We have taken the unusual step of emailing all of our clients to alert them to the Cryptolocker virus that’s doing the rounds. Its the most destructive virus we have seen at Orbits.

For those who are interested, this is the email we sent to all of our clients today:

“Good afternoon all, could you please pass this on to all staff to make them aware of a new threat doing the rounds. This one is nasty.

We don’t normally email alerts out, usually relying on our @OrbitsITAlerts twitter account (please follow if you aren’t already) but we felt we should alert you to a very real and prevalent threat that is doing the rounds at the minute.

There is a new virus in the wild which attacks compromised computers by encrypting certain file formats (word, pdf, excel etc) which means they can’t be opened by anyone without the encryption key. Unfortunately it will also encrypt any files on network shares that the user has access to. The virus will then present a ransom message asking for payment to unlock the files, usually around $300.

Because the virus encrypts files with its own keys, there is nothing we, or any other IT provider, can do to recover those documents except to restore them from backups. We do not recommend paying the ransom for obvious reason. It is therefore vitally important that you ensure ALL critical data is backed up and stored offsite (attached backup drives can also sometimes be encrypted). We have already had 1 client suffer with this virus but we were fortunate that we could restore data from a backup.

This virus is being spread predominantly through email and SPAM. Emails claiming to come from the following companies have been seen by us recently containing this virus:

Companies House

Lloyds Bank

Sage

HSBC

The email will usually contain a zip file which is where the virus is held. Under no circumstances open an email attachment unless you are 100% sure of its origin and you are expecting it. If you are unsure, please check in with us on 02920 003 313 before clicking.

If you think you have opened something you shouldn’t, disconnect your PC from the network immediately or power it down immediately and give us a call.”