10/03/2014
If you haven't heard about them, there is a new threat that is becoming more fearsome, ransomware.
What: Ransomware is a type of malware that tries to extort money from you. One of the newest, CryptoLocker, encrypts files and attempts to force payment of hundreds of dollars to obtain access ($300), If you attempt to remove the encrypted files, the cost rises to over $2000 for the hijackers to send the un-encrypted files back.
Who: The current malware is now produced by organized crime abroad in Russia, China, etc. for profit and has become increasingly sophisticated.
How: Not all ransomware is identical. The key thing that makes a piece of malware “ransomware” is that it attempts to extort a direct payment from you.
Some ransomware may be disguised. It may function as “scareware,” displaying a pop-up that says something like “Your computer is infected, purchase this product to fix the infection” or “Your computer has been used to download illegal files, pay a fine to continue using your computer.”
In other situations, ransomware may be more up-front. It may hook deep into your system, displaying a message saying that it will only go away when you pay money to the ransomware’s creators. This type of malware could be bypassed via malware removal tools or just by reinstalling Windows.
Ransomware is becoming more and more sophisticated. One of the latest scams, CryptoLocker, starts encrypting your personal files as soon as it gains access to your system, preventing access to the files. CryptoLocker then displays a message informing you that your files have been locked with encryption and that there is limited time
to pay. For $300, they’ll send the encryption key.
Prevention: Ransomware arrives through email attachments, via the Java plug-in (Webads and hotspot clicks) and installed on computers that are part of the Zeus botnet.
•Use a good antivirus product
•Avoid running suspicious files, such as .exe attached to emails, websites with free software, and adultsites.
•Keep your software updated.
Resolution: Unplug from the internet and turn off computer until a backup is made from a PE environment so that further invection is prevented and then perform a Safe boot to restore affected files.
Solution: Backup to offline storage such as a disk or cloud storage that enables a system or file restore from source.