Block, SkipCaptcha, Upload, Automoderated users, Check users, delete, edit, Moderators, move, oversight, protect, ratelimit-exempt, rollback
19,940
edits
Changes
Avoidance
*TeslaCrypt (attacked [[video games]])<ref>https://www.hackread.com/famous-games-hijacked-for-ransom-through-teslacrypt-ransomware</ref>
*TeslaCrypt (attacked [[video games]])<ref>https://www.hackread.com/famous-games-hijacked-for-ransom-through-teslacrypt-ransomware</ref>
*WannaCry (attacked entire Windows systems)<ref>http://bgr.com/2017/05/15/wanna-cry-ransomware-virus-windows-wannacry-explainer</ref>
*WannaCry (attacked entire Windows systems)<ref>http://bgr.com/2017/05/15/wanna-cry-ransomware-virus-windows-wannacry-explainer</ref>
==Avoidance==
To avoid ransomware infections, all of the basic safety habits should be practiced. Unknown links should never be clicked, untrusted software should never be installed, e-mail messages from unrecognized senders should never be opened, and so on. However, some ransomware is delivered by worm, so even if everything is done right, an infection can still take place.<br />
Usage of anti-malware software can help significantly in preventing an infection. Basic anti-virus and other anti-malware programs can be useful, since they detect known signatures of ransomware (and other malware) and block them. Heuristic (behavior-based) protection can also be helpful, as it can sometimes detect malware which is not otherwise known. Larger computer systems such as those used by corporations also can benefit from the newer defense method of Deception technology.
==Mitigation==
==Mitigation==
When an individual needs to deal with a ransomware infection, backups become vital. Since most ransomeware uses encryption, data on targeted devices is often impossible to recover unless the ransomware publisher provides the decryption key. Even with backups, users must be careful during the recovery process.
When an individual needs to deal with a ransomware infection, backups become vital. Since most ransomeware uses encryption, data on targeted devices is often impossible to recover unless the ransomware publisher provides the decryption key. Even with backups, users must be careful during the recovery process.
===Preparation===
===Preparation===
Computer users should be sure to regularly back up their personal files on external drives. USB Flash drives, external hard drives, and other such devices can be used for this purpose. In between backups, the drive(s) should always be kept disconnected from that computer, and preferably all others as well.<br />
Computer users should be sure to regularly back up their personal files on external drives. USB Flash drives, external hard drives, and other such devices can be used for this purpose. In between backups, the drive(s) should always be kept disconnected from that computer, and preferably all others as well.<br />
Ideally, the individual will also create complete system backups periodically. This can be done using software such as DriveImage XML. These disk images should be stored on a separate storage device as well, and only connected to the computer at risk when backups are being created. If possible, it is also wise for the individual to keep older images, in case the more recent images were infected, or are for some reason corrupted.
Ideally, the individual will also create complete system backups periodically. This can be done using software such as DriveImage XML. These disk images should be stored on a separate storage device as well, and only connected to the computer at risk when backups are being created. If possible, it is also wise for the individual to keep older images, in case the more recent images were infected, or are for some reason corrupted.
===Cleanup===
===Cleanup===
To begin recovering a personal computer from a ransomware infection, users should begin by isolating the effected computer. It should be disconnected from the Internet and any local network. Any flash drives, external hard drives, and other editable storage devices should be disconnected from the computer as well. The following are some possible steps which could be taken.
To begin recovering a personal computer from a ransomware infection, users should begin by isolating the effected computer. It should be disconnected from the Internet and any local network. Any flash drives, external hard drives, and other editable storage devices should be disconnected from the computer as well. The following are some possible steps which could be taken.
====Using disk image====
====Using disk image====
#Once isolated, try starting up the computer to the recovery CD, DVD, or flashdrive bootable device. For example, if DriveImage XML was used to create the image, use a boot CD such as [[Hiren's BootCD]] or [[UBCD4Win]]. ''(Note: the users should ensure they can boot to the external media before connecting their backup drive. In Hiren's, simply start up, then connect the drive. In UBCD, boot up, then shut down, connect the backup drive, then start the boot disk again.)''
#Once isolated, try starting up the computer to the recovery CD, DVD, or flashdrive bootable device. For example, if DriveImage XML was used to create the image, use a boot CD such as [[Hiren's BootCD]] or [[UBCD4Win]]. ''(Note: the users should ensure they can boot to the external media before connecting their backup drive. In Hiren's, simply start up, then connect the drive. In UBCD, boot up, then shut down, connect the backup drive, then start the boot disk again.)''