Dealing with a Ransomware Attack: A full guide 

Response to certain concerns in the comments: I’m aware that “pulling the plug” can destroy evidence for forensic investigators, but the value of potentially preventing a large amount of data from being encrypted in the first place can be much greater for the user than the slim chance of finding file traces or the encryption key in memory through a high cost forensic investigation. Of course it only makes sense if done early, and as with everything not everyone agrees. This video is meant to be a general guide for most people but of course it cannot tell you how to perfectly deal with every possible scenario.

I hope I wont need to use this video in my lifetime

There is a special place in hell for ransomware developers

Tips for avoiding ransomware in the first place: 1. don't click links in emails 2. don't download programs or microsoft docs off the internet 3. Don't visit sketchy websites 4. Don't touch popups or ads 5. don't plug random USB drives you find into your computer.

200 IQ move: Encrypt your files before a ransomware can.

*just pull out an uno reverse card so now they pay you*

getting rid of the "malware" is easy, the hard part is getting your data back. If you dont care about your data, just reinstall windows or format your pc

Make sure your backups are off line. Attackers tend to delete them. They have been on your network long before the encryption. Check who has admin rights on your network and reset all your password.

Thank you thank you thank you so much, my PC got attached by ransomware. My all the files got encrypted. Luckily I saw this video and I checked with 1 file, it got decrypted. So happy. Thank you so much. I got my all old memories thank you... Guys really it works.

Well there’s no guarantee that the authors of the ransomware would give you the encryption key even if you pay up. So you’re screwed either way.

I had my entire OneDrive documents folder taken hostage by ransomware when I was 16. It was the week of my GCSE coursework hand ins for my Design class and I had to redo months of work in a few days. It was fucking traumatic and I hope to god as an adult I never get into this situation again.

I think the ultimate way around this is to just store any important/sensitive information in a secure cloud server environment (that doesn't sync with your computer) - just do it manually. No matter what happens to your computer, you should have a safe backup as well so that you can just format and restore to get the functionality back - but the whole time your data wouldn't even be in question. That's real peace of mind. Obviously there are other issues associated with keeping information in the cloud - but if you're using a unique secure password and 2FA with a good authentication app then there should be 0 concern. Any input is welcome though :)

Great video! You forgot two important points. 1) only way to be sure you system is clean is to nuke os from orbit. I mean clean reinstall deleting partitions. 2) if you have system restore enabled, you might get files back using tools that can extract files from system restore. I have had success with this several times.

Everybody gangsta until the decryption file you download is another ransomware

I wish I had this a few years ago. I do know the basics of Ransomware but your links for help I would have loved. Thank you SO much! I have saved and shared!

RU-vid is recommending me one of your videos called "My Security 2015", and I want to see your security in 2019.

Someone should send this to the Louisiana government. They recently got hit hard by some ransomeware attacks

This is the most informative video I have found with information that is extremely helpful in the efforts of dealing with ransomware attacks. My question for you is, how in good god do you have all of those actual ransomware files to execute??

still works! followed steps exactly and it works, thx a ton and keep up the awesome videos

Thank you for the great information. Our company just got hit last night. Turned every file to a ". Nortron " extension. I'll do the steps as you described. Hopefully the files can be decrypted.

This is why Google Drive is so handy for me. Anything that I consider sensitive/irreplacable is always kept in a backup folder that I could access at any time. In case I switch to a new PC or if by some chance I am attacked by ransomware

Thanks, Leo.

Great video and just subscribed. Thank you.

I setup my computer to survive a virus attack without relying on an antivirus program, which I have been doing from the early days of Windows. I got hit with a ransomware in the early days of this malware. It encrypted all the Windows doc, text and image files, but my personal files were uninfected, which included my jpg files I saved for my photography business. I laughed at the message it showed on my screen demanding I pay them, because I had backups of everything on CDs. I didn't have to use these backups, because of the steps I took to alleviate the threat. I was impressed at the level of encryption it did to Windows informational files, and I had to reinstall Windows, but I lost none of my personal files.

I wish I saw this a few months ago when I had to deal with it. I got rid of the ransomware, reset and changed the network password and saved a couple files but i didn't figure out how to decrypt the files that got infected. In my case it was the .hese extension. Back in August. Good thing that I had a backup of my most important files but I lost a couple beautiful memories.

I needed that a month ago. I just reinstalled Windows and erased anything related to that piece of crap Ransomware. Thankfully I back up my files on a server separated from the attacked machine. And it forgot to actually encrypt my important data since I caught it mid-process when it was busy encrypting TEMP files x3

Super useful high-level video, thanks!

Just came across your channel and you have a new subscriber.

