Do I have to pay the ransom or there is a software I can use? The fies were encrypted and a .ooss extension was added. Thanks in advance for all your input.
-
Do you have a backup of your data?– AllanCommented Feb 21, 2020 at 18:18
-
The .ooss extension indicates you got hit by the STOP (djvu) ransomware; in some cases (when it used an "offline" key), it's possible to decrypt the files without paying the ransom. (Although if you have a backup, that's an even better option.) First, remove the malware from the PC (see recommendations here), then try Emsisoft's decryptor and see if it can recover your files.– Gordon DavissonCommented Feb 21, 2020 at 20:37
Add a comment
|
1 Answer
It depends.
They didn’t infect your iCloud rather they encrypted the files on the local Windows machine in the synced directory.
If you have a backup of the files taken before they encrypted your files, then no, you don’t have to pay. Simply restore your data. If you don’t have a back up, you will probably have to pay. The good news is this is very likely to work. These scams don’t work if people know that paying doesn’t get your data back.
Whether you restore your data from backup or pay the ransom, make sure you do the following
- Change your iCloud password from a non-infected machine in case the virus had a keylogger
- Wipe that machine (format and reinstall)
- Change the passwords on other accounts you may have visited.
- If any of the documents contained banking or sensitive info, contact those institutions and change logins/passwords. It’s advisable to let them know what happened.
- Update your anti-virus
As far as breaking the encryption, it’s next to impossible. It’s not so much a “password” they used, but an encryption key and attempting to brute force it could take years; many, many years.
I wish there was better news I could give you, but you do have some work to do to recover and clean up. You can take some solace knowing that municipalities and government agencies with dedicated IT departments have been hit with this as well.