Raccine

Raccine is a tool designed to provide an extra layer of protection against ransomware. Considering that most ransomware attacks entails deleting the shadow copies via vssadmin.exe, the role of the tool is to intercept the malware's request and kill the process.

It is important to note that before it kills the parent processes, first the app collects all their PIDs. In the eventuality that no malware is found, then the app creates a new process using the same parameters. If it finds anything suspicious, then it starts killing all processes.

The advantage of using this rather generic method to intercept ransomware stems from the fact that you do not need to replace any system file. It goes without saying that editing system files could lead to integrity problems.

On the other hand, since the app works in the background with wmic.exe and vssadmin.exe it means the tool should be used at your own risk. According to the developer, once you run the tool, you are unable to run blacklisted commands on the machine until you apply the uninstall patch. The tool does not exactly discriminate well between legitimate and malicious combinations that invoke vssadmin.exe, so it may kill agents associated with potential backup processes.