# Popup on computer encrypting all files **URL:** \ **Category:** Factual Questions\ **Created:** [April 25, 2016, 2:23am UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059 "2016-04-25T02:23:06Z")\ **Posts on this page:** 12\ **Page:** 3
**Author:** ![TommySeven](https://avatars.discourse-cdn.com/v4/letter/t/8edcca/32.png) [@TommySeven](https://boards.straightdope.com/u/TommySeven)\ **Post date:** [April 26, 2016, 5:44pm UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/41 "2016-04-26T17:44:46Z")
> [@Chronos](#): > > How the heck would anyone know what ransomware company they’re dealing with? Because they tell you? Right, because they’re obviously trustworthy. If there’s one Googleable ransomware company that really does decrypt the files, then what’s to stop all the rest from just claiming to be them? You have to send money to a particular Bitcoin address. You can confirm that whatever’s giving you that Bitcoin address belongs to the legitimate ransomware company (e.g., that it’s the same domain name used by past victims who got their files back). And again, it’s just not that much more work to write real vs. fake ransomware. It costs time and money to get your malware deployed, and the current situation seems to imply that the ROI is better when the ransomware is real than fake. > [@Chronos](#): > > And again, just decrypting the files isn’t playing fair. To truly play fair, the company would have to decrypt the files, and then remove their malware. Why would they do that? Their incentives are (a) that it’s good for their reputation, and (b) that if they don’t, a skilled IT person can remove it anyways, and/or the usual anti-malware companies will write a tool to do it automatically; the only thing you really need them for is the key. ---
**Author:** ![scr4](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@scr4](https://boards.straightdope.com/u/scr4)\ **Post date:** [April 26, 2016, 5:47pm UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/42 "2016-04-26T17:47:43Z")
> [@Chronos](#): > > How the heck would anyone know what ransomware company they’re dealing with? I guess if the ransomware looks and acts just like a well-known ransomware (e.g. [CryptoLocker](https://en.wikipedia.org/wiki/CryptoLocker)), and puts you in touch with operators who respond to your queries, you have _some_ confidence that it’s a “real” encrypting ransomware and not a data-destroying worm. Enough that \ x \ is larger than the asking price. Whatever the reason, I agree with those who say there seem to be more accounts of _successfully_ getting your data back than not. Also consider that in countries where actual kidnapping of people for ransom is widespread (e.g. Nigeria), the hostage is almost always returned safely after payment. ([This Planet Money story](http://www.npr.org/sections/money/2015/02/27/389607359/episode-607-captive-market) is a fascinating coverage of this, by the way.) So your “tragedy of commons” theory doesn’t seem to hold up when the cost of delivering what was promised is very low (i.e. releasing a hostage is almost as easy as killing him/her, and decrypting the data is almost as easy as not). ---
**Author:** ![TommySeven](https://avatars.discourse-cdn.com/v4/letter/t/8edcca/32.png) [@TommySeven](https://boards.straightdope.com/u/TommySeven)\ **Post date:** [April 26, 2016, 5:56pm UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/43 "2016-04-26T17:56:44Z")
> [@scr4](#): > > Also consider that in countries where actual kidnapping of people for ransom is widespread (e.g. Nigeria), the hostage is almost always returned safely after payment. Agreed, though I think that takers of human hostages have a major incentive that’s not present here: murder is almost always investigated with greater resources than kidnapping, and punished more severely, but that’s probably not true for destroying files vs. faithfully ransoming them. Other incentives seem to be sufficient to keep the ransomware operators mostly faithful, though. ---
**Author:** ![Chickenwrangler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chickenwrangler/32/91_2.png) [@Chickenwrangler](https://boards.straightdope.com/u/Chickenwrangler)\ **Post date:** [April 27, 2016, 7:57am UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/44 "2016-04-27T07:57:17Z")
I got hit by Ransomware some months ago. All my picture and document files were locked. Luckily I had made a full back up on a removable disk the day before so lost hardly anything. As already stated the ransomware affects all drives connected to the computer so the only way to avoid a total infection is by only connecting your back up drive when you are actually backing up, keep it well away from the computer at all other times. Malwarebytes have a free beta Anti-Malware program that is supposed to stop ransomware installing on your computer. I’ve been running it for some weeks, don’t know if it actually works but guess it can’t do any harm. [https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/](https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/) :rolleyes: ---
**Author:** ![JohnClay](https://avatars.discourse-cdn.com/v4/letter/j/c37758/32.png) [@JohnClay](https://boards.straightdope.com/u/JohnClay)\ **Post date:** [April 27, 2016, 8:10am UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/45 "2016-04-27T08:10:38Z")
I recommend herdProtect. It is free and currently uses 68 anti-malware engines: > **[Antimalware Engines - herdProtect](http://www.herdprotect.com/engines.aspx)** > > herdProtect is a free second-level cloud-based malware scanning platform powered by a the top 68 anti-malware engines. It even finds suspicious files such as unsigned programs. ---
