Timeline for What should you do if you catch encryption ransomware mid-operation?
Current License: CC BY-SA 3.0
52 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 6, 2017 at 8:22 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 20 characters in body
|
| S Sep 22, 2016 at 21:24 | history | bounty ended | Fiksdal | ||
| S Sep 22, 2016 at 21:24 | history | notice removed | Fiksdal | ||
| S Sep 16, 2016 at 9:20 | history | bounty started | Fiksdal | ||
| S Sep 16, 2016 at 9:20 | history | notice added | Fiksdal | Reward existing answer | |
| Aug 15, 2016 at 3:39 | answer | added | Mars | timeline score: 1 | |
| Aug 14, 2016 at 21:41 | answer | added | atdre | timeline score: 4 | |
| Aug 7, 2016 at 13:14 | history | edited | Fiksdal |
edited tags
|
|
| Aug 7, 2016 at 8:57 | history | edited | Fiksdal | CC BY-SA 3.0 |
edited title
|
| Apr 28, 2016 at 4:43 | comment | added | Fiksdal | @RossMillikan This has now been discussed in detail here: security.stackexchange.com/a/121711/105562 | |
| Apr 25, 2016 at 11:25 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 34 characters in body
|
| Apr 21, 2016 at 16:07 | comment | added | Daniel C | "What should you do if you catch ransomware mid-operation?" -- (1) Quickly pull power cord. (2) Realize nothing happened so press power button until laptop shuts itself off. (3) Go to different machine and use favorite search engine to understand how to proceed from there. | |
| Apr 21, 2016 at 8:47 | answer | added | CoffeDeveloper | timeline score: 0 | |
| Apr 21, 2016 at 5:25 | comment | added | Fiksdal | @RossMillikan I thought this was so interesting that I asked it as a separate question: security.stackexchange.com/questions/121080/… | |
| Apr 21, 2016 at 4:53 | comment | added | Ross Millikan | My impression is that ransomware encrypts data into new files and does not erase the old files until the encryption is complete. This is so you don't discover the problem part way through by calling upon a file that has been encrypted and rescue your remaining data. If so, just shutting down the computer and mounting the disk to another machine should let you recover the data files. | |
| Apr 20, 2016 at 4:30 | vote | accept | Fiksdal | ||
| Apr 20, 2016 at 3:09 | vote | accept | Fiksdal | ||
| Apr 20, 2016 at 4:30 | |||||
| Apr 19, 2016 at 13:38 | history | protected | Rory Alsop♦ | ||
| Apr 19, 2016 at 9:48 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 14 characters in body
|
| Apr 19, 2016 at 9:43 | history | edited | Fiksdal | CC BY-SA 3.0 |
edited title
|
| Apr 19, 2016 at 8:53 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 70 characters in body
|
| Apr 18, 2016 at 12:12 | answer | added | Tomáš Zato | timeline score: 9 | |
| Apr 18, 2016 at 9:18 | vote | accept | Fiksdal | ||
| Apr 20, 2016 at 3:09 | |||||
| Apr 18, 2016 at 9:04 | vote | accept | Fiksdal | ||
| Apr 18, 2016 at 9:04 | |||||
| Apr 18, 2016 at 9:02 | vote | accept | Fiksdal | ||
| Apr 18, 2016 at 9:02 | |||||
| Apr 18, 2016 at 7:53 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 11 characters in body
|
| Apr 18, 2016 at 6:31 | comment | added | Fiksdal | @D.W. Question 1 and 2 are very similar. The difference between them is that in #2 we want to tread very carefully as to not spoil our opportunity to potentially pay the ransom as an absolute last resort. IMO 1 and 2 are so similar that putting them in separate questions would be close to making duplicates, in the sense that it would fragment the discussion. As for multiple, related questions in the same post: I have seen countless questions here that do that. Can you point to a meta post or FAQ that indicates this is not recommended or allowed? If more people agree, I'll edit my question. | |
| Apr 18, 2016 at 5:56 | comment | added | D.W. | You should ask only one question per question. Please edit your question accordingly. Your first question is an answerable, technical question. I suggest you edit your question to ask only the first one, and remove the second -- you can always post the second one separately. | |
| Apr 18, 2016 at 4:30 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 2 characters in body; edited tags
|
| Apr 18, 2016 at 2:24 | review | Close votes | |||
| Apr 19, 2016 at 7:51 | |||||
| Apr 18, 2016 at 2:21 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 353 characters in body; edited title
|
| Apr 18, 2016 at 1:12 | comment | added | user1751825 | Another thing to consider is the ethics generally of paying ransoms. I'm of the opinion that ransoms should never be paid under any circumstance, as doing so encourages more criminal behaviour. | |
| Apr 18, 2016 at 0:12 | answer | added | Luc | timeline score: 80 | |
| Apr 17, 2016 at 23:12 | answer | added | Ángel | timeline score: 190 | |
| Apr 17, 2016 at 22:52 | comment | added | Vi. | My first reaction to a suspicious process is to suspend it. If it is actually legitimate process, I can just resume. If it is malware, I can, for example, inspect opened files, sockets, etc.. If the program auto-restarts itself, this auto-restart may fail to handle suspending. | |
| Apr 17, 2016 at 20:44 | comment | added | schroeder♦ | The second option does have potential legal implications that might be a tangential factor, but that does not make it a legal question. It is clearly a technical question. Do note: paying ransoms might have legal repercussions in your jurisdiction. Please consult your local laws. | |
| Apr 17, 2016 at 20:03 | answer | added | Dasya | timeline score: 16 | |
| Apr 17, 2016 at 18:30 | answer | added | Loren Pechtel | timeline score: 8 | |
| Apr 17, 2016 at 17:31 | history | tweeted | twitter.com/StackSecurity/status/721753072633004032 | ||
| Apr 17, 2016 at 17:05 | history | edited | Fiksdal | CC BY-SA 3.0 |
deleted 69 characters in body
|
| Apr 17, 2016 at 16:52 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 2 characters in body
|
| Apr 17, 2016 at 16:46 | history | edited | Fiksdal | CC BY-SA 3.0 |
deleted 1 character in body
|
| Apr 17, 2016 at 16:38 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 4 characters in body
|
| Apr 17, 2016 at 16:07 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 1 character in body
|
| Apr 17, 2016 at 16:02 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 107 characters in body
|
| Apr 17, 2016 at 15:40 | vote | accept | Fiksdal | ||
| Apr 17, 2016 at 16:02 | |||||
| Apr 17, 2016 at 15:38 | answer | added | J.J | timeline score: 58 | |
| Apr 17, 2016 at 15:26 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 63 characters in body
|
| Apr 17, 2016 at 15:16 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 5 characters in body
|
| Apr 17, 2016 at 15:16 | answer | added | Brent Kirkpatrick | timeline score: 13 | |
| Apr 17, 2016 at 15:14 | history | edited | Fiksdal | CC BY-SA 3.0 |
added 5 characters in body
|
| Apr 17, 2016 at 15:07 | history | asked | Fiksdal | CC BY-SA 3.0 |