shmu26

Level 83
Verified
Trusted
Content Creator
Experts: Don't reboot your computer after you've been infected with ransomware
Rebooting may lead to restarting a crashed file-encryption process, potential loss of encryption keys stored in-memory.

Security experts don't recommend that users reboot their computers after suffering a ransomware infection, as this could help the malware in certain circumstances.

Instead, experts recommend that victims hibernate the computer, disconnect it from their network, and reach out to a professional IT support firm. Powering down the computer is also an alternative, but hibernating it is better because it saves a copy of the memory, where some shoddy ransomware strains may sometimes leaves copies of their encryption keys

Experts: Don't reboot your computer after you've been infected with ransomware | ZDNet
 

Gandalf_The_Grey

Level 22
Verified
Experts: Don't reboot your computer after you've been infected with ransomware
Rebooting may lead to restarting a crashed file-encryption process, potential loss of encryption keys stored in-memory.

Security experts don't recommend that users reboot their computers after suffering a ransomware infection, as this could help the malware in certain circumstances.

Instead, experts recommend that victims hibernate the computer, disconnect it from their network, and reach out to a professional IT support firm. Powering down the computer is also an alternative, but hibernating it is better because it saves a copy of the memory, where some shoddy ransomware strains may sometimes leaves copies of their encryption keys

Experts: Don't reboot your computer after you've been infected with ransomware | ZDNet
Another good reason not to disable hibernation (y)
 

Cortex

Level 12
Best protection are external backups, my worst case scenario backup is a 3 TB external hermetically sealed buried exactly 22 metres from the centre of Sherwood Forest 3 metres down - It can only be accessed by moonlight on the winter solstice which does have disadvantages in mid summer I admit - But I'm working on another plan - But security isn't a dirty word ...

Edit: I choked on my beer when I saw I need to enable Hibernation !
 

Correlate

Level 8
Don’t restart your computer after a ransomware attack
According to research conducted by a team of security researchers from Symantec in association with Stanford and New York Universities, it is better not to restart a computer after it suffered a ransomware infection as it can propel the malware infection further.
So, experts are urging the victims to either hibernate their infected PCs or power them down as it helps save a copy of the memory where usually most of the ransomware strains store their encryption keys. Symantec Survey says that experts are recommending against PC reboots as it does worse than good.