Security
How to Protect Your Computer from Ransomware
How ransomware actually gets onto a home or small-office computer, the four habits that stop most of it, and what to do in the first ten minutes if you are hit.
By Maximilian Seth-Smith, Founder & Lead Technician · · 2 min read
Ransomware is not something that only happens to hospitals. The people running it go after home computers and small offices because they pay and they have weak defences. The good news: most infections walk in through the same few unlocked doors, and locking them is neither expensive nor complicated.
How it actually gets in
- An email link or attachment that steals a password or drops the infection. Still the number one way in.
- A password reused from an account that leaked in some other company's breach.
- Remote access software or a router admin page reachable from the internet with a guessable password.
- A program or operating system that had a security update available for months and never got it.
- A fake "your computer is infected" popup that talks you into installing the real infection.
Once in, the attacker usually looks around quietly for days, deletes any backups they can reach, and only then encrypts everything, typically at night or over a weekend.
Four habits that stop most of it
1. Turn on multi-factor authentication
If you do one thing, do this. A stolen password is useless if logging in also needs a code from your phone. Turn it on for email, banking, cloud storage, and anything that remembers a card. An authenticator app beats text messages.
2. Let updates install
Windows, macOS, your browser, and your router. Automatic updates close the holes attackers scan for within days of them becoming public.
3. Do not run as an administrator
Use a standard account day to day and keep a separate admin login for installs. Most ransomware needs admin rights to do real damage, and this takes them away.
4. Keep a backup the ransomware cannot reach
A drive that stays plugged in is not a backup from an attacker's point of view; it is more data to encrypt. Keep a copy that is unplugged or in a cloud service with version history, on a different password. Test that it restores.
If you think you are being hit right now
- Disconnect from the network: pull the cable or turn off Wi-Fi. Do not shut down yet; memory can hold evidence and keys.
- Do not log in to other machines with an admin account to "check".
- Change your email and banking passwords from a phone or a different computer, and sign out of all sessions.
- Do not pay and do not run a decryption tool you found online. Bring the machine in.
- Keep the ransom note and a few encrypted files. They identify the strain, and some strains have free decryptors.
How we help
Virus removal at SnapTech starts with a free diagnosis. We remove the infection, recover what can be recovered, close whatever let it in, and set up protection before the machine leaves. Cleanup starts at $99 and most machines are back within 48 hours.