What is Ransomware?

What is Ransomware? a reader asks…

I’ve been reading about various types of programs hackers throw at us consumers. I know about malware, spyware, adware, and computer viruses, trojans and worms, but what the heck is ‘ransomware’ and how do I protect myself from it?

The collective term for all the various bad programs that can get on your computer is ‘malware’ and most everything is a variant of that. Ransomware is a relatively new variant that you might have heard about from an episode of CBS’s “The Good Wife“. Ransomware hijacks your computer – not just your personal files but every file on the computer’s hard drive. It encrypts your hard drive so that you can’t get at any of those files without an encryption key. The purveyors will be only too happy to sell you an encryption key for a pretty penny (actually it can be hundreds of dollars). And you never know if, even after paying, whether you’ll get the right key to release your computer from the encryption.

I last wrote about ransomware in this article back in 2013, when Cryptolocker was making the rounds, although ransomware has actually been around since 1989 (but only in the last few years has become much more widespread). Since 2013, the capabilities of this type of malware have only increased and spread. New ransomware programs like CryptoWall 2.0, TeslaCrypt and TorrentLocker have popped up all around the world. My thinking is that this problem is only going to get worse.

So what do you do? The best method is prevention, which means being very careful about how you use your computer. I’ve previously published ‘safe computing practices’ in this article and this one to help you figure out exactly how to do this. But nothing is a perfect defense against the wily hacker, so you need to also make sure you’ve got a good backup of your entire system (here’s some tips on how-to). That’s so if you should contract ransomware on your computer, you can restore your backup and wipe it out. Mac users can use Time Machine (with a Time Capsule or any external hard drive), and PC users can use Windows Backup and Restore/File History, or any one of a number of 3rd party solutions. For Windows PC users, I’d suggest that you use the simplest and most foolproof method – tools that Microsoft has already built into Windows:

1. Create a System Repair Disc that can boot your computer even if Windows isn’t working
2. Create a System Image that you can use with the repair disc to restore your computer
3. repeat step 2 as often as you wish – you can use an external hard drive or thumbdrive

For my own Windows computers, I use the above method, and create that system image once a week, overwriting last week’s system image. I use a handy, Western Digital My Passport drive (you can get these at any computer supply store or online such as at Amazon.com), plug it into my computer, and create the system image. You can quickly get to the right control by clicking Start, then typing “Backup and Restore” and hitting your Enter Key – for Windows 7. For Windows 8/8.1, Microsoft thoughtfully (sic!) hid this quite well – you have to first search for “Windows 7 File Recovery” before you can see the link to create a system image.

The difference between a System Image and a regular backup (or for Windows 8/8.1 File History) is that the former creates a restore-able image of your entire hard drive. When you use it with your repair disc, you essentially wipe out the existing hard drive and write the system image back onto it. This obliterates any changes to the computer since the system image was created and is a foolproof method for fixing a ransomware attack. Standard backup only backs up your personal files and folders, not the entire operating system and other critical files needed to operate your computer.

As an added benefit, you can use your System repair disc/system image if you need or want to replace your hard drive. Such as upgrading to a speedy solid-state hard drive (see this article for more info).