iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—Norton 360 documents ransomware protection, but it is a protective layer, not a guarantee that every attack will be detected or stopped. On Windows, Norton describes ordinary threat scans alongside a dedicated Ransomware Protection feature designed to help prevent personal photos, documents and other files from being modified, deleted or encrypted. Android subscribers may also have Ransomware Recovery, which scans apps for screen-lock and file-encrypting ransomware. The exact feature name and availability depend on your operating system, Norton plan and app version.
What Norton 360 checks for
Norton’s Windows security documentation describes several defenses that work together rather than one single “ransomware scan.” Threat scans and antivirus protection look for malicious software. A separate Ransomware Protection control is intended to protect personal files from ransomware actions, including modification, deletion and encryption. Norton Support lists these capabilities in its Windows security overview: Norton 360 device-security features.
That wording matters. A scan searches for threats that Norton can identify; ransomware protection also focuses on what suspicious software attempts to do to protected files. The documentation does not establish a universal detection percentage, a guarantee against new ransomware variants or a promise that every encrypted file can be recovered.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsHow the protection layers fit together
| Layer | What Norton describes it doing | What it does not prove |
|---|---|---|
| Threat scans | Search the device for threats identified by Norton’s security software. | That every unknown or future ransomware sample will be found. |
| Antivirus protection | Provides general malware defense as part of device security. | That antivirus alone can undo files already encrypted by an attack. |
| Ransomware Protection | Helps protect personal photos, documents and other files from being modified, deleted or encrypted by ransomware. | That all ransomware behavior will be blocked or that no alert will be missed. |
| Norton Cloud Backup | Keeps selected files and folders available for restoration after data loss, including loss caused by ransomware. | That backup detects or prevents ransomware, or that files not included in a completed backup can be restored. |
Thinking in layers prevents a common mistake: treating a backup as a scanner or assuming a scanner is a substitute for a tested backup. Prevention and recovery address different points in an incident.
#1 Best Overall
Windows: Ransomware Protection and the former Data Protection name
On Windows, Norton’s current app guidance says the feature formerly called Data Protection was renamed Ransomware Protection. If an older installation or help page uses the former name, that does not necessarily mean the capability has disappeared. Norton also warns that feature names and availability can vary by platform and subscription. See the app-change notice for the current naming context: Norton’s new 360 app feature guidance.
To check what your Windows installation actually offers:
- Open the Norton 360 application and go to its device-security or protection area.
- Look for a control labeled Ransomware Protection. On an older interface, look for Data Protection.
- Confirm that the control is enabled and read the protected-file or access prompts shown by your version.
- Run the available threat scan from the same security area, especially after installing software, opening a suspicious attachment or seeing an unexpected security alert.
- Check your subscription details if the control is missing. Norton states that features differ between plans and platforms, so a missing menu is not proof that the product is malfunctioning.
The exact buttons can change as Norton updates its application. Use the labels displayed in your installation rather than following a screenshot from an older version.
Android: Ransomware Recovery is a different feature
Norton’s mobile documentation describes Ransomware Recovery for Android. It scans apps for two categories of behavior: screen-lock ransomware that prevents you from using the phone, and crypto-ransomware that encrypts files. Norton says availability depends on the subscription. The Android description is not a statement that every Norton mobile plan includes the feature.
On an Android phone, open the Norton app and review the mobile-security features shown for your account. If Ransomware Recovery is listed, follow the in-app instructions to run it or respond to an alert. Keep Android and installed apps updated, because an app scanner is only one part of mobile security. The documented Android feature should not be assumed to work identically on Windows or macOS.
Norton’s feature list for iOS is different from its Android list. Therefore, an iPhone or iPad user should check the iOS features displayed in the app instead of expecting the Android Ransomware Recovery control. Norton’s platform-specific feature documentation is here: Norton 360 mobile-device features.
Scanning is not the same as removing ransomware
“Does Norton 360 remove ransomware?” is a separate question from “Does it check for ransomware?” A scan may identify malicious software and the security product may quarantine or remove a detected component, but the supplied Norton documentation does not promise that every attack can be reversed. If files have already been encrypted, deleting the malware does not automatically decrypt those files.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If you suspect an active attack, prioritize containment:
- Disconnect the affected computer or phone from networks if doing so will not destroy evidence or interrupt a managed incident-response process.
- Do not open, rename or overwrite large numbers of affected files; preserve their current state.
- Use Norton’s current scan and remediation prompts on the affected device, or contact your organization’s IT or security team.
- Do not pay a ransom solely because files are inaccessible. Payment does not guarantee a working decryptor and can encourage further attacks.
