Netcore-IT

Info for the day :)

What is Ransomware?

Ransomware is the generic term for any malicious software that, as its name suggests, demands a ransom be paid by the computer’s user. Generally ransomware has done something unpleasant to your computer, and potentially to your data.
For instance, it might have encrypted your documents and demanded that you pay a ransom to unlock access to them. This type of ransomware is known as a filecoder. The most notorious filecoder is Cryptolocker.

How would my computer get infected by ransomware like Cryptolocker? A typical method of infection would be to open an unsolicited email attachment or click on a link claiming to come from a trusted source.

What can you do about it?
1. Backup Backup Backup!
The single biggest thing that will defeat ransomware is having a regular backup regimen, to an external drive or off-site backup service.
2. Do not open attachments you were not expecting, or that are from unknown sources.
This should be a given, but sometimes the emails look legitimate, or may be coming from someone you know. If you don’t know, then ask before moving forward.
3. Make sure your software is patched & updated.
Malware authors frequently rely on people running outdated software with known vulnerabilities, which they can exploit to silently get onto your system. For additional tips to protect you & your data click here.

Does antivirus software protect me from Ransomware?
Majority of antivirus software products will NOT prevent the attack itself, and are generally the last line of defense. Cryptolocker is detected by ESET, however it would only detect the virus after it has encrypted your files; the reason for this is that encryption is an allowed functionality of Windows. i.e. You receive a file attached in an email which appears a a PDF, ZIP etc. and once you've opened the file and allowed the program to run, it creates a process within Windows to start encrypting the files.

The virus signature then gets attached to the files/OS, which is identified by ESET and then removed, but at this point it would be too late to stop the encryption from happening. We urge you to take precautions when opening suspicious attachments. Antivirus software's function is to stop a virus NOT encryption - the way encryption has been used in this attack is to mimic the behaviour of a virus.

Further information
If you are an ESET customer and are concerned about ransomware protection or think you have been targeted by ransomware, call our customer care. They will have the latest details on how to prevent and remediate ransomware attacks.

Best practice to protect yourself against data loss is with regular backups. That way, no matter what happens, you will be able to restart your digital life quickly.
:)