Talking Usability: Do They Have Your Computer for Ransom?

What would you do if you opened a Web page and your computer desktop displayed a warning that your PC was infected with 8000 viruses and to call Windows Help Desk support?

You might try to click away only to discover that your browser is locked. You might reboot your PC only to discover that the banner is still there. Out of desperation you call the Help Desk listed on the banner, the customer support technician promises to remove the virus for $300, and promises to run a virus scanner to remove the virus and update your security software—what a bargain, you think. You provide your credit card number, and the customer support technician tells you where on your PC to run a script and after a few minutes the banner is gone. You are so happy that you dance with joy. When it’s over, you contact the Better Business Bureau about this Windows Support company and discover that is it not accredited by Microsoft or Apple to provide Windows or Mac support.

What you have is called ransomware (a form of malware) and its variants, all of which begin by locking you out of your PC. The ransomware is often passed to the PC by clicking on an advertisement on a website or a link in an email.

What should you do if your PC is infected with ransomware? Do not panic and do not pay the ransom. Once the ransomware has control of your PC, chances are that most of the damage is done. Unless you are an expert, solicit the help of experts: Microsoft Windows Technical Support at 1-855-883-1117 or Apple Technical Support at 1-800-290-5067.

There’s a chance that an antivirus program could remove the ransomware, but in most cases, you might need to reinstall your operating system from the ground up to be safe.  The following are a few suggestions to correct the problem.

If you are running Windows, do the following:

1. Disconnect from the Wi-Fi to isolate your PC from the Internet.
2. Reboot your computer and hold down the F8 key. Your PC will display the Advanced Boot Options menu (F8 menu).
3. Select Repair Your Computer and press Enter.
4. Log on as a user; select your Windows account name. (If you don’t have a password set, leave it blank.)
5. Once logged on, you will see a list of shortcuts to a few tools.
6. Click System Restore to roll Windows back in time. The worse thing that happens is that you lose files that did not save or backed up.

If you are running Mac, do the following:

1. Disconnect from the Wi-Fi to isolate your PC from the Internet.
2. Quit Safari.
3. Press and hold the Shift key and keep it pressed while launching Safari again.
4. When Safari opens, release the Shift key. This action prevents Safari's previously loaded pages from loading again upon launch.
5. Open Safari's Preferences… and select Extensions.
6. Uninstall any Extensions that you are not certain you require by clicking the Uninstall button.

If this does not correct the problem, refer to https://discussions.apple.com/docs/DOC-8071 for advanced instructions.

How to protect yourself:

• Update your computer’s antivirus software.
• Use a pop-up blocker.
• Turn-on the security settings of your browser.
• Turn-on automated patches for your operating system and web browser.
• Have strong passwords and do not use the same passwords for everything.

For more information about ransomware and how to prevent attacks:

• Zeltser, Lenny, Malvertising, the use of Malicious Adds to Install Malware http://www.infosecisland.com/blogview/14371-Malvertising-The-Use-of-Malicious-Ads-to-Install-Malware.html
• Geier, Eric, How to Rescue Your PC from Ransomware, http://www.pcworld.com/article/2084002/how-to-rescue-your-pc-from-ransomware.html
• Keizer, Gregg, Microsoft Hits Windows Tech Support Scammers with Lawsuit, Computerworld, http://www.computerworld.com/article/2861459/microsoft-hits-windows-tech-support-scammers-with-lawsuit.html