Sadly while I was at my church office a few weeks ago an email arrived from the website company who hosts our website which I administer.
I got sloppy and didn't copy the address, paste into notepad to see the entire url, and clicked on the link.
BOOM.......it was ransom ware which, before I could barely react, encrypted the entire hard drive INCLUDING backups, emails, everything with text.
We run a proprietary program which is the record keeping system for all our members which, somehow, escaped encryption (I had an 11 month old backup off site) but wouldn't have been the end of the world. Just curious it wasn't hacked as well.
I had recently updated that computer to WIN 10 and had an idea to check the windows.old folder but, sure as heck, THAT had been encrypted as well.
The ransom was $700 in bitcoin but that was NOT going to happen so I did a square one re-install of WIN 10 which included a thorough hdd format.
Has anyone actually PAID the ransom?
What assurance is there they wouldn't pull if off again?
 | Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years. Thanks, CNET Support |
General discussion
Can my backup hard drives be affected by ransomware?
With all the hacking and malware abound, I was wondering whether am I protected enough? I do not mean Norton or McAfee or ZoneLab. I have all my programs and immediately needed data on my solid state drive (C drive). All my work (relating to web design, graphics and photography) are stored on the second internal hard drive and on two external HDs I can switch off. I've read recently that some ransomware has coding in them so even if one pays, the ransomware is capable of locking the folders/files/data on those secondary drives and can even destroy the data in them. Question: Are are secondary hard drive and external drives safe? If not, how can I make them safe from ransomware? Thank you for your help.
--Submitted by Judit K.
Discussion is locked
31 - 60 of 71 Posts
- Collapse
- Collapse -
- Collapse -
We recently had a ransomware episode in California where a medical facility had their entire bunch of systems encrypted. Unfortunately, this included critical systems where patients were undergoing surgery at the time (bad design?) Due to time constraints, they did pay the ransom and got their systems unlocked.
There is no insurance that they would not "pull it off again" (maybe if a warranty came with the unlock keys). There is an issue that, if the system could not be unlocked and word spread about this one specific instance, not too many will pay the ransom. As for getting the thing again.. well, if you got it the first time, I guess you can run the same program you ran the first time and get the infection a second time. Would the same keys work to unlock the system? Don't know.
- Collapse -
It sounds like you earn your living as a web designer. Buy an inexpensive Chromebook or laptop for everything you do on the Internet and disconnect the "work computer" from the Internet.
Problem solved, no internet access on the work computer, no "ransomware"!
- Collapse -
Several months ago, my monitor flashed up a ransomware screen, and I panicked and unplugged the PC. Took me 2 days to rreformat and rebuild the main hard drive. <
The next time it happened, I ignored it: I tried another browser and everything seemed OK, so I went into my usual browser and reset the default home screen.
Ransomware was GONE! Hasn't happened since.
Using Mozilla Firefox as main browser and Avira Anti-virus.
- Collapse -
though you may think you are clean, you really need to go to one of those websites that checks for malware and have them check a few logs for you to make sure you are clean. ransomware does not always immediately activate. sometimes it is just sitting there waiting. Also, who knows what else may have been uploaded to your computer that may currently be collecting info about you.
see the following and scroll down to mitigation.
https://en.wikipedia.org/wiki/Ransomware
a couple of sites that will check your logs for malware are - just post in their malware section.
http://www.techsupportforum.com/
http://www.bleepingcomputer.com/forums/
- Collapse -
If this were truly a fake alert, you could get away with closing the browser and running CCleaner, properly configured to delete all temporary files and hopefully startup injections too. I've defeated many an attack of such malware that way. I run as a limited user, so unless there is a vulnerability in an application or the operating system they won't be able to take over the computer - however, if a limited user can encrypt his files, then chances are a truly dangerous cryptolocker malware could do it too. It never hurts to hit Ctrl-Alt-Del, and end all desktop processes with Task Manager, clean with CCleaner, and re-boot and pray. Disconnecting the Ethernet or booting to safemode with no networking could help mitigate this, if the malware is not too sophisticated. CryptoPrevent at bleepingcomputer could prevent the whole mess in the first place.
As an alternative to safe mode, one could run a rescue disc like Kaspersky's Rescue Disc 10 and blow the malware out of the water before it can do more damage. You would have to reconnect the Ethernet so the rescue process could update - it is doubtful the malware could re-activate in this environment, so I assume it is safe to try. If things have already taken place, and your files have been encrypted; this won't help that at all. You would either have to follow the disaster recovery sections on this from bleepingcomputer(dot)com or wipe and reinstall the operating system and restore from backup - hopefully a backup that is not also infected.
