Questions tagged [ransomware]

Ransomware is a lethal kind of Malware that Encrypts your harddrive(s) and holds them hostage, providing the decryption key if you pay the hostage-taker(s) money (well-known variants are the FBI Virus and the Police Virus).

Filter by
Sorted by
Tagged with
4
votes
2answers
2k views

Ransomware - Full disk wipe versus formatting

Typically when I encounter ransomware/cryptoware on a device I will fully wipe the drive(s) with at least one pass using a utility such as DBAN. I sometimes wonder if I am overestimating the potential ...
26
votes
3answers
33k views

Does WannaCry infect Linux? [duplicate]

After reading this question, now, I am wondering if WannaCry malware can infect Linux OS especially Ubuntu. One of the answers talked about SMB2 and windows. Does it mean a Linux based computer is ...
1
vote
1answer
253 views

Can ransomware run without prompting user? [duplicate]

That is, a user downloads attachment from email and runs it, will the ransomware run silently without showing the security prompt/UAC (that should block non-administrator users...)
246
votes
10answers
81k views

How is the “WannaCry” Malware spreading and how should users defend themselves from it?

There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names. It ...
1
vote
1answer
696 views

How to detect Ransomware [closed]

I have installed a SIEM on my company that is based on Alienvault USM correlation rules. How can I detect Ransomware activity on my network? I already enabled Suricata IDS on all of my network ...
0
votes
0answers
640 views

How are ransomware keys found?

I'm familiar how ransomware works and how they encrypt the files. If the encryption is done by a public key only (which the private is saved at the attacker's server), you cannot decrypt those files ...
1
vote
2answers
126 views

Can an application modify files that are in a password protected folder?

Specifically regarding Win 10 and this method of password protecting a directory. Would a malicious application be able to modify files placed in this directory or would it be stopped? Thanks for ...
1
vote
0answers
144 views

How can I decrypt a ransomware encrypted imme files [closed]

I have tried multiple online available ransom decryption but they don't seem to be working, can you please guide which tool can assist me? I have attached the encrypted files snapshot with this post. ...
3
votes
2answers
690 views

Security vulnerabilities when sharing files between virtual machine and host

According to this link, when running a windows OS virtual machine on a windows host OS, one can share files like one would share files between two computers on a network by ensuring that file sharing ...
2
votes
2answers
459 views

Rename important files to any file type to protect from ransomware

Is it a good solution that rename an important files to a new file type that only owner od the file know? like Data.Rar rename it to Data.BEATURAN, so it will become BEATURAN File and just rename ...
4
votes
0answers
376 views

How to deal with Sage Ransomware 2.2 infection?

My PC got stuck like this: It's a Sage 2.2 Ransomware. How do I fix this? Does restoring the system help me?
0
votes
1answer
279 views

Company name is used in Dropbox invoice scam

People, not employees or users, just ordinary people with no relation to us, have been getting scam emails, prompting them to open and download a link from Dropbox. I think this link contains files ...
8
votes
2answers
4k views

How to recover from ransomware using Restore Points?

While reading about ways to recover from a ransomware on a Windows machine it's often recommended to use the System Restore functionality, e.g. to restore from a Restore Point. I know that the ...
0
votes
1answer
260 views

SVG virus/ malware with an extension on Google Chrome (one) [closed]

This question is about the SVG virus malware I got through Facebook, which adds a malicious Google Chrome extension. It's called one or ubo. Some articles write that it is ransomware. I think I ...
9
votes
5answers
337 views

Could ransomware be stalled while encrypting?

I have been reading about ransomware, and I was wondering if it could be defended against by having certain "trap" files on a drive. Sometimes I look through Code Golf and am thoroughly impressed by ...
0
votes
1answer
310 views

Ransomware note found - cannot find encrypted files

I have a note on my machine which indicates that my machine has ransomware on it. I've done a system restore of my machine back several weeks, and each time the files keep coming back. My files are ...
0
votes
1answer
313 views

Affected by Marlboro Ransomware (“.oops” extension) - Which decryptor to use to decrypt the files?

