Tip of the Month for: November 2014
Protecting Your Files from Ransomware Viruses
Recently, a few Data Resources Corporation customers discovered they had been attacked by a ransomware virus. While their Answers data itself was safe, and no critical Answers data was lost or stolen, the ransomware virus resulted in other problems and errors that we want all our Data Resources Corporation customers to be aware of and to take any necessary precautions to protect themselves from these threats.
What is a ransomware virus?
A ransomware virus is a program that encrypts or encodes certain files on your PC and makes them unaccessible. They typically target standard files such as .PDF's, Microsoft Word documents, Excel documents, .BMP files, .GIF files, and others. Basically most of the image files and document files you use are susceptible to be encrypted. We did find that .TIF documents and plain text files (such as your archived reports) did not seem to be encrypted by these viruses. The program searches your entire PC hard drive, as well as any mapped drives, and encrypts files. Once the files are encrypted, a ransom notice is posted. The ransom notice informs you that your files are now encrypted and can only be decrypted by paying the ransom fee. Once you pay the fee, a unique unlocker key is used to restore your files. The fee's can range anywhere from $300 to $1000 or more. And, they have to be paid by "bitcoins" so that the recipient isn't traceable. The ransom notices provide specific instructions on how to unlock your files with payment. These programs use unique keys on each machine they encrypt so that it is not possible to get a key from another source to unlock your data. Your files are locked in such a way that no other program can decrypt them. Some common names of these ransomware viruses are CryptoLocker, CryptoWall, and CryptoDefense.
I have anti-virus, can I still get a ransomware virus?
Unfortuately, yes.
Ransomware viruses are typically delivered to you in an unsuspecting way. Most commonly, they will be delivered to you via email that is disguised as a bill, invoice, or customer support notification from a common source. They come as an attachment to an email, and as document that you would not suspect, such as a PDF, but when you click on the PDF to open the document, it actually is an executable file that proceeds to run on your PC, installing it's encryption software and then proceeding to search your PC and encrypt your files. The emails will even pretend to be from "reliable" sources such as Fedex, or UPS, or other places that you would not suspect as being a virus. Your anti-virus programs may scan the incoming emails but not find a problem with an unsafe attachment, since the attachment does not seem to be an executable or other potentially harmful file.
How do I know if I have a ransomware virus?
As mentioned earlier, these viruses target your image files, and other common document types. Some of the programs actually present you with a notification screen that tells you your system has been encrypted. Others, you will not know until you try and open a document and the document cannot be opened. PDF documents, for example, will try and open and then give you a message that the file is damaged or not a correct PDF header. Other image files may tell you they are an incorrect format. And, as you proceed to try other documents, they are all going to give you format error messages. So the first sign that you may have been a target of a ransomware virus may be the notification message, or the images files and documents not being opened successfully.
Another indication may be "decrypt_instruction" files placed in the folders of any encryted documents. Any folder containing PDF or image documents would have been searched and the documents encrypted and some files placed there telling you how to recover your damaged files. These same files will be in every folder containing documents that were encrypted.
You may also see other effects, such as weird pop-up messages, but the main indication will be that your files will not open.
If I have been infected with a ransomware virus, what should I do?
The notifications and decrypt instructions provided by the developers of the virus will instruct you on how to create an account and pay them with Bitcoins. IF you do choose to pay the ransom fee, it does seem that you are provided with the keys to unlock your files. While it is never desirable to encourage thieves and culprits by actually paying them... if you do not have backups of your files, and they are important information, there is no other way to uncode or decrypte them. Some of these viruses offer you a certain number of days to pay and after that, the unlock codes are no longer available. Others offer you a lower ransom fee at first, but after a set time, the ransom fee is increased.
To recover your data without paying a ransom fee means that you will need good backups of all your files. And, those files will need to be restored. Along with restoring the files, you need to also ensure that no resident copies of the virus executables remain, or it will continue to keep infecting your files.
At this time, the only two methods of recovering files are 1) restore them from backup, or 2) pay the ransom.
How do I prevent a ransomware virus?
There are things you can do to protect your computers.
1. Make all users aware of this potentially dangerous virus and before they open any documents (especially PDF documents) that have been emailed to them, they verify the sender. These viruses do mask themselves as being from reliable sources, however, if you do get emailed invoices from UPS or FedEx, you should also be able to go online and access those same invoices. If it is not the normal time to receive invoice, or the typical "from" address, or you have not submitted support requests, etc, then those documents may be fraudulent. Your users should not click on links in emails, etc unless they are certain they are legitimate links because they could be re-directing you to sites that will download spyware or other harmful software and make you more susceptible to viruses.
2. Keep good backups of all your documents and files. As previously stated, the Answers data files have not been susceptible to this virus because we do not use file extensions on the majority of our files and those that do are user names, or terminal numbers, or other "non" typical extensions. And, our files are not standard formats that other developers could develop programs to read and destroy. However, the image files, where you scan documents into Answers, or file attachments are susceptible to this virus because it is targeting these types of files. A lot of times, users have moved their images out of the datafiles folder to make their nightly backups quicker. This is OK, but if you do not have any backups of these documents and you were to be targeted by this virus, then you do not have a way to recover and restore your documents. We also recently had one customer where this virus targeted their VSI-Fax directory and VSI-Fax would not function until the database files in it were restored. You need to have backups of all your important files, not just those found in the datafiles folder. Backing them up to another drive or PC is also OK, but keep in mind that these viruses do proceed to check mapped drives and any other drives like external hard drives and USB drives.
3. There are Software Restriction Policies you can put into place on each of your PC's to prevent the disguised executables from running. This would need to be done on each PC as well as the server. There are various articles available on the internet, but you can review some that we and other Answers users have found to be helpful:
www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information#discover
www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information
http://support.microsoft.com/kb/310791
Again, please realize that we have had no cases where ransomware viruses encrypted or damaged any critical Answers data files. Our files are in a proprietary format and do not use common extensions. These ransomware viruses target more common document and imaging files.
We, however, want you, our valuable customers to be informed on potential threats and have the knowledge to protect your documents and images from these potential threats.