Very Serious Malware!! Just in time for the Holiday’s

Now that the malware authors have found a new way to extract money from computer users, the incidence of Fake AV software has declined. This as a class of malware was relatively easy to remove from infected systems, and relied on the inexperience of those infected to persuade them to hand over money in return for the removal of often non-existent threats.

Encryption of files on an infected system is a different matter. The encryption method may be known but if the key used is unknown then decryption is, if not actually impossible (the NSA could probably do it), then not feasible for almost everyone who is affected. Cryptolocker is the most recent and most widespread of this class of ransomware, and someone somewhere is raking in the cash as a result. Note that payment for decryption cannot be done using credit cards : you have to make payments using MoneyPak vouchers or BitCoins.

In combatting ransomware, bear in mind that the initial infection can be removed quite easily - but the encrypted files remain and cannot be decrypted.

In this case prevention is better than cure; if Cryptolocker strikes then having a recent backup of the infected files is the only easy way to restore the file system.

"Prevention is better than cure" - there is apparently a way to prevent Cryptolocker from encrypting those files : by preventing it from running in the first place. This works best in a business environment, but can be adapted to work also on some (perhaps all) home PCs.