My friend got infected by "Marlboro" Ransomware (description of the nasty thing: http://sensorstechforum.com/marlboro-ransomware-remove-restore-oops-files/). I have researched online, and a way to ...
6
votes
2answers
1k views

Why isn’t Secure Boot protecting against ransomware like PETYA

Some ransomwares, like PETYA, are encrypting the MBR and asking for a ransom. I don’t understand why Secure Boot isn’t preventing that of happening.
3
votes
4answers
1k views

Where to find ransomware samples to make demonstrations?

I'm looking for some ransomware samples that work on Linux so that I can show a proof of concept with Qubes OS on how one's other virtual machines can be safe from a ransom attack if a single virtual ...
2
votes
2answers
718 views

Can a ransomware “destroy” git remote repositories?

Instead of a backup, i store my important documents (my resumee, certificates and such) in a git repository - which is then pushed to sth like github. My reasons for using git instead of an backup ...
0
votes
3answers
170 views

How to keep client data confidential when attacked by a ransomware?

Hypothetical scenario: If a ransom-ware attack was to happen which threatened to make public "private client data" if you didn't pay up. Assuming such a virus exists and you've already been infected,...
1
vote
4answers
482 views

A ransomware locked my operative system on C. Are the other drives at risk?

I think I have a ransomware avoiding me to access Windows, for each time I restart my PC Windows boots but no login window appears and I cannot perform any operation but selecting the power and the ...
3
votes
2answers
326 views

Will ransomware reach an air-gapped computer?

I'm doing some research and wondered since ransomware allows a user a decryption key- how that would be possible if it is not on a network? 12/23 Edit: After learning how ransomware works I'm now ...
4
votes
1answer
202 views

Simple, malware-resilient, automatic Windows backup (or: How should the average small company protect their Windows server?)

I am trying to devise a backup strategy for a Windows server, and I'd like it to satisfy the following criteria: It should be resilient to malware: If ransomware takes over the server, it should not ...
2
votes
2answers
441 views

Protect backup from ransomware [duplicate]

I'm planning to (finally) backup all my personal files from my home network on a new HDD. If I'd use an external HDD with USB cable the ransomware would theoretically encript these data too. Would ...
0
votes
2answers
73 views

Is there external service which can detect ransomware?

I am thinking about ways of protecting against ransomware other than backing up all data. So i thought is there such service which could scan trough emails and find does email contains links or other ...
-2
votes
2answers
797 views

Is it possible to break any encryption by knowing the data that was encrypted? [duplicate]

I have very basic Idea about encryption/decryption and was wondering if we can break any encryption using this method. By break I mean to retrieve the encrypted data and the key.Possibly finding ...
66
votes
3answers
13k views

How does ransomware get the permissions to encrypt your disk?

Recently, my employer blocked access to Gmail, Yahoo Mail, etc., because an employee downloaded an email attachment which contained ransomware and got their disk encrypted. QUESTION : How does ...
17
votes
4answers
13k views

Do Linux systems need antivirus against ransomware? [closed]

I use Linux to store private data and backups for my team because it is said that Linux is itself very secure from malware and doesn't need antivirus. But now as ransomware is spreading and has ...
26
votes
4answers
9k views

How to decrypt .lock files from ransomeware on Windows [closed]

I am helping a friend which is an accountant and got all of her books locked due to this. Here are some details: BTC address of the attacker: 1MBwkTssJkqRvXmAFcSEZ3xTD39A9rkyYA Email: helptoyou1@...
2
votes
0answers
36 views

Ransomware Type of Virus and How to prevent it (Zepto Virus) [duplicate]

My computer had been hit by a Zepto virus which is a type of ransomware. All my files had been encrypted to a file that cannot be opened by any applications. It only hits all my office document files. ...
6
votes
3answers
2k views

Ransomware-resilient Linux Samba file server

Imagine the following scenario: Files are kept on a Linux server and clients access them via Samba. One of the client machines gets infected with ransomware, which encrypts everything within the ...
2
votes
1answer
307 views

Can I hook “vssadmin.exe delete” process?

