Attn. Computor Gurus: I NEED YOUR HELP - All my saved files were erased by an email file I opened!!!

Good to hear that all was not lost. A PITA for sure.

Thanks, and looking at the good that came out of it, a wake-up call and learning experience.

Hey Laces. Thanks for inquiring. I've read a lot of everyone's thoughts and appreciate them. I decided to delete all the infected files (pretty much all my saved documents, pictures and videos) on that laptop. Most of those files had been sitting around for years and were no longer needed. Many of my important files I also have stored in saved folders on my AOL and Microsoft Office email. Others I can find in attachments I sent people. My other laptop, thankfully, is the one I've recently been using the most, so all files on there are good. I got Dropbox set up on the affected laptop and got the Dropbox phone app. I still need to link the dropbox account to my other laptop. So far so good!

1. Don't connect the affected laptop to Dropbox unless you are sure the malware has been removed. Even if Dropbox can revert to a prior version, you don't want to go through the pain if you can avoid it.

I am not familiar with this ransomeware variant, but malware can be quite stubborn once it is burrowed into a machine. Others may be able to chime in more authoritatively on how you can be sure the machine is clean, but I would at least reimage the machine, run antivirus and confirm a clear result, and let the machine run for a test period of time to see if the malware kicks back in.

2. It may be worth keeping a copy of the encrypted files, even if you have no intention of paying the ransom. There have been instances where ransomware has been cracked by white hat hackers allowing those affected to get the password without paying-

3. Buy an external hard drive and make a copy of your irreplaceable files there. Don't leave it plugged into your machine 24/7. The idea is to have a drive not connected, thus not accessible to malware at the moment it runs. You can get a huge external hard drive for $50. No excuse not to do this. Even if you don't update as much as you should, this gives you a baseline of irreplaceable photos, files, etc.

Here's my strategy to deal with stuff like this:

1) I image my c: drive (operating system and programs) every time I install a new piece of software. The image drive is kept disconnected when not in use.

2) Data is kept on a different disk (d:)

3) I run a backup of my data drive every week. Local portable disk that is disconnected when I'm not using it.

4) I run a backup of my data ~every month to a different drive that is then kept in my safe deposit box.

I don't backup to the 'cloud'. Don't care about it.

If I suspect a virus or any other issue I just go get my c: disk image and reinstate to the last known good point. Done. I dont't ever run any antivirus software and I don't care too. I just always reload my last clean image.

Last 2 posters- thanks for that additional advice.

I decided I needed to do somewhat of a back up on my personal laptop. We're talking mostly music and photos and a some tax records so I'm don't need the cloud, just a separate hard drive. Problem is I get this error message when I attempt the back up "The task image is corrupt or has been tampered with". What can I do to get past that (other than switching to Linux of course)?

Are you trying to run a backup job or just copy the files directly? If you were running a backup, try just copying the files. Otherwise, I haven't run into this one. Might be worth opening a thread on bleeping computer or somewhere similar where you could get some more targeted help.

Wise One wrote:

People don't like Linux because there are no apps for it other than coding. Even coders don't make apps for Linux.

Everything you said is totally wrong.

As the one guy said you could go to bleeping computer or similar site. I'm betting though you're more likely to get better computer advice here than running advice at bleeping computer.

It sounds like you may be trying to use the hard drives "easy to use" back up utility. You often have to install a program on your computer, follow some prompts and it will save an image, probably a proprietary image on your back up drive. As the other guy said copying may work best. Depending on how they are saved will determine the next move. If YOU created folders for your music, photo's, misc documents you should be able to just copy the whole folder to the bu drive. If they are saved in the default window folders, part of the library, it will require an extra couple of steps.

-Those library's are system folders and if you just click on my photos and copy, it will copy the folder, but not the contents.

-Open up the back up drive, right click, new/folder and name it "Dudes Photos" (without quotes) Go to where the pics are at, select all, copy, go to Dudes Photos, paste, wait, Done. Do the same thing, (make new folders) go to where you're other stuff is located and repeat. You can test this out my just copying one song or photo to the main folder of the new drive.

-Personally I delete all the S**t than came of the back up drive and treat it as a giant thumb drive. You can always download the "easy to use" software again.

I'm BIG on backing stuff up if you have more questions.

the files are IN the computer

My wife's insurance employer uses some CA or Oracle program to reload the boot drives with fresh images, backup the data, and re-boot on every Windows compute at 3 AM in the morning. I don't know what the product it's called though

hi my name is bob wrote:

the files are IN the computer

NO. But got me thinking about it.

Indeed, nowadays ransomware is too much widespread, and unfortunately there is no multipurpose tool to struggle it, but if you understand the way it works it is easier to avoid it. Here is not bad description of the issue http://myspybot.com/jaff-file-virus/.

Thanks for this. Update: it's been almost 3 months now since I was cyber-attacked. I deleted every suspicious file on my hard drive and I now save all my files to Dropbox. I've had no problems thus far.

The reality of the situation is you need to buy the best anti-virus program

you can afford, I recommend ESET Smart Security, never any problems,

actually my fault - instally a browser that was that had yahoo malware, but fixable. Those ransom email are deadly. I noticed Windows Defender has released new progs to circumvent the ransomware.

Look, this is special for you!

Ransomware Prevention Tips:

- Toggle your email provider’s anti-spam settings to filter out all the potentially harmful incoming messages. Raising the bar beyond the default protection is an important countermeasure for ransom Trojans.

- Define specific file extension restrictions in your email system. Make sure that attachments with the following extensions are blacklisted: .js, .vbs, .docm, .hta, .exe, .cmd, .scr, and .bat. Also, treat ZIP archives in received messages with extreme caution.

Rename the vssadmin.exe process so that ransomware is unable to obliterate all Shadow Volume Copies of your files in one shot.

- Keep your Firewall active at all times. It can prevent crypto ransomware from communicating with its C&C server. This way, the threat won’t be able to obtain cryptographic keys and lock your files.

- Back up your files regularly, at least the most important ones. This recommendation is self-explanatory. A ransomware attack isn’t an issue as long as you keep unaffected copies of your data in a safe place.

- Use an effective antimalware suite. There are security tools that identify ransomware-specific behavior and block the infection before it can do any harm (

https://myspybot.com/losers-ransomware/

)

It seems that calm times are over for mac users as well, Recently new virus began fast spreading through IOS. OSX.Proton is making the rounds in quite an unusual fashion. Specifically, it arrives at Mac computers with a trojanized copy of Elmedia Player, a free multimedia solution by Eltima Software. The situation gets yet more disconcerting due to the fact that users were downloading the weaponized app from Eltima’s official website for an unknown period of time http://macsecurity.net/view/162/.

Lol "dear customer", "at february 16", "ups chief office manager"... How do you even fall for that?