable from the Windows account. Cloud synchronization alone isn't a backup if deletions and encryption synchronize immediately. Confirm how long version history lasts, who can delete it and whether a compromised endpoint session can reach it.

Test a small restore every month or after meaningful configuration changes. Once or twice a year, simulate losing the entire PC: use a clean machine or isolated environment, retrieve the recovery documentation and keys, restore representative files and open them in the real application. NIST’s current 2026 ransomware guidance release reinforces building countermeasures and recovery into a practiced playbook rather than treating backup as a checkbox.

When a legitimate app is blocked, preserve the decision evidence

Capture the Panda alert before clicking anything: detection or control name, exact time, executable path, target file or folder and chosen action. Then identify the binary’s publisher, digital signature, installation source and expected task. An app update can replace the executable, change its hash, introduce a helper or move it to another path, so yesterday’s allow decision may not describe today’s writer.

Close the app and reproduce with a disposable file inside a test folder. If the signed official executable performs the expected edit, add only that exact writer to the appropriate access list, keep the protected folder and retest with Panda active. Don't exclude the whole data directory from antivirus scanning, disable Anti-Ransomware or allow every process merely because the app’s brand is familiar.

If the alert names a temporary directory, unsigned binary, script host or process you didn't launch, keep it denied and investigate. Our Panda scan, quarantine and exclusions guide explains how to preserve evidence and avoid unsafe broad exclusions. If several security tools are reacting, a recent r/antivirus incident thread illustrates why stacking remediation actions can make the sequence harder to understand; use community reports as caution, not diagnosis.

For an active ransomware alert, isolate first and preserve what happened

If filenames are changing, documents stop opening, ransom notes appear or multiple hosts show similar activity, stop ordinary troubleshooting. Disconnect the affected PC from Wi-Fi and Ethernet and detach writable network shares or backup drives without browsing through more files. CISA’s response checklist prioritizes identifying impacted systems and immediately isolating them; if individual isolation is impossible during a broader event, the network may need coordinated containment.

Record the alert, process path, user account, first observed time, affected locations and any recent download, remote-session or credential event. Photograph the screen if that's safer than saving into a compromised filesystem. Don't run several cleanup suites in sequence, delete ransom notes, rename encrypted originals or restore on top of them. Those actions can destroy evidence and the only remaining copy.

For a work device, regulated data, shared storage or signs of data theft, use the organization’s incident-response path. Contact vendors through links opened from their official domain, not phone numbers or “support” advertisements found in search results. If credentials may be exposed, change them from a separate known-clean device and revoke active sessions; changing them on the suspected PC can hand the new secrets to the attacker.

Recover into a clean environment after finding the incident scope

Containment isn't recovery. Determine which devices, accounts, shares and cloud locations were reachable, then establish the earliest known-bad time. Preserve affected originals read-only when possible. A file that appears to open may still be incomplete, tampered with or part of a dataset whose companion files were changed.

Choose a clean restore target: preferably a rebuilt and fully patched Windows installation or another isolated known-clean system. Install applications from official sources, update them, enable security controls and only then introduce scanned restoration media. Restore a small representative set first, validate file contents and application behavior, and monitor for unexpected modifications before returning the full dataset.

Local Shadow Copies may be one source if they survived and Panda exposes a usable version. Versioned backup is another. Neither should overwrite encrypted originals during the first attempt. Keep a copy of the affected material until recovery is verified and any professional responder no longer needs it. Afterward, close the initial access path—unpatched software, stolen credentials, remote access, malicious attachment or exposed service—otherwise a clean restore can be encrypted again.

Panda File Encryptor protects confidentiality, not availability

Panda’s current File Encryptor page describes converting selected content into unreadable encrypted data and reversing the process with the corresponding key or password. This helps when a file, USB drive or device is copied or lost and the reader shouldn't see its contents.

Encryption doesn't stop deletion and doesn't make the encrypted container immune to ransomware. A malicious process can encrypt the encrypted file again, corrupt it or remove it. The control therefore sits beside Data Shield and backup, not above them. It also introduces a new failure mode: if the only key is lost, the owner can create the same practical outcome as an attacker—unreadable data.

Before encrypting important originals, make a verified backup and test the complete decrypt-and-open workflow on a copy. Record the product version and file format needed for recovery. Avoid encrypting a sole password-vault recovery key with a key stored only inside that vault. For general plan context, compare Panda Free and paid tiers; the confidentiality tool isn't part of the free-plan threat model.

A key plan must survive loss of the PC and loss of the owner

Use a unique, high-entropy passphrase or generated key appropriate to the tool, and store recovery material outside the encrypted device. Two independently controlled copies are sensible for irreplaceable data: for example, a reputable password manager plus a sealed offline recovery record. Protect both from casual access, but don't make the procedure so secret that the authorized owner can't execute it under pressure.

Test key recovery, not just key creation. On a separate clean system, retrieve the stored key, decrypt a non-sensitive sample and open it. Document which Panda component and version are required. If another person or business must recover the data after illness or departure, define that authorized path now rather than sharing a password informally.

Rotate a key when exposure is plausible, but understand what rotation means for already encrypted archives. You may need to decrypt and re-encrypt them, creating temporary plaintext copies that require controlled deletion. Never paste a key into an unsolicited support chat or give remote access to someone who called after you searched for a Panda number.

Use File Shredder only after proving you selected the right copy

Panda’s File Shredder page presents the tool as permanent deletion and even recommends testing with recovery software afterward. The useful operational rule is simpler: treat shredding as irreversible for the selected logical file, confirm the path and maintain a verified retained copy if policy requires one.

Before shredding, close the owning application, verify the filename, path, size and content, and check whether the item is part of a larger project. A database journal, signing key, media sidecar or index may look disposable while being essential to the remaining data. Don't test the feature first on the only copy. If a litigation hold, retention rule or organizational policy applies, deletion needs authorization outside Panda.

Shredding isn't malware cleanup. If a file is suspicious, deleting it permanently can remove evidence while leaving persistence elsewhere. Quarantine or preserve it according to the incident process. Shredding is for intentional data-lifecycle decisions after classification, not for making an unexplained alert disappear.

SSD, sync and cloud copies set limits on file-level shredding

Traditional overwrite language maps imperfectly to SSDs. Wear leveling lets the controller remap writes, TRIM changes how discarded blocks are handled, and platform encryption may make whole-drive crypto-erase the appropriate retirement path. Panda acts through the filesystem on the selected item; it doesn't certify the physical state of every flash cell. For a retired device, follow the drive manufacturer and operating-system sanitization guidance, then verify the result appropriate to the data’s sensitivity.

A local shred can't reach a cloud version, snapshot, email attachment, collaboration history, recipient download, phone copy or disconnected backup. Delete or expire each copy at the system that owns it, while respecting retention needs. Sync can also propagate a local deletion, so inspect the service’s behavior before using a destructive tool inside a synchronized folder.

The same boundary protects you during ransomware recovery: independent history is valuable precisely because an endpoint operation can't rewrite it. Design confidentiality and retention across the whole data flow—creation, sync, backup, sharing, archive and disposal—instead of expecting one Windows context-menu command to govern every copy.