IGCSE Computer Science 0478: Ransomware vs Virus in a Malware Case Study

A small architecture firm keeps every current project drawing on one shared office laptop. One afternoon, an employee opens a file attachment they were expecting from a regular supplier. Within an hour, every project drawing on the laptop has been renamed with a strange new file extension, and a text file appears on the desktop demanding that the firm pay an amount of digital currency before the files will supposedly be restored.

(a) State the specific type of malware most likely responsible for this incident, and identify the detail in the scenario that supports your answer. [2]

(b) Explain how this type of malware affects a user's files differently from how a computer virus typically affects a user's files. [2]

(c) The firm decides not to pay. Give two precautions, other than avoiding suspicious attachments, that the firm could put in place so that future project drawings can be recovered without paying. [2]

Part (a): Identifying the malware

Two details point to a specific type of malware here: the affected files have been renamed with a new extension so they can no longer be opened normally, and a message on the desktop demands payment before the files will be released. This combination (files locked, then a ransom demanded for their return) is the defining behaviour of ransomware.

Part (b): Ransomware vs computer virus

A computer virus attaches itself to other files or programs; when the infected file is run, the virus replicates itself into further files and typically corrupts or deletes data as a side effect, without asking for anything in return. Ransomware instead deliberately encrypts or locks the user’s own files, keeping them intact but inaccessible, and only threatens to make them usable again once a ransom is paid. The damage is the loss of access itself, held for payment, rather than corruption or deletion.

Part (c): Making files recoverable without paying

The question asks specifically for precautions that let the firm get its files back without paying, so measures that only reduce the chance of infection (such as anti-malware software, patching, or restricting attachments) do not answer this, because they do nothing for files that are already encrypted. What actually lets encrypted files be recovered is having an unaffected copy to restore from:

Regular backups of the project drawings mean a recent, unencrypted copy of the files exists.
Storing the backup on a separate device or offline location, not permanently connected to the laptop or network, stops the ransomware from reaching and encrypting the backup copy along with the originals.
Keeping more than one previous backup version guards against the case where the most recent backup was itself taken after the infection had already started. An older, clean version would still be available.

Any two of these give the firm a way to restore the drawings from backup instead of paying the ransom.

Final answers

(a) Ransomware. Identified by the ransom demand for payment before the files are restored.
(b) Ransomware locks/encrypts files and demands payment for their return; a virus replicates and corrupts/deletes files without a ransom demand.
(c) Any two of: regular backups; backups stored offline/on a separate device; keeping multiple backup versions.