Tech Wednesday – CryptoLocker Ransomware

by John | Nov 9, 2020 | Best Practices, Instructor Tech Help

Strategies for protecting the health of your Mac or PC computer, from the malware know as CryptoLocker, isn't really much different from what you do to protect your personal health; you're careful with what you consume and have some insurance in place for when you get sick. As a fitness professional, you depend on your body to earn some or all of your income. If it breaks you're screwed. Your Dept Head will only except you teaching off the bike for so long, before deciding to replace you.

You are also very dependent on your computer for managing your music and communicating through email and social media – so if it fails you have a similar problem.

In case you haven't heard, CryptoLocker is a nasty piece of malware (virus) that can infect your computer – YES, Mac users are just as susceptible as PC owners. CryptoLocker encrypts (scrambles) your files so they can't be opened… ever…by even the NSA… unless you send the hacker $300.00 for the key to unlock the encrypt files.

This article from Forbes explains the threat –Computer Virus Spreading That Means You Never Get To See Your Files Again

However, there are trojans out there that have surprising and nasty behaviours like encrypting your files with a password you don’t have and demanding money to unlock them. This kind of malware is not new but over the past 18 months it has become significantly more prevalent and the malware authors have written significantly more clever and scary versions.

This kind of malware is now all over the web and your chances of running in to it and being exploited are uncomfortably high. Some of the more widespread examples such as CryptoLocker even include a count down timer which claims if you don’t pay them $300 in 72 hours they will delete the key file so that your data is lost forever. Malware like this is growing more scary day by day including the ability to encrypt all your data but also to spread over the network and hit other systems.

You can search in vain for a solution, but there is no know remedy to recover your encrypted files if you get infected. Well except by paying the ransom demanded by the hacker – yes, believe it or not, these are honest hackers. Most do send you the encryption key after they receive your $300.00.

Preventing CryptoLocker – don't click that link!

As scary as it sounds, any link you click could install the CryptoLocker virus (or other malware) on your computer. The trick is not clicking that infection link in the first place. The primary places you find those links is in SPAM email and garbage websites offering free nonsense; games, software and (wait for it) FREE MUSIC DOWNLOADS. Don't go there and you're 50% guaranteed that you won't have to send that $300.00 to recover your 10,000 songs in iTunes.

Long time readers have heard me implore you to use strong passwords for your email accounts. NOTE: you must have listened because I'm seeing far fewer SPAM emails, sent from hacked accounts. CryptoLocker doesn't get installed in your computer by hacking your email, no, but the SPAM emails going to all your friends in your contact list. Most people have learned to ignore an email that says; “Hi there. I saw your picture on facebook and think you're cute. Click this link to see pictures of me!” But a few haven't.

But what if I am infected?

Beyond sending the $300.00, the only known option is to completely wipe your computer clean / restore to factory settings and restore from a backup that predates the infection. If your last manual backup was two years ago – then that's what you'll have to work from. Sorry, there is no other solution 🙁

If you're using an automatic backup service to the cloud; Carbonite, TimeMachine, Windows Backup, etc… you're in luck. All of those services have multiple restore points – you can go back in time to before you were infected, and recover those old, encrypted files. But only after you've first wiped your computer clean so the files you re-import aren't reinfected.

I copied this from Carbonite's help page that explains:

• Restoring a previous version of a file lets you correct any accidental changes.
• Each day a file is backed up, Carbonite maintains a version of that file.
• You can view up to 12 versions of a file to restore (depending on how many times the file was backed up and how long ago it was backed up).
• You can restore a file you have deleted from your computer hard drive (as long as the file was deleted within the last 30 days).

Originally posted 2013-10-30 10:38:53.