What ransomware actually does
Ransomware locks up your files and demands payment to unlock them. The nastier versions do more than that: they hunt down backups and delete them, spread across any shared folders they can find, and often copy your data first so they can threaten to publish it even if you get everything back.
It usually gets in through something ordinary — a convincing fake invoice, a fake software update, a password used in more than one place. It's rarely clever. It's just effective against machines that haven't been updated, aren't being watched, and don't have a backup.
Why you need more than one layer
No single thing stops everything. Antivirus catches known threats; behaviour-based protection catches new ones that act suspiciously; web filtering stops your browser reaching a dodgy site at all; updates close the gaps attacks rely on; and backup is what saves you when all of that fails anyway.
That last one matters most. Assume something will eventually slip through, and judge your setup by whether you could get everything back on a bad day.
How ARK protects you
ARK Care combines these rather than relying on just one thing.
- Antivirus with behaviour-based blocking on every plan
- Stronger ransomware protection and the ability to undo damage, from Plus upward
- Deeper monitoring and web filtering on Pro, blocking dodgy sites before they load
- Updates installed automatically to close the gaps attacks rely on
- Encrypted UK backup with older versions kept, so a clean copy always exists
- We keep an eye on backups too, so you find out about a failure now, not during a crisis
If it's happening right now
Disconnect the machine from the internet straightaway — unplug the cable or turn off Wi-Fi — but don't wipe or reinstall anything yet. Don't pay the ransom; it funds the next attack and often doesn't even get you a working way back in.
Then call us on 01329 623 555. If the machine's on an ARK Care plan, we'll already have information showing what happened and when, which makes it much easier to work out what's affected and find a clean point to restore from.
Recovery, honestly explained
Getting back to normal means restoring from a backup taken before the attack, onto a machine that's been rebuilt or checked as clean. That's why keeping older versions matters — your most recent backup might already contain locked files.
It usually also means changing passwords for anything that machine had access to, since attackers often steal login details alongside locking your files. We'll talk you through both.