A1RunGuard

Ransomware will leverage legitimate programs for nefarious reasons to avoid detection by your antivirus software. It is designed to intercept the launch of these programs. But rather than blocking them completely, it investigates the command lines of the program and fires the alarm only if a dangerous combination occurs. It uses the Windows Image File Execution Debugger method to intercept the running of the executable files.