In recent weeks a nasty form of virus has been re-circulating the business community. Colloquially known as "ransomware," this particular type of strain infects files on your computer and then offers to fix the problem for a fee in range of a few hundred dollars.
Ransomware originated a couple of years ago but gained significant traction late in 2013 and early in 2014. A strain known as "Cryptolocker" infected numerous businesses and government agencies in that time frame, until a solution was found in May. Recently, however, newer versions of ransomware have reappeared with a vengeance.
Most ransomware works by searching your hard drive and attached network drives and encrypting files it "knows" how to manipulate. Typically, we’ve seen word processing files, spreadsheets and even common accounting software files, such as Quickbooks, fall victim to this virus.
When you try to access an infected file, a message pops up, informing you that the files can be decrypted, how much it will cost and whom to pay. Typically the fee is $500 if you pay within the first seven days of infection, and $1,000 after that. The fees must be paid in bitcoin.
Most folks’ first reaction is to try to fix the problem. The bottom line is that the only way to resolve a ransomware infection is to restore your data from a backup. Of course, this backup must be taken before the actual infection. On top of that, one must first eliminate the source virus from all involved systems, otherwise you will simply get re-infected.
Should you pay the ransom? Of course, most folks can’t stand this idea. In many cases, however, $500 or even $1,000 can be a small price to pay. Factoring in the cost of labor of your IT staff, the magnitude of the infection, the complexity of your network and the lost productivity of your entire user community, the actual cost to recover, without paying the ransom, could be several orders of magnitude greater than the actual fee itself. In a rather ironic twist, anecdotal evidence suggests that paying the ransom always solves the problem.
How do you prevent being held hostage? Quite simply, by practicing the diligence that industry experts have been preaching for years. Ensure that your antivirus software is functioning and up to date. Even free versions of antivirus software help prevent ransomware attacks.
Of course, users have to be careful as well. Ransomware typically comes in as an attachment to an email, so don’t open attachments if you don’t know who the sender is, and be careful even if you do know the sender.
Furthermore, make sure you have an adequate, tested backup strategy so that if you do get infected, you can restore your files quickly and easily.
John Agsalud is an IT expert with more than 25 years of Information Technology experience in Hawaii and around the world. He can be reached at johnagsalud@yahoo.com
