content: Such as routinely backing up documents/images to storage only accessible by the antivirus,   This would be a genius approach, but REALLY hard to pull off. The issue with write protecting something is that, as soon as a process has administrative permission in the file system, it still can't write to it, but it CAN remove the write protection and THEN write to it. That's why booting as root (like we do in windows) is so dangerous. Since end users are so conditioned to click through UAC prompts, there's nothing we can do, save educate. And even when users don't click yes when they shouldn't, occasionally someone finds a privilege elevation bug.  or monitoring if a process is encrypting lots of files and pausing it/warning the user.  This falls under HIPS protection, something I suggest every user have. The issue with HIPS programs, is that they are annoying as fuck at times, and therefore will be disabled by the end user (confession, my hips filter is off 90% of the time) as soon as they can. On top of that, while HIPS might stop a program from encrypting the program files folder, most filters won't prevent the contents of the user folder (90% of what people care about) from being messed with, since that's an area that literally every program will read and write to near constantly. As for determining based off number of files messed with, that could be a good approach, a VERY good one in fact, though if it goes off via writing to 100 files, a significant amount of data has already been lost, but certainly far less than what would be lost if the process continues.