We often hear of viruses and in the category of “malwares”, there is “ransomwares”. These viruses are specifically designed to infiltrate your computer, create a unique encryption key and lock your files.

The release key is obviously available only from the pirate who infected you. He asks a ransom to unlock your files.

Encryption keys are usually impossible to submit to Brute force attacks by passwords software. Some solutions may be developed by reputable companies in the field of computer security, but these solutions are rare and can take time to be available or to process your particular situation.

So you find yourself in front of a dead end, pay or not to pay the ransom?

A phenomenon that affects even the police departements!

Recently, the Sheriff’s Office in the towns of Damariscotta, Waldoboro, Wiscasset and Boothbay Harbor in Lincoln County (Maine, United States), have been a target. They shared one server and one of their employees has possibly opened a file received by email which spread and block all their files.

To pay or not pay the ransom?

The rule is DO NOT PAY ransom. Although the police departement mentionned earlier, have paid  the $ 300 requested in bitcoins. They tried everything to get their files back but without luck. An embarrassing situation for a public protection service.

Obviously, this is the goal of cybercriminals to take you by surprise. So to make sure you’ll not be in the same situation as those peace officers, we must see how to prepare for this type of attack.

Ransomware Protection

These few basic rules will adequately prepare you to handle the situation:

1. Make backups, more backups. In several places, on several machines and preferably on a server that does not share the same accounts or departments. Each backups servers must rely on a private sub system, out of eventual breaches.

2. Have two separate software solutions, which operate in a common effort for the verification of virus threats in emails.

3. Block all addresses to Darkweb (Tor network), inbound and outbound. A good hardware and / or a computer technician can certainly help you in this process.

4. Establish with your family or colleagues / employees, a small training to recognize phishing attacks, these fraudulent emails / email scams on the Internet. Be aware that in most cases:

– An unexpected email;

– An offer too good to be true;

– A file attached to an unknown transmitter into an email;

– An extension .EXE or attached image file;

– An email in a language other than your own;

– The demand almost mandatory to click a link in the email;

Contains SURELY A SCAM OR A POSSIBLE ATTACK, or at least, should awake you to stay alert.

In terms of hardware, software and staff

I personally use a technique that help me so far be out of any threats. I open all my emails on an old iPad. Even if I adopt a preventive approach, I do not take any risks.

Even if a malware existed for IPad and locks my files, I lose nothing. In addition, it allows me to destroy suspicious emails before synchronizing my other devices.

If however, you are not able to follow the same path as me, you can always personally or in your company:

A) Activate the option on your computer to show all file extensions in visible mode. This will inform you of a suspicious file that will have a “.EXE” extension. As an image: Clown.jpg.exe

B) If you have aan ntivirus software and / or hardware that enables filtering of your files, make sure to block the extension “.exe”. “BIN” and “.ZIP”

C) If you use Windows, you can set rules to prevent the execution of files in the folder: AppData / LocalAppData.

D) Disable the “Remote Desktop Protocol” on your machine.

E) Have an approved version of a recognized antivirus and keep it updated.

F) Limit data access to a small group of people if you are in business

G) Keep all departments on different servers to guard from a global attack.

The damage is done?

Despite all the good attention , the inevitable can happen. If you end up with a threat of malware in your computer, do these steps:

1. If you notice in time or have doubts and no blocking window is displayed that your files are blocked, immediately disconnect your internet connection.

2. Restart in “safe” mode under Windows. If an equivalent solution exists for the operating system you use, do it or go into terminal mode. Change the BIOS date and time to an earlier state, it may play a role on viruses that triggers themselves on a precise date and time.

3. Restore your computer to a date you are sure not to be infected with anything.

4. Copy your critical data to an external media.

5. Format your disk, reinstall a new copy of the operating system with all the required software protection.

6. Perform a “scan” of your external media before putting your files back on your new installation.

7. Keep this copy of your data in a secure place.

Nothing is better than a good analysis of the situation. Do not click without read, evaluate and understand!