Ransomware - I got hit

Paul F

Veteran
This is a reminder to take the proper steps to backup in a way that is not vulnerable to ransom and to always stay aware. Due to me letting my guard down, my computer files are encrypted. But I got lucky.

I got lax and just was not thinking. I needed a video format converter for a simple conversion my wife needed to covert a video on her phone to something else. I'm normally very cautious about downloading software from legitimate sources. But for whatever reason, I didn't even consider it this time and I grabbed the first converter that was recommended by an unknown reviewer. I didn't bother to look from where I was downloading. The converter didn't do what I needed. I then passed the task of finding a converter to my wife. Again, I did not think about the consequences of downloading software and I did not warn her. She picked something and it worked.

The next day, I turned on the computer and I had a screen telling me all my files are encrypted and links were provided to recover the files. Oddly enough, some are encrypted and some are not. I was able to pull up projects in Premiere normally, but some other items like Illustrator files were encrypted.

I don't use email on this computer. It is only used for videos and web browsing. So I am convinced it was one of the two downloads (likely the one I downloaded) that caused the problem.

The saving grace of the story is I backup to an external drive that was off the entire time. I happen to have a backup of both the C: drive and the editing drive on the external drive. So I will be able to recover nearly everything without paying ransom.

Lessons learned for me - Never let your guard down. I am going to have two external drives, with one offline at all times and alternate backups.
On my notebook, I always backup to a stick and remove the stick. I am now going to have two sticks that I alternate for backups.
 
Sorry you got hit. Glad you had a backup.
I got hit with the lovely Crypto Wall 3.0 one year ago and fortunately had most of mine backed up. Still was quite a hassle. Some things are lost forever.
 
Good to hear you had a backup and that it was offline at the time you got hit. Also worth considering is an online backup solution like Carbonite, Crashplan, or Backblaze (which is the one I use). Nothing beats $50/year for truly unlimited offline storage!

The negative to Backblaze and Carbonite are 30 and 60 day file retention limits (respectively). What that means is a disconnected external drive would need to be connected at least once every 30/60 days for the service to keep the backed up files. Crashplan doesn't have this limit, and can be set to retain files from offline drives indefinitely. Crashplan also does file versioning (you can control how frequent the versions are saved).

Wait a second...... Why am I not using Crashplan?! Oh, yeah. The Java based program (yuck!).
 
I've posted this stuff before, but it's probably worth repeating. I add the following to my backup regiment:

Cryptoprevent from Foolish IT : https://www.foolishit.com/cryptoprevent-malware-prevention/ The profanity filter kills the URL, but you can go here: https://goo.gl/zP7iQf

Malwarebytes makes an Anti-Ransomware product that works really well: https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/

They also make a nice Anti-Exploit that shields your browsers and PDF readers: http://www.bleepingcomputer.com/download/malwarebytes-anti-exploit/

Good luck, friends! It's tough out there.
 
Does Ransomware require admin? I currently have admin privileges separate from my daily user account in hopes of preventing installations without my participation.

I get like 3-5 emails a day trying to get me to open fake invoices or contracts as zip files. I just don't open any zip files unless I know 100% its clean. Its getting ridiculous how much ransomware spam I'm getting.
 
Does Ransomware require admin? I currently have admin privileges separate from my daily user account in hopes of preventing installations without my participation.

No, it doesn't require admin permissions. It can encrypt anything the current user account has write access to.
 
Sorry you got hit. Thanks for posting. I did a refresh of my operating system drive clone to be safe. Old school second hard drive on the shelf is the only true defense to all of the internet ills.
 
Sorry you got hit. Thanks for posting. I did a refresh of my operating system drive clone to be safe. Old school second hard drive on the shelf is the only true defense to all of the internet ills.
Yeah. One on the shelf and one off-site for other ills :)
 
These look interesting.
I've read that normal virus protection (macafee, norton, etc) often doesn't catch ransomware.
Does this eat significant resources?
I've posted this stuff before, but it's probably worth repeating. I add the following to my backup regiment:

Cryptoprevent from Foolish IT : https://www.foolis*%t.com/cryptoprevent-malware-prevention/ The profanity filter kills the URL, but you can go here: https://goo.gl/zP7iQf

Malwarebytes makes an Anti-Ransomware product that works really well: https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/

They also make a nice Anti-Exploit that shields your browsers and PDF readers: http://www.bleepingcomputer.com/download/malwarebytes-anti-exploit/

Good luck, friends! It's tough out there.
 
Antivirus normally doesn't catch it because they aren't viruses per se.

Cryptoprevent uses zero system resources. It's just a collection of group policies. I run both the Malwarebytes applications and they don't use much of anything for resources.
 
Hey, thanks everyone here for posting these defense resources.

I've been taking a "not to me" attitude since I first heard of ransomware...DUMB. But now I'm all armored up.
 
The free applications I mentioned and regular backups will save you from just about anything. It's all about preparation. :beer:
 
Use it well, my friend! That stuff is nasty. It's also quite profitable, so it's not going away anytime soon.
 
Back
Top