Ransomware

[conVINCEd 21477]

Dad apparently clicked on an email he shouldn’t have.  Is there a workaround, or are his choices bricked computer or pay the money?

[ztejas 44228]

Need more details please. Is this like an identity theft type deal or a virus that's locked down his computer?

[conVINCEd 21477]

Locked down.  They want $500.

[NeverMarryAStripper 22294]

Tell them you'll pay, but only in cash face to face.  Shoot them when they show up.

[AUinHsv 584]

Not to pile on but this is a good reason to discuss the word "backup" with him and others. And keeping the backup somewhere else like a fire safe.

The real question is how much stuff does he have that is not replaceable. Depending on how email was set up - it may all be saved on the server of the provider. The photo albums of the grandkids may be replaceable if he sent copies to someone.  I would not pay money until I figured out what was encrypted. Also there is no honor here - they may not send the key to decrypt.

[Dbeasy 15593]

By the way, my son-in-law is a fireman and he told me they uncover burned up fire proof safes all the time. He said they don’t survive very often. Better bet is to store offsite somehow, either digitally or physically. 
 

edit - and some people use them to protect from being stolen, but that just provides a target for thieves to focus on when they breakin. 

Edited October 22, 2021 by Dbeasy

[Dr Fear 1290]

It's also possible that only access has been locked. I would first pull the HD and see if the files were encrypted.

[conVINCEd 21477]

3 minutes ago, AUinHsv said:

Not to pile on but this is a good reason to discuss the word "backup" with him and others. And keeping the backup somewhere else like a fire safe.

The real question is how much stuff does he have that is not replaceable. Depending on how email was set up - it may all be saved on the server of the provider. The photo albums of the grandkids may be replaceable if he sent copies to someone.  I would not pay money until I figured out what was encrypted. Also there is no honor here - they may not send the key to decrypt.

I’m going over there in a little bit.  My only instructions to him were to not deal with these people until I get there, and to check his bank accounts and make sure everything is ok there.

[Francisco 2.0 32587]

This is why olds* should never use a computer.

 

 

*We had a 20 something female here at work that called me one day asking for the admin credentials on her computer, because she had Microsoft "support" on the phone and they wanted to remote in and check her work PC for malware.  And within a year, we had a 30 something woman call me asking the same, because she had a tab open in Chrome to call Apple "support" and they needed to check her PC.

 

 

 

 

[conVINCEd 21477]

I’m off the hook.  He decided I wasn’t moving quick enough, so he took it to “some guy” with a shop in a strip center who has fixed things for him before.

Edited October 22, 2021 by conVINCEd

[Updawg 2385]

Change all password for every account immediately. Check rules on their email accounts to make sure their is no auto forwarding etc. enable multi factor for everything. Wipe all devices and start over

[Nice Guy Eddie 13729]

If you pay the ransom, be prepared that you still won’t get access. I get the concept that the people behind these attacks need to release the hostage computer or people will stop paying in the future. But that is more with real attacks and not $500 single computers.

If there isn’t something irreplaceable, I would just trash the computer. Even if you pay, I would trash the computer after copying over any necessary files.

[dcbc 14644]

On 10/22/2021 at 2:34 PM, Dbeasy said:

By the way, my son-in-law is a fireman and he told me they uncover burned up fire proof safes all the time. He said they don’t survive very often. Better bet is to store offsite somehow, either digitally or physically. 
 

edit - and some people use them to protect from being stolen, but that just provides a target for thieves to focus on when they breakin. 

Backblaze is $7 per month and backs up external drives as well.  Backup is in real time.  Easy to roll back backups to last known good state. Worth every penny when something like this happens.  No help in this particular instance, however.

Edited October 24, 2021 by dcbc

[LosIllini 91]

Been using Backblaze to backup files for a couple of years--- works well in the background, and doesn't seem to be a resource hog.

I also use Macrium Reflect to do daily system images to an external server.  Had to reinstall my whole system one time, when windows 10 update decided to corrupt my machine.  Worked perfectly.

[Homercles 10206]

On 10/22/2021 at 3:49 PM, conVINCEd said:

I’m off the hook.  He decided I wasn’t moving quick enough, so he took it to “some guy” with a shop in a strip center who has fixed things for him before.

Plot twist…”some guy” sent him the original infected link.  

Edited October 25, 2021 by Homercles

[Modessit 5666]

Assuming a PC and not Apple, this is where still knowing DOS comes in handy. Assuming the actual files aren't encrypted and fucked beyond recovery, I'd just bypass any OS and go straight to a Command Prompt and copy off all personal files then do a reformat of the hard drive and reinstall the OS. Open each copied file in a shell to make sure they don't have a Trojan piggybacking and you're good to go.

Then make sure you have a good anti-virus program that prompts before any registry change and tell Dad to call you if that prompt ever comes up.