# Ransomware Recovery Question **URL:** \ **Category:** Factual Questions\ **Created:** [July 4, 2016, 9:07pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093 "2016-07-04T21:07:23Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 6, 2016, 2:22am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/21 "2016-07-06T02:22:53Z")
> [@Oddball\_92](#): > > The reason for my initial question is that while I was on a website I had not previously been on, I suddenly got flashing banners, with bells and whistles going off, saying a virus has been installed and to call a certain number for instructions as to how to get rid of it. I just shut down the computer, rebooted and, so far, everything seems fine. I did a virus/malware scan and no issues were detected. Did it look something [like this?](http://doorbell.net/junk/Important_security_msg1a.jpg) If so, that’s a fake warning, intended to drive you to the site or phone number given, where you will be introduced to grief when you had none to begin with. To add insult to (fake) injury, they sometimes lock up the “error” window, making it difficult to navigate elsewhere. Hint: you can just disable the one tab in your process list to get rid of it, so Don’t Panic. The moral? Don’t visit unknown porn sites. 🙂 ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 6, 2016, 2:57am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/22 "2016-07-06T02:57:49Z")
Yes, worst case, pull the plug. If you are in a browser and can’t close it, start task manager and tell it to kill the process. (ctl-alt-del or right click on lower right clock to open task mgr). As I said, it takes a LONG time to rewrite a ton of files. As others mentioned, the ability to decrypt is above our pay grade - of even the FBI, let alone a typical help desk or tech support. So if it’s a problem, kill the machine. best case, someone removes the hard disk for you, hooks it as a second drive to another system, and does scans and cleaning that way to guarantee the virus is not carrying on. But remember - most of these are “lego sets” - guys with moderate tech ability and some tricks they downloaded have put together a canned function to run their favourite scam. A virus to do everything bad and defend itself would be bigger than Windows. A virus that needs several minutes or an hour to rewrite your data is not going to also announce itself immediately and ask you to call 1-800-pay-crooks. A virus that wants to take over your PC and use it to launch spam or other nefarious stuff, or watch your keystrokes while you type your email and bank passwords - is not going to also announce “hello, you’re infected, send me money” - which guarantees you clean your computer. Virus used to disable windows updates and virus protection when there were 3 or 4 dominant programs - but the number of different AV programs (and versions) has multiplied, it’s far too complex to beat all of them at once; even the number of different browsers is too varied today; with Windows 10, the proportion of un-updated Windows is going down, as is the number of machines with no anti-virus. From my experience, the majority of serious virus takeovers are from fake emails nowadays. People deliberately run an attachment in the mistaken belief it’s something else, or enter private login information on a phishing site from an email. ---
**Author:** ![Wolf333](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolf333/32/3460_2.png) [@Wolf333](https://boards.straightdope.com/u/Wolf333)\ **Post date:** [July 6, 2016, 3:15am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/23 "2016-07-06T03:15:31Z")
> [@SigMan](#): > > I partition my drive to C: and D:. The OS goes to the C: drive and my sensitive data on D:. > > The C: drive is 1/4 to 1/3 of the capacity of the whole drive. More than enough to hold the OS and installed programs. I use the D: drive for data and archives. > > Once you have the drive ready make a back up copy of the C: drive and you’re done. **Hackers usually don’t see your D: drive**. > > When your system gets hijacked the reset button is your best friend, push it or hard power off instead. > > Unplug the modem once in a while to clear the cache and unplug your computer data cable off the modem overnight. The last few ransom-wares I’ve dealt with not only saw the D drive, but also mapped network drives. ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [July 6, 2016, 7:51am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/24 "2016-07-06T07:51:37Z")
> [@SigMan](#): > > Hackers usually don’t see your D: drive. As a former IT technician, I can tell you that this is bad advice. Malware will not only enumerate local drives but also network attached drives. Edit: I see **Wolf333** makes the same point. Guess I should have read ahead. 🙂 ---
