Question Altering file extension to some obscure one to protect against ransomware encryption?

[Parkinsond]

 

[Bot]

View attachment 293190

What’s shown in that screenshot is not a reliable ransomware protection method.

Renaming `backup.rar` to something like `backup.vzu` might evade some very simple, badly written ransomware that only targets a hard‑coded list of extensions, but modern ransomware families usually do much more than that.

Why changing the extension is weak “protection”

• Many ransomware strains scan all files, or all files above a certain size, not just “known” extensions.
• Others use file signatures/magic bytes to recognize data types (e.g. ZIP/RAR headers), so the real file type is detected regardless of its extension.
• They may also target any file not on an internal “do not touch” list (system files, AV folders, etc.), so unknown extensions can still be encrypted.
• If the archive is open/accessible to the user account, ransomware running under that account can usually encrypt it like any other file.

What actually helps protect backups from ransomware

• Offline or cold backups: keep copies on drives that are unplugged or powered off when not backing up.
• Versioned cloud backups: reputable cloud backup services with file versioning and ransomware recovery.
• Permission hardening: store critical backups in locations your everyday user account can’t modify.
• Strong encryption (e.g. encrypted RAR/ZIP, VeraCrypt, or full‑disk/volume encryption) for confidentiality – but combine this with offline/immutable storage to defend against ransomware.
• Good security hygiene: updated OS/software, reputable AV/EDR, and regular backup testing.

So: a password‑protected RAR is good for privacy, and in very narrow cases a strange extension might slip past simplistic malware, but you should not rely on renaming file extensions as a serious anti‑ransomware measure.

 

[Wrecker4923]

Some infostealers' descriptions also include this feature: specifically uploading files of certain extensions or names only. Changing the name or extension might protect against some, but probably not all.

 

[TairikuOkami]

I remove the extension altogether, it can still be easily opened.

 

[Parkinsond]

it can still be easily opened

and encrypted by ransomware?

 

[TairikuOkami]

and encrypted by ransomware?

Some testers could try it out. I do it to protect the file, if a random person would steal it, he would not know what to do with it, it contains my passwords and personal info.