Ransomware: the signs and what to do
Ransomware is malware that locks your files by encrypting them and then demands money for the key. It usually arrives through an email attachment, a fake download or a security hole in software that was not updated.
Signs of an attack
- Documents and photos no longer open, or their names suddenly end in an unknown extension.
- A new text or web file appears in many folders with instructions on how to pay.
- The PC becomes very slow while the drive is constantly busy.
What to do at once
- Disconnect the PC from the network: unplug the cable and switch off Wi-Fi, so the malware cannot reach other devices or shared folders.
- Do not pay. Paying does not guarantee you get your files back, and it funds the next attack.
- Do not delete anything yet. Take photos of the ransom message with your phone; they help the police and specialists.
- Report it to the police. In Germany every police force accepts reports online.
- Check for a free decryption tool at nomoreransom.org, a project of police forces and security companies.
- Restore from your backup once the PC has been cleaned or reinstalled.
Be ready before it happens
The best protection against ransomware is a backup the malware cannot reach. A simple rule: keep at least one copy of your important files on an external drive that you connect only to make the backup. Add updates and care with attachments, and most attacks lose their power.
How Malzox helps
Malzox watches your Documents, Desktop and Pictures for a program that suddenly changes or renames many files, as ransomware does. It pauses that program and asks you to stop or allow it, or stops it straight away if you choose that in the settings. Files changed before the program was caught are not restored, so a backup stays important.