**Author:** ![jz78817](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jz78817/32/1028_2.png) [@jz78817](https://boards.straightdope.com/u/jz78817)\ **Post date:** [July 6, 2016, 12:36pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/25 "2016-07-06T12:36:37Z")
> [@Quartz](#): > > As a former IT technician, I can tell you that this is bad advice. Malware will not only enumerate local drives but also network attached drives. > > Edit: I see **Wolf333** makes the same point. Guess I should have read ahead. 🙂 yep, it can (and will) F up any connected volumes you have write access to. ---
**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\ **Post date:** [July 6, 2016, 1:27pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/26 "2016-07-06T13:27:30Z")
[Here](https://blogs.mcafee.com/mcafee-labs/javascript-php-joint-exercise-delivers-nemucod-ransomware/) McAfee decrypt an example of one such ransomware malware. > [@](#): > > The “for loop” checks for the directory chr(67) [C] to chr(90) [Z] with the help of the is\_dir() function. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 6, 2016, 8:18pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/27 "2016-07-06T20:18:36Z")
> [@Quartz](#): > > As a former IT technician, I can tell you that this is bad advice. Malware will not only enumerate local drives but also network attached drives. > > Edit: I see **Wolf333** makes the same point. Guess I should have read ahead. 🙂 I saw a virus infection over a decade ago that not only saw mapped drives, but crawled through the network shares across the globe on the corporate network, and infected any shares it had write access to. Fortunately it was not an encryption virus back then, but the virus originated from a consultant’s laptop in Singapore (we think) and infected the research group in Canada who figured the corporate "don’t share C:" policy did not apply to them. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [July 6, 2016, 8:38pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/28 "2016-07-06T20:38:51Z")
For ransomware, it will indeed scan all accessible drives. OTOH, it is surprising to find once in a while (not terribly common) that some malware (and non-malware) assumes the OS is in C:\Windows rather than windir. (Guess how I know this.) And other things like that. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [July 6, 2016, 8:56pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/29 "2016-07-06T20:56:39Z")
We got hit by Zepto at my workplace this week. Two infected machines managed, between them, to destroy nearly the whole of the network shared drives for half a dozen different departments. Fortunately, the backups are performed using server-level snapshots - the backup process can see the servers, but the malware can’t see the backup repository or directly damage it (it’s still possible for the malware to cause loss of data by working insidiously and polluting all of the recent backups, but we caught this one in time and stopped it) ---
**Author:** ![Chickenwrangler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chickenwrangler/32/91_2.png) [@Chickenwrangler](https://boards.straightdope.com/u/Chickenwrangler)\ **Post date:** [July 8, 2016, 2:27am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/30 "2016-07-08T02:27:05Z")
I had a ransomeware hit some weeks ago. ALL my graphic and movie files plus all document files were encrypted on ALL drives in the computer, so saying only the “C” drive is vulnerable is false. I have regular backups on drive “E” and the one consolation was that files that were INSIDE the backup folder were not affected. Malwarebytes has a BETA version of an antiransomware program - [https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/](https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/) Don’t know how effective it is - I have been using it for some weeks now and have not been hit again, but that my just be luck. 😃 ---
**Author:** ![Oddball\_92](https://avatars.discourse-cdn.com/v4/letter/o/b3f665/32.png) [@Oddball\_92](https://boards.straightdope.com/u/Oddball_92)\ **Post date:** [July 8, 2016, 2:37am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/31 "2016-07-08T02:37:40Z")
> [@Chickenwrangler](#): > > I had a ransomeware hit some weeks ago. > > ALL my graphic and movie files plus all document files were encrypted on ALL drives in the computer, so saying only the “C” drive is vulnerable is false. > > I have regular backups on drive “E” and the one consolation was that files that were INSIDE the backup folder were not affected. > > Malwarebytes has a BETA version of an antiransomware program - [https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/](https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/) > > Don’t know how effective it is - I have been using it for some weeks now and have not been hit again, but that my just be luck. 😃 Just curious, did you pay the ransom? I cannot fault someone who does, so I am not judging. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [July 8, 2016, 3:38am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/32 "2016-07-08T03:38:24Z")