I'm studying and listing ransomware family.(like CryptoWall, TorrentLocker, CTB-Locker, .etc) When I read the features of those family, they do vssadmin.exe to delete shadow copies of victim's PC so ...
0
votes
1answer
142 views

Possible Ransomware Infection, want to clarify some things [duplicate]

I am not sure whether ransomware attacked a pc in my home setup. An adware popup came up and locked the browser however i ended the process and ran my av, nothing was detected. There were usb drives ...
0
votes
1answer
115 views

Do backups with application-level authentication defeat ransomware?

While having "too much time" and after some careful thinking from my side, I kinda "found" that if you authenticate at application level, ransomware would have to carefully analyze all known settings ...
-2
votes
2answers
264 views

How to stop cryptolocker attacks? [duplicate]

There are many crypto viruses being launched and this crypto virus is very painful for any system. All your data, songs, movies, pictures, and many other docs and project files are encrypted. How to ...
1
vote
1answer
413 views

A few files on a domain controller were encrypted - how could that have happened?

I've just realized that the policies on one of our Windows domain have been failing. I've traced the problem and it turned out the INI files were encrypted by Globe ransomware (or one of its variants)...
21
votes
5answers
8k views

How can ransomware know file types?

When ransomware searches the victim's files in scanning step, how can ransomware know the types of files? It can check the file name (e.g. book.pdf) or file signatures. What I'm wondering is when ...
2
votes
1answer
135 views

Write protect a partition

I have an HDD partition that contains a Karaoke song library of 400 GB. Backing it up is cumbersome at best and requires a large external drive and hours of time. The library is the only thing on the ...
0
votes
1answer
291 views

JavaScript Malware attack vector

I've been reading a bit lately about pure JavaScript ransomware attacks. The Sophos seems to imply that this a a browser based attack and that you're infected by only visiting the site. I can't ...
0
votes
2answers
569 views

How can I get notified about the publishing of ransomware decryption keys

My computer had been hijacked by "Cryptolocker" a ransomware you might be well aware of. The nasty ransomware has encrypted most of my documents and video files. I used an anti-malware and removed the ...
3
votes
2answers
254 views

Being anonymous with bitcoin

In the recent ransomware attacks, attackers have asked the targeted organizations to pay them in bitcoins. How can they be anonymous if they deal in bitcoins? Can they convert bitcoins to any other ...
0
votes
4answers
4k views

Can I decrypt files encrypted by Odin ransomware?

My system, excel, rar and zip files are encrypted by Odin ransomware and my ethics never allow me to pay ransom to thieves. I tried recovery softwares but only recovered old deleted files - no ...
9
votes
4answers
4k views

Will password protected files like zip and rar also get affected by Odin ransomware?

If I protect my files with password and use rar or zip files to store these files. Can ransomware encrypt password protected files?
3
votes
1answer
310 views

Is overwriting the entire hard disk (e.g. with `dd`) sufficient to ensure that ransomware has been removed?

Appologies if this is the wrong place to ask this question. I have/had a computer infected with ransomware. I have just used a linux live cd and used the command dd if=/dev/zero of=/dev/sda bs=1MB ...
0
votes
1answer
593 views

How to decrypt file that was attacked by ransomware? [closed]

there are a ransomware attacking on of my computer and most of the file has been renamed to something like id-2832SGndfDcbv.supportfriend@india.com.xtbl The file isn't corrupted as the file still ...
0
votes
1answer
280 views

Ransomware encrypted first 64 kB of file

I heard about a ransomware virus going around that encrypts only the first 64 kB of a file. If I was infected with this, would it be realistically possible to retrieve my files?
4
votes
1answer
656 views

Is malware known to mount volumes?

I have several Windows machines that do automatic backups to external or internal backup drives. This happens automatically during off hours, and it needs to stay that way with no manual intervention ...
-1
votes
1answer
2k views

What file extensions do ransomware encrypt? [closed]

Is someone have a generic list of files that payment walls encrypt? I want to build software to protect only those kind of files. I know that this changes from time to time. Let me know if the list ...
30
votes
8answers
9k views

Is Windows 10 backup safe from ransomware?

Windows 10 stores its backups in a protected folder, e.g. E:\System Volume Information, and only the SYSTEM account has full access to it. Does this make it safe from ransomware that encrypts files? ...