Question Best way to trap Ransomware

[mmitsch]

Our daughter's computer was struck with Ransomeware. It's a DELL System, running Windows 11, and this infection caused a message to pop-up saying an automatice reboot would occur due to an infection and to call a number to have it removed. Number was [spammer# removed] and said it was toll free (not very well written...). The machine was runnng a free version of McAfee but it missed this...

I tried everything I coud to remove it and finally, as had been advised in a previous post, reinstalled Windows from scratch. All seems to be running fine again and am getting the apps back on for our daughter / grandkids.

What I've done so far is...

a. Took McAfee off and entable Windows Antivirus. Is there a good took to get to previent this from occurring going foward?
b. I enabled restore points so that maybe I could recover in the future -- think this will work?
c. I can get a USB reovery made using Windows 11 if that's advised.
d. Should I use an external SSD or HDD to make backups of data each day?

Let me know your thoughts on getting this re-configured.

Thanks!

Mike

 

[Secret-Squirrel]

Our daughter's computer was struck with Ransomeware...................this infection caused a message to pop-up saying an automatice reboot would occur due to an infection and to call a number to have it removed.

Were your daughter's files actually encrypted or was it just that pop-up that caused alarm?

 

[USAFRet]

Backup
Backup
Backup

Frequently, there is no actual "infection". That scareware popup asking you to call is the problem. You call them, they connect to your system to "fix", and THEN you are actually infected/compromised.

Backup
Backup
Backup

And if you DO get an actual ransomware encryption, don't bother trying to eradicate it and magically decrypt your stuff. This is where the backup comes in.

Backup
Backup
Backup

"System Restore points" are only marginally useful. Living in the same drive and system, they are potentially subject to corruption by the bad actor as well.

You need a real backup situation.

Backup
Backup
Backup

The general concept is 3-2-1.
3 copies, on at least 2 different devices, at least 1 offsite or otherwise inaccessible. I use Macrium Reflect for this.
Frequency of the automated backups is all on you, as to what level of pain you want to endure.
My main system gets an Incremental backup of each drive individually, every night.
Other systems in the house, every other day, or once a week.

 

[USAFRet]

Is there a good took to get to previent this from occurring going foward?

Don't click on weird stuff, and do NOT call a random phone number that tells you your system is infected.

 

[mmitsch]

Were your daughter's files actually encrypted or was it just that pop-up that caused alarm?

Thank you for your reply!

It was just the pop up that worried us - and then the system would restart after about 2 mintues...