> [@Francis\_Vaughan](#): > > Best answer is to always browse with the standard set of addons - typically no-script, ad-block, ghostery. **No-script is an absolute necessity.** If your browser won’t support it, switch. I have always used Ad-Block and Ghostery; on your suggestion I installed No-script a few days ago. I’m on a Mac, the one that I found is called NoScript Suite Lite. As I’ve been browsing over the past few days, I have discovered that almost every site that I go to has something that doesn’t work with scripts disabled. So I infer that almost every site uses _bona fide_ scripts to some degree? I have ended up whitelisting pretty much all of the sites that I trust and commonly visit. So, it seems that this is effectively giving me a self-imposed “two click rule” on any new potentially dubious site that I might visit? I got to a new site; I almost inevitably discover that it probably doesn’t work quite right without scripts; and I then have to decide if I really trust the site enough to whitelist it and trust it to run scripts. Is that a reasonable view of how I should be using this? Or are there many sites that do work fine without scripts, and I’m just suffering from confirmation bias and forgetting the times when I don’t have to whitelist? ---
**Author:** ![Chickenwrangler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chickenwrangler/32/91_2.png) [@Chickenwrangler](https://boards.straightdope.com/u/Chickenwrangler)\ **Post date:** [July 9, 2016, 4:50am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/33 "2016-07-09T04:50:18Z")
> [@Oddball\_92](#): > > Just curious, did you pay the ransom? I cannot fault someone who does, so I am not judging. NO Luckily I had done a backup just the day before so nothing much to be lost. As I said the files inside the backup folder were not infected so was able to use the backup, but it has made me more aware and now the only time by backup drive is connected to the computer is when I’m actually doing a backup. Would I have paid a ransom had I not had a recent backup and lost everything \*\*NO \*\* Mine is a home computer with personal papers and family photos some irreplaceable but same would have happened if the house burn down or the computer was stolen, no way back from that. Don’t know how I would have reacted had it been my business with all important and confidential information on it. Much against my principle probably have taken a chance on paying the ransom. Hopefully I will never have to make that decision in the future. ---
**Author:** ![filmore](https://avatars.discourse-cdn.com/v4/letter/f/7993a0/32.png) [@filmore](https://boards.straightdope.com/u/filmore)\ **Post date:** [July 9, 2016, 1:26pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/34 "2016-07-09T13:26:41Z")
Another way to protect your computer from ransomware is to run your browser in a sandbox environment. This causes anything your browser writes to be saved in a virtual sandbox area and not on the real computer. The browser thinks it’s writing to the real location, but the virtual sandbox environment saves that write to the sandbox. When the browser exits, the sandbox is deleted. If a virus tried to write to your computer, it would only write to the sandbox and not affect your computer. Sandboxie is one product which provides this capability. The advantage to the sandbox can also be an inconvenience. Since everything written is thrown away when the browser exits, that means things you might want to save are also deleted. Things like cookies, saved passwords, saved form data, web page cache, downloaded files, etc. will all be deleted. Usually the sandbox environment will let you save off the downloaded files if you want. But you can run the browser sandboxed or not, so it can still run it normally if you need. ---
**Author:** ![bob\_2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bob_2/32/3341_2.png) [@bob\_2](https://boards.straightdope.com/u/bob_2)\ **Post date:** [July 9, 2016, 2:36pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/35 "2016-07-09T14:36:47Z")
> [@md2000](#): > > From my experience, the majority of serious virus takeovers are from fake emails nowadays. People deliberately run an attachment in the mistaken belief it’s something else, or enter private login information on a phishing site from an email. So by [mostly] avoiding dodgy sites, not clicking the link in the email from Paypal saying that my account will be frozen, and not clicking any link that comes in an unsolicited email, I have a high chance of avoiding problems then? ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 9, 2016, 4:03pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/36 "2016-07-09T16:03:27Z")
