Held to ransom by Zepto !

stator

Don't throw away the encrypted files.
Sometimes the groups who created these things get arrested and the police get hold of the unlock keys. Or sometimes someone finds a flaw in the encryption.
Best thing is to do a complete new install on a fresh hard drive and keep the old hard drive somewhere and then periodically google the virus and see if anyone has found a solution.

debitcardmayhem

Better_Days wrote: »

Sorry to hear of your experience OP. It's made me think.....

I'm planning on backing up my important documents via BT Cloud. I'm wondering if I use the sync function then if I am unlucky enough to get encrypted, then will the cloud files be encrypted too? Would it be safer to manually upload?

Back them up locally too and remove your backup device after backing them up

AndyPix

Better_Days wrote: »

Sorry to hear of your experience OP. It's made me think.....

I'm planning on backing up my important documents via BT Cloud. I'm wondering if I use the sync function then if I am unlucky enough to get encrypted, then will the cloud files be encrypted too? Would it be safer to manually upload?

Hi,
This evil sh1te will encrypt anything on your computer and anything that it can access via a mapped drive.
Im not sure about BT cloud as iv never used it so dont know how it presents its self,
but if you can access it the same as you would do with any other drive connected to your computer then these files are also at risk.
If it is an automatic thing then yes, the backup would treat the files like they have been updated and upload the updated files to the cloud.


Dropbox etc are vulrerable as they are presented as a drive on the computer so yes they would be encrypted too.


Best way would be as you say a manual upload to a destination that is not normally connected all the time.


We had one of our sales guys machines infected once, and he came back and plugged his laptop into the network and it happily went away and encryptred every network drive that he had access to on our servers.
We have tape backups so this time it was no more than a minor headache to recover them luckily.


The best single thing you can do, is to not click on links or attachments in emails you arent expecting as this is 99% of the infection vector

AndyPix

stator wrote: »

Don't throw away the encrypted files.
Sometimes the groups who created these things get arrested and the police get hold of the unlock keys. Or sometimes someone finds a flaw in the encryption.
Best thing is to do a complete new install on a fresh hard drive and keep the old hard drive somewhere and then periodically google the virus and see if anyone has found a solution.

^^ this right here is great advice,
A while ago, police released thousands of keys after taking down one of these servers/groups, so it is not impossible that this would happen again at some point.

zagubov

AndyPix wrote: »

^^ this right here is great advice,
A while ago, police released thousands of keys after taking down one of these servers/groups, so it is not impossible that this would happen again at some point.

Keep checking this site here which may have some help in the future
https://www.nomoreransom.org/

poppellerant

If nothing else, this thread reassures me that the safest backup is your own offline one. I backup to a harddrive once a month - the rest of the time, the drive is in storage.

dcouponzzzz

"Data never existed at all if it doesn't exist in 3 places at once, separated geographically"

This has stuck with me since my first IT role at age 16... I'm not the kind of person to value photos and I don't have anything of value to lose, but all you guys with NAS and backup hard-drives... I hope it never happens but a house fire will waste all of that effort.

For really important stuff store at least 1, if not 2 copies in other locations - original copy > physical copy (in another building) > cloud copy.

bloodnok

Still no joy in getting files back...........anyone heard of any successes other than paying ?

AndyPix

bloodnok wrote: »

Still no joy in getting files back...........anyone heard of any successes other than paying ?

I think you need to accept that your files are now gone unless you want to pay the ransom.


But take the HDD out and keep it somewhere, keys MAY be released in time.
But its not something that is worth keep thinking about/waiting for


Accept your loss, or pay the idiots

bloodnok

Just found an SD card from an old camera with a load of photos on it, which held over a thousand of the photos I thought were lost...........so that's made things a little less hard to take !
Still if anyone hears of any successes in retrieving encrypted files, please let everyone know.
PS
"BACK UP EVERYTHING THAT YOU'D HATE TO BE WITHOUT"