iHELPERPC Ransomware...

[The Weed]

I believe this is brand new ransomware. If you've heard of it and know how to defeat it, please let me know. Fortunately it's not my computers that have been affected.

Yesterday a friend's production computer became infected. Every file is encrypted with the extension .ihelperpc after the legitimate extension. Every folder has an html file with the Ransomware note. Even his images are now encrypted.

After copying off any files he hopes to eventually decrypt he will be formatting the drives and reinstalling Windows 7. (He's stuck there because he has a Delta 1010 soundcard and Adobe Audition 3.0) Not sure when the last time his Windows 7 was patched and he wasn't running any anti-virus protection.

Because of this I now have a new backup mantra: If it's not connected it can't be infected.

Nightly, I plan to check I'm not infected, then plug in external drive, image to it, turn the computer off and unplug the external drive. That drive won't be plugged in again until the next night or I need to restore an image from it.

Yes, I know that should have been my backup strategy from the get go, but it is what it is: A cautionary tale.