Hit by Ransomware – Now What?

You’re working on your computer, simply browsing the internet and suddenly a note appears on your screen saying that your computer is locked and all files have been encrypted. You’ve been struck by ransomware.

Hit by Ransomware – Now What?

What is Ransomware

Ransomware is a type of malware that holds your device hostage. It locks up your system and you might not be able to access any of your files because they have been encrypted. If you’re infected by a ransomware, it will probably ask you to pay a certain amount of money to get the key that unlocks the encrypted files.

There’s no guarantee that once you pay, the criminals will let you have access to your files again. This makes ransomware really tricky. While you might think paying a couple of dollars is not a big thing, the truth is that ransomware can even demand thousands of dollars.

The risk of ransomware is real and growing as the ideas used by criminals are evolving and they are coming up with new types of malware. With malware getting sophisticated, it is suspected that more people will get infected in the coming years.

What to do?

When you’ve been struck by a ransomware, take a deep breath and relax.

Identify the Ransomware

First, you need to determine the type of malware that has attacked you. Has it locked your screen or encrypted your files? It could also be a bogus ransomware that pretends to be malicious to make you pay up. If you’re unable to close the note on your screen, it’s probably a screen-lock type ransomware. If you can access your computer folders but cannot open your documents, emails, or photos, it’s probably a file-encryption type ransomware which is more dangerous.

Don’t Pay Ransom

Security experts say that you shouldn’t pay the ransom. Even if you do pay it, there is no guarantee that you’ll get your files back.

Don’t Click On The Ransom Note

There will be a pop-up on your screen, asking for ransom. Don’t click on the note. Instead, close it by using keyboard shortcuts.

How to Deal with each Type of Ransomware

Screen Locking Ransomware

Here are the steps to get past the screen-locking ransomware.

1. Disconnect from the internet and all other devices.
2. Take a photograph of the ransom note using a camera. It will help in filing a police report later.
3. Restart your computer in safe mode or try a system restore. Your system will start from the last known good state.
4. Inform the police. This will let authorities keep a check on the spread of that virus.

This will generally solve the screen-lock ransomware issue.

File encryption ransomware

1. Disconnect from the internet and all other devices.
2. Use your camera or phone to take a photo of the ransom note.
3. Check if you have a backup copy of the encrypted files. If you do, you’re not at risk of losing them.
4. Some encryption malware work by making copies of the files, encrypting them and then deleting the original ones. There are some tools (such as Pandora) that can help you recover deleted files.
5. Try to decrypt your files by using tools. If the ransomware has announced its name, you can upload your files to tools such as No More Ransom and see if they can be restored. If you don’t know the name of the ransomware, you can upload them to Crypto Sheriff and find out if they can be decrypted or not. 6. If one tool doesn’t work for you, look for more and try them.
6. File a police report.

File-encryption ransomware is tricky and there’s no guarantee that you’ll get back your files this way. However, these steps are worth a try nonetheless.

Fake Ransomware

It just might be a fake ransomware note trying to get some money out of you. Don’t panic or make the payment. Try to get past the note and access your files. If you can do both, it was probably a fake note and there’s nothing to worry about.

Ransomware Cases

SynAck is the latest strain of ransomware to attack computers. It’s not the only one. There have been various cases of different types of ransomware all around the world. Here’s how you can stay protected from them.

1. Make sure you keep a backup of all your files.
2. Use a VPN while accessing the internet on a public hotspot. A VPN will encrypt your data to ensure that your traffic stays hidden from spying eyes.
3. Don’t download suspicious files.

List of Ransomware Files

• Wannacry
• Amnesia
• SynAck
• Ransomware32
• M4N1F3STO
• Apocalypse
• Wildfire
• WannaLocker
• Alpha Crypt
• TeslaCrypt
• Crypto-Virus
• Cryptolocker
• Fatboy
• CryptoShield
• ZCryptor

Paying Ransom

If you think your files are too precious and you cannot risk losing them, you might want to pay a few hundred dollars to the hackers to recover them. If you decide to pay up, make sure you negotiate with them first. This usually works and you will be charged lower than what was written on the note.

If you already have a backup of the files and they are all safe, simply reinstall the operating system. If you have a backup on an external hard drive, don’t connect it to the infected system as the backup files can get encrypted as well. Follow safe internet practices and stay safe from malware.