my wallpaper has been replaced with a note that apparently all of my files have been encrypted and I can no longer access them. wtf?
Userlevel 7
Hi doereid
Welcome to the Community Forums.
Sorry to hear about this but it sounds like you have fallen foul of ransomware. In the majority of cases WSA is able to detect and effectively block ransomware before it is able to encrypt files.
However, new variants are released on a constant basis, and are specifically designed to circumvent the major security apps available, so it is a constant battle to try to keep ahead of these nefarious individuals...and it is not always possible, so this means that new variants are able to infect a number of users before the Webroot Threat Researchers can create detection rules for them.
Whilst we cannot promise that they will be able to help the best course of action is that you ASAP Open a Support Ticket, to let the Support Team know of the issue and so that they can see if they can help. The service is free of charge to users with a current/active subscription. Also, refrain from rebooting your system as some forms of ransomware are known to replciate themselves on each reboot, in an effort to make them harder to detect and remove.
I do not want to hold out false hope but it is possible that WSA spotted the variant of ransomware that has gotten onto your system but because it was unable to determine if 'good' or 'bad' it has set the critter to 'Monitor' status in which case WSA will be journalling all it's activities and therefore the Support Team, may be able to use the journals produced to roll back the 'damage' caused...but they will need to look into that and advise if that is an option.
I hope that the above in someway helps? Please keep us posted on what transpires further to contacting the Support Team which, as I have stated before, you should do ASAP.
Regards, Baldrick
Welcome to the Community Forums.
Sorry to hear about this but it sounds like you have fallen foul of ransomware. In the majority of cases WSA is able to detect and effectively block ransomware before it is able to encrypt files.
However, new variants are released on a constant basis, and are specifically designed to circumvent the major security apps available, so it is a constant battle to try to keep ahead of these nefarious individuals...and it is not always possible, so this means that new variants are able to infect a number of users before the Webroot Threat Researchers can create detection rules for them.
Whilst we cannot promise that they will be able to help the best course of action is that you ASAP Open a Support Ticket, to let the Support Team know of the issue and so that they can see if they can help. The service is free of charge to users with a current/active subscription. Also, refrain from rebooting your system as some forms of ransomware are known to replciate themselves on each reboot, in an effort to make them harder to detect and remove.
I do not want to hold out false hope but it is possible that WSA spotted the variant of ransomware that has gotten onto your system but because it was unable to determine if 'good' or 'bad' it has set the critter to 'Monitor' status in which case WSA will be journalling all it's activities and therefore the Support Team, may be able to use the journals produced to roll back the 'damage' caused...but they will need to look into that and advise if that is an option.
I hope that the above in someway helps? Please keep us posted on what transpires further to contacting the Support Team which, as I have stated before, you should do ASAP.
Regards, Baldrick
Reply
Login to the community
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.