47

I just discovered that my files have been encrypted by ransomware.

  • Can I get my files back? How?
  • Should I pay the ransom?
  • What should I do so that this never happens again?
  • 15
    This is a canonical question to use as a duplicate target. See this meta discussion: security.meta.stackexchange.com/questions/3349/… – Anders 2 days ago
  • 2
    Are the files really encrypted, or is it just the ransomware telling you so? There are some out there that just pretend they are and (through other means) block access to your files, but didn't actually touch them. – jcaron 2 days ago
  • I do encourage more people to post answer. My answer was in no way meant to be the only one or the definitive one. – Anders 2 days ago
  • @R1W You have this backwards. That question should be marked as a duplicate of this one. – Joseph Sible-Reinstate Monica yesterday
43

Can I get my files back? How?

Maybe.

If you have backups, you can restore your files from there. Just make sure to completely reinstall your operating system first, i.e. "nuke from orbit", to remove the malware first. If you don't do that, you will just get infected again.

If you don't have backups, things get a bit more tricky. Some ransomeware has been beaten and its encryption can be reversed. Others have not. To find out if you are lucky, you can use a decryptor (e.g. The No More Ransom Project, Kaspersky's No Ransom). They offer a service that helps you identify what strain of ransomware you have, and let you know if there is a tool to decrypt your files.

If you are unlucky and your ransomware is not on the list, you can backup the encrypted files on an external drive (with nothing else on it, it might be infectious...) in the hope of a future cure. But there is a real risk that your files are just irreversibly gone forever.

Should I pay the ransom?

No.

First of all, there is no guarantee that you will get your files back - there is no honor among thieves. Some forms or ransomware doesn't even bother to encrypt the files - it just replaces it with random junk to make it look encrypted. Obviously, paying in a situation like that does not help.

Second, you will be financing organized crime and creating incentives to create ransomware in the first place.

What should I do so that this never happens again?

Apart from general good computer hygiene (don't download strange stuff, keep things updated, etc.) there is one killer solution to the ransomware problem: Make frequent external backups.

  • 49
    Do you have any data to back up the claim that "you probably won't get your files back"? An article I've found in ZDNet (April 2019) says that "96 percent of the time, paying the ransom results in the victim receiving the decryption tool, with around 93 percent of data recovered" [ zdnet.com/article/… ] – reed 2 days ago
  • 3
    Not sure if it's a typo or not but should it say "...some forms of ransomware don't even bother..."? – Kodos Johnson 2 days ago
  • 4
    @reed That's the importance of offline backups. I also see a common misconception that copying folders, naive rsync, etc. counts as a backup; it doesn't. If you make a mistake (change the contents of a file, delete a file, have your files encrypted, etc.), such processes will indiscriminately overwrite your backups with the new (bad) files. – Alexander - Reinstate Monica 2 days ago
  • 16
    @johndoe, if you had any file(s) worth $200 million and no clean, reliable back up of it...I'm not sure what to tell you. – Seth R 2 days ago
  • 11
    @johndoe If I had 200 million dollars file, I would not be taking advice from internet strangers. – Anders 2 days ago
15

Should I pay the ransom?

The inclination here is to post an emphatic HELL NO, tell them where they can stick their malware, and bid them a good day. No payouts for you, Mr. Neer-do-well! The company I work for was hit by the original cryptolocker (circa 2013) and we were able to do just that thanks to a simple but effective use of Windows Backup.

Odds are, if you're here, you don't have one. Or you thought you did, but... well, stuff happened. I disagree with Anders' answer on this point

First of all, you probably won't get your files back

Now this can be true (there's always the one-off morons doing this just because they can), but most people doing this stuff want money. If there were a widespread reputation that people didn't get their files back far fewer people would pay up. There is, at least, a decent chance you can get your files back, but like any media failure, you have to ask yourself this question:

Can I afford to lose the files?

If so, don't pay up. Take your painful lesson, backup in the future and move on. Problem solved

For a decent chunk of the people out there, the answer is probably NO. Like, maybe you work for a city/state/federal government agency and all your digitized records are at stake.

I'd love to tell you there's a magic service that can unencrypt your files, but, alas, even those who sell such services often pay up

Storfer said he’s been told by the FBI that Proven Data’s staff used to rely on “canned responses” that gave clients two options for data recovery. The first was paying the ransom. The second option was to unlock the files using Proven Data’s technology. Unbeknownst to clients, Storfer said, the second option didn’t exist. If they chose it, Proven Data paid the ransom anyway.

