Ransomware? Don't reboot!

[shmu26]

Experts: Don't reboot your computer after you've been infected with ransomware
Rebooting may lead to restarting a crashed file-encryption process, potential loss of encryption keys stored in-memory.

Security experts don't recommend that users reboot their computers after suffering a ransomware infection, as this could help the malware in certain circumstances.

Instead, experts recommend that victims hibernate the computer, disconnect it from their network, and reach out to a professional IT support firm. Powering down the computer is also an alternative, but hibernating it is better because it saves a copy of the memory, where some shoddy ransomware strains may sometimes leaves copies of their encryption keys

Experts: Don't reboot your computer after you've been infected with ransomware | ZDNet

 

[Gandalf_The_Grey]

Experts: Don't reboot your computer after you've been infected with ransomware
Rebooting may lead to restarting a crashed file-encryption process, potential loss of encryption keys stored in-memory.

Security experts don't recommend that users reboot their computers after suffering a ransomware infection, as this could help the malware in certain circumstances.

Instead, experts recommend that victims hibernate the computer, disconnect it from their network, and reach out to a professional IT support firm. Powering down the computer is also an alternative, but hibernating it is better because it saves a copy of the memory, where some shoddy ransomware strains may sometimes leaves copies of their encryption keys

Experts: Don't reboot your computer after you've been infected with ransomware | ZDNet

Another good reason not to disable hibernation

 

[CyberTech]

Second is restoring the data if a backup mechanism is available.

this is exactly what we do its important to make a backup image or sync it every 2 weeks or a month...

 

[Cortex]

Best protection are external backups, my worst case scenario backup is a 3 TB external hermetically sealed buried exactly 22 metres from the centre of Sherwood Forest 3 metres down - It can only be accessed by moonlight on the winter solstice which does have disadvantages in mid summer I admit - But I'm working on another plan - But security isn't a dirty word ...

Edit: I choked on my beer when I saw I need to enable Hibernation !

 

[ForgottenSeer 69673]

even back in the 90's when I worked for a telecommications test set making company we backed every day with tapes lol

 

[Cortex]

even back in the 90's when I worked for a telecommications test set making company we backed every day with tapes lol

And they worked rather well, and still do for some.

 

[[correlate]]

Don’t restart your computer after a ransomware attack
According to research conducted by a team of security researchers from Symantec in association with Stanford and New York Universities, it is better not to restart a computer after it suffered a ransomware infection as it can propel the malware infection further.
So, experts are urging the victims to either hibernate their infected PCs or power them down as it helps save a copy of the memory where usually most of the ransomware strains store their encryption keys. Symantec Survey says that experts are recommending against PC reboots as it does worse than good.

News

Stay ahead in cybersecurity with insights on cyber attacks, data breaches, identity fraud, insider threats, news, reports, webinars, and security resources.

www.cybersecurity-insiders.com