HELP VIRUS!!! Can anyone please advice urgently

Thanks for all the suggestions. It is a Locky extension and as everyone has said there is no ideal solution. I have disconnected my document HD and am storing it in the hope at some point in the future someone breaks the code. Until then its a clean install and back up my files on a separate system everyday.


.
 
Given that human error was involved (opening and attachment) and Windows Defender did not protect the computer, would having any other anti-virus software installed have prevented this?

The answer is "maybe". Windows Defender is adequate but not professional grade. It exists to provide a decent baseline of defence and stop the rampant level of infection and botnets that have been seen in the past. I'm not slating it, it's alright, but market leaders like Kapersky have wider protection and are updated faster. Kapersky and TrendMicro have consistently scored the best last time I researched things (a couple of years ago). I use Kapersky.
 
sympathy for your situation

The earlier link from armageus#8 references other antivruses that might have helped and spot bad behaviour as files were rapidly being encrypted.
I saw that Avira I use has nothing to offer, this might motivate me to start paying for an antivirus
 
Given that human error was involved (opening and attachment) and Windows Defender did not protect the computer, would having any other anti-virus software installed have prevented this?


.

AV - I'd say no. I've seen machines with Trend, McAfee, AVG and more all get hit with malware or ransomware.
 
I have two HDD on my desk for backups, I have one on at a time awhile backing up and when it's done I shut one off and do it again on another. Basically if you can't decrypt them then you'll just have to wipe the drive.
 
Ok just thinking out load.... .

If I set up a Gdrive/Dbox and sync my work folder on my desktop to it. What happens if I get infected with ransomware on my work desktop?
Won't all my files on the Gdrive/Dbox also get changed as they are are synced to the desktop folder?

.
 
Yes, which is why you should always have an offline backup (i.e. a hard drive you own that is disconnected, ideally in a different building in case your house burns down etc.)
 
If I can just jump in this thread as I see a lot of knowledgeable peeps in here.

Although I've never had one of these ransomware thingy's I am well aware of them and have wondered before that if your files are already encrypted with say CryptBox or any other off the shelf types then could they still be encrypted again with the ransomware encryption?
I am just thinking about encrypting some photos then if my system was ever compromised I could then move these files over to another machine and decrypt them there.

I am also wondering about using Linux for all my web use and have wondered if this ransomware has appeared on that at all?

Anyway good luck getting sorted OP.
 
Although I've never had one of these ransomware thingy's I am well aware of them and have wondered before that if your files are already encrypted with say CryptBox or any other off the shelf types then could they still be encrypted again with the ransomware encryption?
I am just thinking about encrypting some photos then if my system was ever compromised I could then move these files over to another machine and decrypt them there.

Yes they could certainly encrypt an encrypted file, making it practically impossible to decrypt just like a normal file. Whatever is doing the encrypting doesn't care what the file is, it just sees the bits.

I am also wondering about using Linux for all my web use and have wondered if this ransomware has appeared on that at all?

Good question. There do seem to be some, although they're aimed at servers (1,2). Amusingly the Linux.Encoder variants are badly written and easily 'cracked'. Note this one needs root privileges, so it either needs to trick a user into doing that (much more likely to ring alarm bells on a GNU/Linux system than in Windows where people are usually quick to permit those UAC requests) or exploit some flaw elsewhere to get arbitrary execution as root (such flaws are generally very quickly patched). I would say they're probably much harder to fall for than on Windows for these reasons.
 
not sure if it's been mentioned already but a lot of these ransomware tools will search your local network and encrypt everything on it as well.. so if you can have a live and an off the network drive too it would help hugely.

also, some of the ransomwares are fake.. so they appear to encrypt but only actually change the file extension. worth a try.
 
Yes, which is why you should always have an offline backup (i.e. a hard drive you own that is disconnected, ideally in a different building in case your house burns down etc.)

Not strictly true with Dropbox, I had a client who got hit by zepto. Everything in Dropbox was saved as I restored all files to the previous version. Time consuming yes, as there's no restore all to previous version function but certainly doable. I have a local disk backup via duplicati and the same backup is encrypted and uploaded via FTP offsite.
 
Just restore from your backu.....



Next time, take images with Macrium Reflect and keep offline copies of your files.
 
Back
Top Bottom