The ransom may be your only way if the files must be restored

The prospects are grim otherwise

[O]rganizations have limited options when it comes to fighting back. The most obvious route, if backups are available for affected systems, is to simply restore the affected files. But with embedded computing devices and some other systems, backups may not be an option. Organizations could also use security gateways to try to block Tor traffic to prevent some crypto-malware from obtaining encryption keys, but Schowenberg notes that Tor-blocking "is not a solution to all ransomware problems"—and it might become less of a solution as attackers choose less-detectable communications methods. In some cases, companies have been able to mount an active defense with the help of law enforcement or security researchers.

But this can be a slow and expensive process. one that is problematic when time-sensitive data is involved. So, for companies and organizations without the wherewithal to reboot and restore their systems, paying up may be the least of the possible evils—especially if they can just sweep it under the rug afterward.

Paying up can work

Three Alabama hospitals have paid a ransomware demand to the criminals who waged a crippling malware attack that's forcing the hospitals to turn away all but the most critical patients, the Tuscaloosa News reported.

But wait! That's supporting crime!

Yes, it is. And it really REALLY stinks. Those are your options. You either have a backup, you walk away from the data, or you pay up and cross your fingers. The reason I even suggest it at all is the criminals have an incentive to ensure your files are returned. Just remember, that Anders was 100% correct when he also said this

there is no honor among thieves

Good luck. You're going to need it. And if you've never been hit, you'd best check your backups are working and restorable.

  • 2
    The biggest problem I see with paying is that you can't really trust any of those files. They could include exploits or payloads that make you vulnerable to the same attack in the future. – pcalkins yesterday
  • @pcalkins I know it. I just don't want people to think not an option either (some chance is better than none). If you're stuck, it might literally be your only option. – Machavity yesterday
  • If you're going pay to unencrypt, going forward I would segregate all future backups. Don't keep old decrypted data with new. You simply can't trust the machine that holds that data... so you'd need to quarantine that machine and it's data and any backups of it forever. – pcalkins yesterday
5

Most of the ransomware attacks directed at US computers originate from countries which used to make up the USSR, to include Russia. I personally got hit with one of these about 3 years ago. It locked all my files, and booted a wordpad note saying I'd been hacked, and auto-took me to several websites saying I'd been hacked and demanding ransom. They wanted several hundred dollars in bitcoin and had a handy "type questions here regarding bitcoin accounts" where someone would actually get on and chat to talk you through getting and sending bitcoin. Knowing that these hackers generally avoid russian-based computers (because Russia don't care if you hack someone else, just don't do crime there.) I decided on a desperate gambit. Instead of asking a bitcoin question I sent, "Your attack in interfering with the ongoing operations of the Russian Federal Security Service. You have 48 hours to return access to this machine or actions will be taken against you." Lo and behold, the next day my computer was unlocked! Mind you it wasn't a clean "erasure" of the virus, as whenever I start my computer I still get a popup of the notepad doc saying I've been hacked. Can't figure out how to ditch it. But haven't had another problem apart from that and all my files were unlocked.

So say you don't have a chatbox/don't want to try it. Will paying get your your stuff back? Yes. Should you? Depends. You're very likely to get your computer unlocked if you do, but how do you feel morally about being extorted by sleazebags? Every success just makes them more likely to keep on trying.

New contributor
Eriol is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 14
    This is a cute anecdote, but it doesn't answer the question. – Ben Crowell 2 days ago
  • 10
    Wait, are you saying you're still using the same computer with the same pop-up instead of reloading everything? Seems very dangerous... – Kat 2 days ago
  • 2
    did ransomware author write this answer – aaaaa says reinstate Monica 2 days ago
  • Technically, it is a valid answer: "I wrote them to say that I was Russian police, and it worked". It's highly doubtful that it's true and it is highly situational and highly dependent on a number of factors, but, as far as a Q&A site goes, it hits all the requirements. – schroeder yesterday
-3

One day I found that every non-text file on my Windows 7 computer was encrypted with a ransom note placed in every single folder. I defeated the encryption by rolling back the driver.

New contributor
apcris is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 7
    "by rolling back the driver" - Which driver? How did you roll it back? Did you mean "drive"? A driver is something else entirely and "rolling back" one is highly unlikely to help at all. And, if you meant "drive", you mean you basically just restored from a backup, as per the top-voted answer? – NotThatGuy yesterday
  • The only part of your answer that remotely answers the question is the bolded sentence, but it makes no sense and it requires a lot of detail. Please edit your answer to include the details of the solution you used. – schroeder yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.