Your computer has been infected by ransomware. All those files — personal documents, images, videos, and audio files — are locked up and out of your reach.
There may be a way to get those files back without paying a ransom. But first a couple of basic questions: Do you you have complete backups? If so, recovery is simply a matter of wiping the machine — bye bye, ransomware! — reinstalling your applications, and restoring the data files. It’s a little stressful, but doable.
Are they good backups? Even if you did the right thing, backups aren’t foolproof, as legions of traumatized users have discovered. Unfortunately, this may be hard to determine without a full restore, so be aware that the wipe-and-restore method carries some risk.
[ Wait, is that fake ransomware or the real thing? Here’s how to tell and what to do about it . | Make threat intelligence meaningful: A 4-point plan . | Discover how to secure your systems with InfoWorld’s Security newsletter . ] If you answered no to either question, don’t throw in the towel and pay the ransom yet. Maybe — maybe — there’s a decryption tool that can get you out of this jam. But before we examine that option, let’s run through what you should do step by step. 1. Isolate the infection
The first step, once you’ve been infected, is to immediately disconnect the infected computer from the network. Turn off wireless networking and Bluetooth. Disconnect from all peripherals, cloud services, and external hard drives. This ensures the infection can’t spread — and prevents the malware from communicating with the mothership. It buys some time, and when the ransom note threatens to increase the payment if you take too long, every second is precious.
Remember the clock is ticking. The bad […]