- After the device is clean, restore only from a backup you know predates the incident and has not been connected to the compromised system.
These are incident-response precautions, not a claim that Norton performs each step automatically.
Cloud Backup: the recovery layer
Norton Cloud Backup lets you choose files and folders to copy to cloud storage. Norton presents this as protection against data loss from ransomware and other causes. The setup instructions are available in Norton’s Cloud Backup guide.
A useful backup must exist before the attack and include the files you care about. Configure the backup set deliberately rather than assuming that every folder on the device is covered. Pay attention to the last successful backup time and any exclusions or capacity notices shown by the application.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Norton also documents local backup destinations, including an external hard drive or USB storage. Local backups require user intervention; they do not run automatically according to Norton’s instructions. A removable drive that remains connected all the time can be exposed to the same ransomware event as the computer, so disconnect it after a backup completes and reconnect it when you need to run or verify another backup.
How to restore files after ransomware
When you have a clean device or have confirmed that the malware has been removed, Norton’s restore documentation explains how to restore a complete backup set or selected files: Norton’s backup-restore instructions.
- Confirm that the device is no longer showing active ransomware behavior. If you are unsure, involve an IT professional before reconnecting backup storage.
- Open Norton’s backup or restore function and select the relevant backup set.
- Choose either the entire set or individual files and folders, depending on the damage and the time of the last good backup.
- Select a restore destination that will not overwrite evidence you still need. Restoring to a separate folder first lets you verify the files.
- Open representative documents, photos and other important files to confirm that they are usable before replacing the damaged originals.
- Run a fresh backup after recovery and record when it completed successfully.
Restoration can recover only what was backed up. Files created after the last successful backup, excluded from the backup set or already corrupted before backup may not be available.
What changes by platform and plan
| Setup | Documented ransomware-related capability | Important qualification |
|---|---|---|
| Windows | Threat scans, antivirus protection and a named Ransomware Protection feature. | Feature names can change; Norton says plan and platform determine availability. |
| Android | Ransomware Recovery can scan for screen-lock and file-encrypting ransomware. | Availability depends on the subscription. |
| iOS | A platform-specific mobile feature set listed by Norton. | Do not assume Android’s Ransomware Recovery feature is present on iOS. |
| Cloud or local backup | Recovery of files that were backed up before the incident. | Cloud setup must include the files; local backups require manual intervention. |
Norton’s Windows overview and app notices emphasize that the product is not identical across every edition. Check the subscription attached to your Norton account and the operating system on the device you are protecting before relying on a particular control.
Recommended Free Tools
Common problems and practical fixes
The ransomware control is missing
First check whether the app uses the older Data Protection label. Then verify that you are looking at the supported operating system and the correct Norton account. If the feature is still absent, consult the current product documentation for your plan rather than enabling an unrelated setting or installing a second antivirus program that could conflict with Norton.
Best Value
A scan finds nothing, but files are changing
A clean scan is not proof that file activity is safe. Stop opening new files, disconnect the device from shared storage where practical, and investigate the process responsible. Check whether Ransomware Protection is enabled and whether the affected folders are included in your protection or backup configuration. Escalate to IT if the device belongs to an organization.
Backup exists, but the newest files are absent
Review the backup set, the last successful run and any folder exclusions. Cloud Backup restores only data that was successfully uploaded. A manually operated local backup may simply not have been run recently; inspect the storage device and its backup date before assuming it is current.
Restored files will not open
Try restoring a known-good earlier version or a smaller selection to a separate folder. Do not overwrite the only remaining copy while testing. If every version is damaged, the backup itself may have occurred after encryption or may have captured already-corrupted files.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow much confidence should you place in Norton 360?
Norton’s support pages establish what the company says its features are designed to do; they do not provide an independent ransomware detection rate or demonstrate perfect prevention. Treat Norton 360 as one control in a broader security plan:
- Keep the operating system, browsers and applications patched.
- Use a separate administrator account for administrative work when practical.
- Be cautious with unexpected attachments, macros, links and pirated software.
- Maintain at least one backup that is not continuously writable from the everyday account.
- Test restoration periodically instead of checking only that a backup job says it completed.
- For businesses, combine endpoint protection with least privilege, network segmentation, identity protection and an incident-response plan.
The direct answer remains yes: Norton 360 checks for and describes protection against ransomware, with Windows Ransomware Protection, Android Ransomware Recovery on eligible plans, and backup-based recovery as separate pieces. What you receive in practice depends on the device, subscription and version installed, so verify those details in your own Norton app before an incident occurs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