Hey! Thats a great video. However I have a question, What would you suggest for downloading the decryptor or checking the ID-Ransomware website when the infected device is off network. Also, most enterprise usually tend to block mass storage devices? What would you recommend?

dang now i have a way to fight this kind of stuff since its been on the rise as of late.

Very good work, thank you

i believe that the best protection is to use two external drive and alternate them and unplug them as soon as your backup is done

“Im gonna give a live demonstration, so were gonna infect this system with ransomware” *pulls out a whole folder of ransomwares*

If you don't care for data JUST REINSTALL WINDOWS FFS

Thanks for Sharing.... Really good to know how to react when hit by Ransomware....

Thank you - very informative

My brother had a laptop that was infected with ransonware some years ago. He got rid of it with a complete wipe and reload of his laptop.

I just checked ID Ransomware and it says it supports Spora, have they added support since you recorded this yesterday?

Best case scenario, you actively back up your work and use external version control for any major project. Thus making it a simple case of wiping your drives and reinstalling your os. Worst case scenario, contact the ransom, ask for a demo to prove they arent just going to scam you further. Perhaps even pay a tiny fee to prove your intent of paying the full ransom. Take that demo to security expects to reverse engineer the ransom. What ever little you spent (if so) likely will help others in the long run.

Good content 👍 For my sight I prefer back up solutions routine. Sperate from any source connect to internet.

Can I store some important "Ransomware (phobos) encrypted files" in another pc for further/future decryption without being infected??

if onedrive is mounted to documents , pictures, desktop, will the ransomware be able to encrypt that, if yes, is it recoverable from cloud

production. Thanks again!

you should also make a video on ransomware that locks the computer. my brother had a couple of them and i had to go through a few hoops to get them out without a format. as for data security, the best thing to do is get a 2TB+ USB drive (or more if needed), plug it in, make backups and then unplug it. this way you can be sure that nothing has access to the backups, then in case of ransomware, you deal with the problem and if no decryption is available you just restore the backups.

How much these criminals usually ask to decrypt your files?

I’ve been pirating stuff for over a decade and not once have I ever had any virus/malware/ransomware, how do people even come across this sort of thing?

Helpful Video Leo

Backups, backups, backups. Ransomware won't be able to touch your AWS S3 objects (unless it knows your root account password, in which case data loss is the least of your worries). It also won't encrypt your external hard drive unless it's plugged into your machine at that moment.

Please don't pay ransom: All hackers: *triggered*

since I formatted my computer after the attack my email accounts on social networks and even accounts that I didn't remember existed tried to be connected by strangers, what can that be?

By recent past experience on a ransomware attack, I would recommend urgently to keep up-to-date the bios of the computer. It seems this was the only door open to get infected.

My friend got infected with Cerber Green ransomware 2 years ago and lost all of his data. Very upsetting for him and his business

I notice you never brought up a full system restore.

Note: Do not execute any virus on real computer, use virtual machine or dont execute them at all. It's for your safety.

Very useful vid. Thanks

You have a great website

Merry christmas to you and family and a happy free virus 2020 year , greetings from hans of the dutch lowlands nl 👍👌

"Half the time the ransomware will encrypt your backup once u connect it to your PC" *Laughs in stack of DVD-R's*

Thankyou very much for uploading this video but sadly my version of ransomware isnt decrytable !

this video is literally the embodiment of the quote: "having a gun without needing it is better than needing it without having it"

Since my systems do not have sensitive files I just do a full wipe and reboot

1:05 *pulls out my grandfather's life support*

My solution is to always have backups, and not backups from like..months ago, but bi-daily backups....in other words I have backups from Sunday-Monday, that I overwrite with backups for Tuesday-Wednesday...which get overwritten with backups for Thursday-Friday..etc...and I rotate them and keep it steady and even, I guess once you get into a rhythm with making / storing, and overwriting backups?...ransom ware becomes a thing of the past. There's also the fact that you MUST change ALL passwords when/if you get hit with ransom ware, (I always encrypt my passwords and use long complex, yet easily remember-able passwords too...not a word really but a phrase....like (not ever used by me...just using this for an example): Take your name....say...its "Timothy".... SPLIT it "Timo-thy".... Place something INSIDE your split name....like ... "scH001Bu5"...... SPLIT that as well... "scH001-Bu5" in the middle of THAT?...place your birthdate... 00/00/0000....but use underscores instead: 00_00_0000 so you now have "TimoscH00100_00_0000Bu5thy"......now...take THAT?.. and ENCRYPT IT!...by the time someone cracks THAT?....you already have backups of your backups which are backups of your backups, and if they DO hit you with ransomware?...you can listen to some jazz, sip on some chilled wine...and smile as you restore your latest backup and change your passwords yet again. Just some simple advice from an old Network admin!...(sometimes..."simple" doesn't have to mean "vulnerable"!...LoL!!)

this video helped me. thanks

i dont store super secret stuff on my computer so if i ever get ransomware i have no problem doing a factory reset they got my anime wallpapers

You can do system restore on Windows also!!

thx for this video :)

I'm gunna leave a sticky note on my desktop with the link to this video just in case this happens. Thanks bro.

the dislikes are ransomware makers

Thank you. Now I'm calmer about my attack.