> [@bob\_2](#): > > So by [mostly] avoiding dodgy sites, not clicking the link in the email from Paypal saying that my account will be frozen, and not clicking any link that comes in an unsolicited[sup]\*[/sup] email, I have a high chance of avoiding problems then? I’d say a near-100% chance. At least until something new is invented. - Avoid emails supposedly from friends, too, if they look suspicious. ---
**Author:** ![Flyer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/flyer/32/7298_2.png) [@Flyer](https://boards.straightdope.com/u/Flyer)\ **Post date:** [July 9, 2016, 10:28pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/37 "2016-07-09T22:28:23Z")
> [@Musicat](#): > > Did it look something [like this?](http://doorbell.net/junk/Important_security_msg1a.jpg) > > If so, that’s a fake warning, intended to drive you to the site or phone number given, where you will be introduced to grief when you had none to begin with. > > To add insult to (fake) injury, they sometimes lock up the “error” window, making it difficult to navigate elsewhere. Hint: you can just disable the one tab in your process list to get rid of it, so Don’t Panic. > > The moral? Don’t visit unknown porn sites. 🙂 That last part hasn’t been true for years. From 2012– > [@](#): > > Symantec, the maker of Norton AntiVirus software, found that “religious and ideological sites” have far surpassed pornographic websites as targets for criminal hackers. According to the company you’re now three times as likely to encounter malware—insidious software that can steal your data, pelt you with spam, or enslave your machine in a botnet—on your local church blog as you are on a porn site. > **[Porn Sites Used To Be Riddled With Computer Viruses. You’ll Never Guess Where...](https://slate.com/technology/2012/05/malware-and-computer-viruses-theyve-left-porn-sites-for-religious-sites.html)** > > As with herpes, one of the peripheral embarrassments of contracting a computer virus is that everyone has a pretty good idea of what you were up to... More recently– > [@](#): > > Nearly 75 percent of all legitimate websites have unpatched vulnerabilities, putting us all at risk. > **[Symantec Security Center](https://www.broadcom.com/support/security-center)** > > Symantec security research centers around the world provide unparalleled analysis of and protection from IT security threats that include malware, security risks, vulnerabilities, and spam. ---
**Author:** ![Musicat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/musicat/32/20189_2.png) [@Musicat](https://boards.straightdope.com/u/Musicat)\ **Post date:** [July 9, 2016, 11:30pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/38 "2016-07-09T23:30:22Z")
> [@Flyer](#): > > That last part [stay away from porn sites] hasn’t been true for years. Nevertheless, the screen shot I supplied was an offshoot from a site that tends to spawn porn sites and such scares, and was recorded less than a year ago. ---
**Author:** ![Chickenwrangler](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chickenwrangler/32/91_2.png) [@Chickenwrangler](https://boards.straightdope.com/u/Chickenwrangler)\ **Post date:** [July 10, 2016, 5:11am UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/39 "2016-07-10T05:11:05Z")
If you do a search about ransomware infection you’ll find that many if not most people got caught not by visiting dodgy sites but just normal computer use. I think mine came with my kids automatic Minecraft update. ☹ ---
**Author:** ![Oddball\_92](https://avatars.discourse-cdn.com/v4/letter/o/b3f665/32.png) [@Oddball\_92](https://boards.straightdope.com/u/Oddball_92)\ **Post date:** [July 11, 2016, 11:12pm UTC](https://boards.straightdope.com/t/ransomware-recovery-question/759093/40 "2016-07-11T23:12:53Z")
> [@Chickenwrangler](#): > > If you do a search about ransomware infection you’ll find that many if not most people got caught not by visiting dodgy sites but just normal computer use. > > I think mine came with my kids automatic Minecraft update. > > ☹ I got the notice from a site where I was watching fishing movies. If it had been a porn site I could have understood it, but this was not. [Previous page](https://boards.straightdope.com/t/ransomware-recovery-question/759093.md?page=1) [Next page](https://boards.straightdope.com/t/ransomware-recovery-question/759093.md?page=3)