- Collapse -
Always think of the simple solutions first. I tend to over complicate things and I have to push myself to the discipline of KISS - and I'm sure we all know what that acronym means! 
- Collapse -
Many thanks to all!
In summary:
1. Have a backup regime with frequency dependent upon nature and quantity of valuable data
2. Clean before backup
3. Disconnect from the internet while backup to removable storage
4. Disconnect backup drives other times
- Collapse -
In addition to a standard anti-malware program, other precautions need to be taken. I've installed FoolishIt's Cryptoprevent Pro and Malwarebyte's Anti -Exploit Pro which run in background. For good measure, I also run Malwarebyte's Anti Malware periodically. My prime anit-malware program is Webroot SecureAnywhere. I also keep Windows and software up to date. A nice (free) program is File Hippo's app manager. Qualy's Browser Checker is also very good at keeping your browsers clean.
I run a two stage backup using Easeus Todo backup software. A free version is available, BTW. First I do a daily automatic backup to a second internal hard drive. Then, every two or three days, I run Bleeping Computer's ListCRIlock which searches for encrypted files. This takes only a second or two. After being assured that my computer is free of ransomware, I connect an external hard drive and copy over the backed up files. In addition, about once a quarter, I make a full backup to a portable drive and place it in a bank safe deposit box.
Should recovery to an infected or crashed drive ever be needed, I boot up from a recovery disk created by Easeus todo and select the level of backup that I want to use. The recovery process wipes the drive being recovered.
- Collapse -
I knew I shouldn't have posted this early in the morning and I do know how to spell 'layers'. Hopefully, CNET will someday add a post posting editing capability.
- Collapse -
I guess we've all become just too dependent on spell check which doesn't apply to titles here.
- Collapse -
to confirm your name for the crypto-prevent utility; many people are put off by that developer name, but it is genuine and considered the industry standard for ransom-ware prevention. It can be found on bleepingcomputer(dot)com
- Collapse -
Had a lot of trouble getting in touch with anyone at DropBox for Customer Support. My entire account was hacked and was unable to get my documents back, and no luck getting in touch with DropBox Support.
- Collapse -
The biggest problem with backing up everything is these days we could be talking several terabytes and backing up that much data is not only near impossible on a home system but expensive.
Even using a cloud service it would take weeks to upload that much data.
The first rule is these random blackmailers is they use either suspicious and dubious web sites, Illegal share sites, porn sites Usenet or bogus emails to infect. Simply do not go to any of these places. Never ever open an email attachment unless you are 100% sure where it came from. If you suspect something use your email client to check the properties of the email and trace it's origin. Check the sender's name and then do a whois check. that can tell you a lot about the origin.
I am no genius and have had a ransom demand once. It only affected JPG files, which fortunately had an off line backup. Since then I have not had a virus, malware or any other problems.
Another trick is connecting external drives via a passworded network meaning if you need to access an external drive it will demand a password. At least then only the system drive needs to be backed up.
There are ways to stop these people in their tracks. Most require expert help to make your system virtual hack proof.
By the way I use Ashampoo anti virus from Ashampoo.com which has two engines, Emisoft and anti malware leader Bitdefender and it updates every hour.
- Collapse -
reading on Krebs on Security, that password protection didn't save some victims on NAS storage networks, or even cloud based storage. ( one exception was Carbonite). I suppose I could be wrong - I am getting "old timers" disease after all. 
- Collapse -
He asked his son at home to come up with a FREE anti-malware solution. The kid found one but it turned out to be the one that was ransom-based. That is, it claimed it found something but it refused to clean it or let you use the "dangerous" computer until you paid them money. Rebooting obviously didn't help. He brought the PCs in (they were provided by work) and I had a helluva time getting them into safe mode and being able to remove this a/v software. At least it didn't encrypt files. (It was ransom-ware but more on the side of "FakeAV". The part that was interesting was that the major a/v software vendors declared this "fake" to be malware and the malware makers sued them, claiming that their product was legit software with a novel marketing method.
- Collapse -
having a web-site reputation utility is helpful. Using Web of Trust or McAfee's SiteAdvisor can be of use to avoid bad connections. I prefer WOT because SiteAdvisor is the ONLY product that I can stand that McAfee makes - they will try to foist off all their other junk on you just for using the SiteAdvisor browser extension. WOT will also totally block a bad page if you attempt to visit it.