So in other words if there is a repair tool for the ransomware you have then you can repair the files if not restore from backup. This is a good reason to back up to a NAS device that uses unique login credentials and is not part of the domain. I have seen people get their backups encrypted too so no way to recover short of paying the ransom.

This is an excellent source of information and very well explained.

I remember getting ransomware on my computer like 10 years ago from downloading Terrordrome, CSGO, and Fallout 2 on super sketchy sites💀

This Video : **Exists* Me : Dont Use Computer lol

Thank You kindly for the tips its kind of sad that these people will barely be punished, so lessen thier effectivness is noble deed. Can I ask how it works that files which take over your entire data are usually very small sized? and what are the most common ways to be infected? Sorry if thats silly question Im trying to be as cautious as I can but since Your Ccleaner video Im very stressed :)

after watching this video i'm not gonna download anything that isn't from a widely trusted source.

Backup your computer regularly, people! My high school recommended doing so every Friday, so that's what I've done for years.

will they know my ip address ?? i have the .booa virus on my pc and my pc dont have any important stuffs so lol

I was trying to find some clip like this but I just couldn't find it, and RU-vid recommended me after I got rid of my important files...

Thank you bro. My data files infected by iisa (dajavu Ransom ) Now I would decript my files. 😘

I just keep all important files on flash drives. If I was infected I would long format the drive and then reinstall windows.

Step 0: Have backups Step 1: Nuke the install from orbit Step 2: Install Linux instead (I'd reccomend Linux Mint if you're used to Windows.)

I just started watching your videos and LOVE THEM! But I'm a dope when it comes to this stuff. When you say, "Lockdown infected computers in your Network" does that mean if my child's computer gets Ransomware on his tablet or laptop, my laptop or my other kids stuff can get infected? So everything hooked up on my ISP is now at risk?

I keep isolated system backups. I would do a restore using a full wipe of the partition before restoring.

Honestly, just owning it and not trying to hide it is partially why I watch you. It's the honorable thing to do and it make the rest of the jobs much more believe when you are call out of the spots like that, so thank you #davkracks.

great video mate! just a question though, if i get attacked by ramsonware and i use microsoft onedrive (synchronized) will my files on cloud be encrypted too or are they safe? Thank you in advance for your time and keep up the good work!

Always have a backup with all your files, as in a seperate drive. If you use an ssd or hdd, it doesn’t matter! Get a hard drive (cheaper) and copy your files on there. If you ever get a virus, shut down and unplug pc, remove your normal drive and plug in the backup and use that until you can wipe the main drive or fix it

I'd always recommend backuping. Can be annoying but is SUCH A RELIEF! if something like this shit happens.

what's the best imaging/backup software to get a complete sector by sector image of your entire system? And, should the infected drive be wiped or zeroed out before an infected system get restored with an image?

I just did backup and it worked :D, at least with most of files :(

I’m always so careful with my backup external drive, and the one time I left it plugged in this happened 😞

ive had one like this before, luckily it was a fairly fresh an not used much machine, so i was able to just reformat an install again, switched to linux after that an havent had it happen again since

How do you expect people to do all the things you suggest if their systems are frozen? The times I was hit I could not move from the demand screen. I had no internet access at all except on a different desktop computer.

I keep a number of backup images for my computers. The images are on drives that must be manually connected to the computers to restore. If I have any reason to restore a computer, I first boot on the Windows repair start DVD and then I connect the image drive. I then run the utility to restore the computer.

I subscribed on this video... Great information.. how have you downloaded ransomware.. please make one video

We need party when you hit 1M Leo

thank you sir

A few months ago I got hit by one with the .boop extension so I basically have 2 TB of data encrypted, that includes approximately 15 years of pictures. The two infected drives are lying here on my desk. I have a new drive in my machine but I operate from home so my work files are on those drives. I became complacent and wasn't backing up as I used to.

You actually have a folder, with these WMOs. :-O

Can someone explain to me how to exactly do this at 0:40, does it just mean disconnecting from the internet? I'm not very good with computers so I don't quite know how to do this. I haven't been hit by ransomware btw, but I just wanted to know if my laptop ever gets infected by ransomware.