**Author:** ![Francis\_Vaughan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/francis_vaughan/32/3093_2.png) [@Francis\_Vaughan](https://boards.straightdope.com/u/Francis_Vaughan)\ **Post date:** [April 27, 2016, 12:50pm UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/46 "2016-04-27T12:50:57Z")
It isn’t impossible that there is some hope for victims. [Kaspersky is claiming they can decrypt](https://blog.kaspersky.com/cryptxxx-ransomware/11939/). ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [April 27, 2016, 10:06pm UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/47 "2016-04-27T22:06:26Z")
> [@Chronos](#): > > How the heck would anyone know what ransomware company they’re dealing with? Because they tell you? Right, because they’re obviously trustworthy. If there’s one Googleable ransomware company that really does decrypt the files, then what’s to stop all the rest from just claiming to be them? > > And again, just decrypting the files isn’t playing fair. To truly play fair, the company would have to decrypt the files, and then remove their malware. Why would they do that? If kidnapping resulted in the death of the hostage 95% of the time, nobody would pay the ransom. For a business of any scale, paying $300-$500 to get the files back is not a big deal, heck my self employment taxes every month push that. Fixed expenses for my business run around $3K/month Just having to spend hundreds of man hours rebuilding records from paper is more expensive, I just paid that to have my business taxes filed. I understand the logic that you are trying to apply here, however as it plays out in the real world, you are wrong. I as a small business IT guy will advise people every time to pay the ransom if you dont have good backups. ---
**Author:** ![Carryon](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@Carryon](https://boards.straightdope.com/u/Carryon)\ **Post date:** [April 27, 2016, 10:06pm UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/48 "2016-04-27T22:06:57Z")
Bitdefender has an option to prevent encryption in the first place, but you have to tell it what folders to protect, and it can’t help after the data is encrypted. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [April 28, 2016, 12:06am UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/49 "2016-04-28T00:06:59Z")
Just because the thieves are acting against their incentives now, does not mean that they will continue to do so indefinitely. I see no reason to trust that they won’t wake up to the reality of those incentives. ---
**Author:** ![iamthewalrus\_3](https://avatars.discourse-cdn.com/v4/letter/i/258eb7/32.png) [@iamthewalrus\_3](https://boards.straightdope.com/u/iamthewalrus_3)\ **Post date:** [April 28, 2016, 12:10am UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/50 "2016-04-28T00:10:47Z")
> [@drachillix](#): > > Rumor has it there was a backup strategy and system in place however there was an issue with those backups. > > So it wasn’t that they lacked a parachute, but that the chute malfunctioned when deployed. IT still deserves to be sacked. If you’re not regularly testing restore-from-backup, you don’t have a backup system. ---
**Author:** ![davidm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/davidm/32/225_2.png) [@davidm](https://boards.straightdope.com/u/davidm)\ **Post date:** [April 28, 2016, 12:23am UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/51 "2016-04-28T00:23:09Z")
> [@Francis\_Vaughan](#): > > It isn’t impossible that there is some hope for victims. [Kaspersky is claiming they can decrypt](https://blog.kaspersky.com/cryptxxx-ransomware/11939/). They can decrypt files encrypted by one particular type of ransomware, and then only if you have an unencrypted example of at least one of the files. ---
**Author:** ![TommySeven](https://avatars.discourse-cdn.com/v4/letter/t/8edcca/32.png) [@TommySeven](https://boards.straightdope.com/u/TommySeven)\ **Post date:** [April 28, 2016, 12:47am UTC](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059/52 "2016-04-28T00:47:49Z")
> [@Chronos](#): > > Just because the thieves are acting against their incentives now, does not mean that they will continue to do so indefinitely. I see no reason to trust that they won’t wake up to the reality of those incentives. What incentive do you think they have to scam? I’ve already explained how you can figure out which brand of ransomware has your files, so there’s no tragedy of the commons. The operators will sometimes even decrypt a few files as samples, to prove that they have the key. I’ve explained that the ransomware can be removed like any other malware, so that past victims are at no special risk of reinfection, as long as their new IT staff is competent. What am I missing? And beyond that, for existing ransomware, all the cost of encrypting (vs. just trashing the files, and claiming that you encrypted) is sunk. So the marginal cost for them to faithfully release your files when they get the ransom really is almost zero, at most a few minutes of a low-level employee’s time. If they’ve automated their Bitcoin payments (which I think some of them have?), then it’s even less, a few milliseconds of CPU time on their server. So what possible incentive could they have not to give you the key? [Previous page](https://boards.straightdope.com/t/popup-on-computer-encrypting-all-files/753059.md?page=2)