Ransomware Response and Recovery
If files have been renamed, will not open, or a ransom note has appeared, the next hour matters more than the next week. Do the five things below, then call us.
The first hour
- Disconnect affected computers from the network: unplug the cable and turn Wi-Fi off. Leave them powered on if you can.
- Disconnect backup drives and NAS units that are not yet affected.
- Do not pay, and do not reply to the attackers.
- Do not wipe or reinstall anything. The evidence shows how they got in and which strain it is.
- Photograph the ransom note and call (213) 986-4855.
What we do
- Contain: isolate infected machines and check every other device and account
- Identify: the strain, the way in and what was touched
- Check for a free decryptor: for some strains one exists, for example through the No More Ransom project
- Restore: rebuild affected machines and bring data back from clean backups
- Recover what we can where no backup exists, using data recovery methods
- Close the door: reset passwords, patch, and fix the weakness that was used
Should you pay?
The FBI advises against it. Payment does not guarantee you get your files back, and it marks you as a business that pays. You can report an attack to the FBI’s Internet Crime Complaint Center at ic3.gov; if customer data was involved you may also have legal duties to notify, and should get legal advice.
Afterward
An attack that worked once will work again unless something changes. We put protection and a tested backup in place before we call the job finished.
Questions
Can encrypted files be decrypted without paying?
Sometimes. It depends on the strain. Where no decryptor exists, backups are the route back.
How long will we be down?
With good backups, often a day or two. Without them, much longer.
Can you come to our office?
Yes, anywhere in our Los Angeles service area.
Book a visit or a pickup
Call us or book online and tell us the make, the model and what is going wrong. For IT support a technician comes to your home or office. For a repair we pick the computer up from your door, fix it at our own workshop in Burbank and bring it back. We have no storefront, so there is nowhere to drop a machine off. Outside our area, you can mail it to us.