Ransomware: encrypts, blocks, demands payment

Ransomware is a type of malware that locks you out of your own files or systems, either by encrypting them so you cannot open them or by blocking access entirely. The attacker then demands a ransom, typically in cryptocurrency, to release the data. Unlike other malware that might steal data quietly, ransomware makes its presence known immediately, often with a screen or message demanding payment within a deadline. A key contrast: ransomware holds your data hostage, whereas a virus might just corrupt files without asking for money.

To spot ransomware questions, remember that paying the ransom does not guarantee you will get your data back—attackers may take the money and vanish, or leave the encryption in place. A common trick in exams is to present a scenario where paying seems the only option, but the correct answer will point to prevention measures like offline backups, least privilege access, and regular updates. Another elimination hint: if a question mentions a demand for payment in exchange for a decryption key, it is almost certainly ransomware, not a trojan or worm.

To lock this in, think of the acronym 'EBD'—Encrypts, Blocks, Demands—and pair it with the rule: never pay, restore from backup instead. This turns the definition into a decision: when you see a locked screen and a payment demand, your first thought should be 'backup, not payment'.