Using Comodo's DNS service that is given along with its Dragon browser or other free products will add another layer of defense.
- Collapse -
I found Symantec's (even Norton's) reputation-based protection good; maybe too good. If you are a developer/tester you need to make sure that the files are all signed by the developer or the reputation service will delete the files on download. We had a meeting to discuss that with Symantec that didn't go very well.
- Collapse -
Yes, your secondary and externally connected hard drives can be locked out by ransomware, or even destroyed by malware.
The obvious solution is to periodically back up to an external hard drive or off site hard drive that you then DISCONNECT.
I use Acronis True Image to back up daily to a connected hard drive, but weekly to an external hard drive that then is disconnected and stored in a waterproof and fireproof safe. Use a backup program that allows you to make a bootable dvd and/or usb drive, so you can boot from and recover from uninfected sources.
- Collapse -
Yup! Most people got it right.
Even removeable media - because either the malware will attach itself when you insert the media, or you'll copy it when you copy your files.
The "good malware" cannot be seen by your system, so Norton's, etc. are useless. The only way to properly scan is with a bootable cd or dvd and a good detection program.
Best advice I can come up with is to not do incremental backups. Do complete backups each day and save to a file that has the date and time in the name, so that you do not overwrite. That way, if you accidentally backup files that are already corrupted, you haven't destroyed your last good backup.
- Collapse -
will lock all the backups whether they are incremental of not, so I'm not sure what he is talking about. However if he means use a different media each time and do a full backup, that makes sense, because only the last media disc, stick, cloud account that was used is ruined by locking it up with the ransomware. That can be a very difficult plan, but if you have a dozen or so DVD RW discs, and that will hold a full backup, that is an example of what he is talking about. Once you get hit by the ransomware, you can guess your last backup has the attack file on it. The smart malware writers lurk in the background long enough that incremental backups using the same media source will already be infected. The best cure is prevention by using CryptoPrevent found at bleephingcomputer(dot)com
- Collapse -
The issue with using backups is that the infection could have happened weeks before that. If you do a full backup and then only incrementals after that, you may wind up with only ONE backup of a critical file versus several over time.
The important thing is to make sure your backup plan makes sense to YOU and your data and yet remains cost-effective. We had one bit of malware (lookup: Michelangelo Virus) that doesn't "spring" until the birthday of Michelangelo which could be up to a year away (then it says Happy Birthday as it formats your HDD). I've seen worse. Since this was replicated by floppy disk, I don't know if you would see much of it today. The important thing is to realize how the malware got activated. If it is because you executed a file or clicked on a web link, then you should be able to go back to just before the link or file activation and, well, just don't click on it. So a lot depends on what specific malware you are dealing with.
- Collapse -
it can be almost impossible to root out all evil - but like you said, you just have to take account of what you are willing to risk, and how much to spend to protect your data. In my experience, I've had success simply restoring a very early image, and then isolating the back up files and computer from any network access for at least 24 hours; long enough to let the AV/AM solutions find the threat and expire the zero day odds, and scan the backup files. in every case, I was able to find the attack package sleeping in the backup files and remove it before restoring. I still consider that pot luck though. If you are a high value target, the recovery will be more than grueling, I'm sure.
- Collapse -
I use a low-cost service that automatically backs up all changed files to the cloud daily. The important thing is that it keeps up to 10 versions of the file. So if I change a file every day, there will be 10 different copies of the file in the cloud from the last 10 days.
So if malware scrambles my files and I don't notice the same day, there will now be scrambled copies in the cloud IN ADDITION to my original versions.
So I can go back to the previous version and restore.
The first thing I'll probably notice is that my cloud backup is taking forever.
Fortunately, I've never been a victim, but I think this simple, automatic approach will protect me.
- Collapse -
elsewhere in this thread, someone said to do this with Dropbox. I've never used cloud based storage so can't comment - but it does seem very plausible this would work. In fact I think one of the victims wrote into a forum I frequent and said that was how they ended up recovering from a Cryptolocker attack.
- Collapse -
Someone in this thread also mentioned they used dropbox and their files were "hacked". I wonder if you used a cloud drive and had a drive letter mapped to the cloud drive, if the cloud drive would get caught by the ransomware?
- Collapse -
cryptolocker did find the cloud backup and compromise it. However, there was supposedly a way to restore a backup of the cloud files from the cloud server, and this worked --- supposedly. :/
CNET Forums
Operating Systems
Software
Electronics & Gadgets
Hardware
Tablets & Mobile Devices
General Help
Roadshow Autos
Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic