Ransomware Recovery Question

Did it look something like this?

If so, that’s a fake warning, intended to drive you to the site or phone number given, where you will be introduced to grief when you had none to begin with.

To add insult to (fake) injury, they sometimes lock up the “error” window, making it difficult to navigate elsewhere. Hint: you can just disable the one tab in your process list to get rid of it, so Don’t Panic.

The moral? Don’t visit unknown porn sites. :slight_smile:

Yes, worst case, pull the plug.
If you are in a browser and can’t close it, start task manager and tell it to kill the process. (ctl-alt-del or right click on lower right clock to open task mgr).

As I said, it takes a LONG time to rewrite a ton of files. As others mentioned, the ability to decrypt is above our pay grade - of even the FBI, let alone a typical help desk or tech support. So if it’s a problem, kill the machine. best case, someone removes the hard disk for you, hooks it as a second drive to another system, and does scans and cleaning that way to guarantee the virus is not carrying on.

But remember - most of these are “lego sets” - guys with moderate tech ability and some tricks they downloaded have put together a canned function to run their favourite scam. A virus to do everything bad and defend itself would be bigger than Windows. A virus that needs several minutes or an hour to rewrite your data is not going to also announce itself immediately and ask you to call 1-800-pay-crooks. A virus that wants to take over your PC and use it to launch spam or other nefarious stuff, or watch your keystrokes while you type your email and bank passwords - is not going to also announce “hello, you’re infected, send me money” - which guarantees you clean your computer. Virus used to disable windows updates and virus protection when there were 3 or 4 dominant programs - but the number of different AV programs (and versions) has multiplied, it’s far too complex to beat all of them at once; even the number of different browsers is too varied today; with Windows 10, the proportion of un-updated Windows is going down, as is the number of machines with no anti-virus.

From my experience, the majority of serious virus takeovers are from fake emails nowadays. People deliberately run an attachment in the mistaken belief it’s something else, or enter private login information on a phishing site from an email.

The last few ransom-wares I’ve dealt with not only saw the D drive, but also mapped network drives.

As a former IT technician, I can tell you that this is bad advice. Malware will not only enumerate local drives but also network attached drives.

Edit: I see Wolf333 makes the same point. Guess I should have read ahead. :slight_smile:

yep, it can (and will) F up any connected volumes you have write access to.

Here McAfee decrypt an example of one such ransomware malware.

I saw a virus infection over a decade ago that not only saw mapped drives, but crawled through the network shares across the globe on the corporate network, and infected any shares it had write access to. Fortunately it was not an encryption virus back then, but the virus originated from a consultant’s laptop in Singapore (we think) and infected the research group in Canada who figured the corporate “don’t share C:” policy did not apply to them.

For ransomware, it will indeed scan all accessible drives.

OTOH, it is surprising to find once in a while (not terribly common) that some malware (and non-malware) assumes the OS is in C:\Windows rather than windir.

(Guess how I know this.)

And other things like that.

We got hit by Zepto at my workplace this week. Two infected machines managed, between them, to destroy nearly the whole of the network shared drives for half a dozen different departments.

Fortunately, the backups are performed using server-level snapshots - the backup process can see the servers, but the malware can’t see the backup repository or directly damage it (it’s still possible for the malware to cause loss of data by working insidiously and polluting all of the recent backups, but we caught this one in time and stopped it)

I had a ransomeware hit some weeks ago.

ALL my graphic and movie files plus all document files were encrypted on ALL drives in the computer, so saying only the “C” drive is vulnerable is false.

I have regular backups on drive “E” and the one consolation was that files that were INSIDE the backup folder were not affected.

Malwarebytes has a BETA version of an antiransomware program - https://forums.malwarebytes.org/topic/177751-introducing-malwarebytes-anti-ransomware-beta/

Don’t know how effective it is - I have been using it for some weeks now and have not been hit again, but that my just be luck. :smiley:

Just curious, did you pay the ransom? I cannot fault someone who does, so I am not judging.

I have always used Ad-Block and Ghostery; on your suggestion I installed No-script a few days ago. I’m on a Mac, the one that I found is called NoScript Suite Lite.

As I’ve been browsing over the past few days, I have discovered that almost every site that I go to has something that doesn’t work with scripts disabled. So I infer that almost every site uses bona fide scripts to some degree? I have ended up whitelisting pretty much all of the sites that I trust and commonly visit.

So, it seems that this is effectively giving me a self-imposed “two click rule” on any new potentially dubious site that I might visit? I got to a new site; I almost inevitably discover that it probably doesn’t work quite right without scripts; and I then have to decide if I really trust the site enough to whitelist it and trust it to run scripts.

Is that a reasonable view of how I should be using this?

Or are there many sites that do work fine without scripts, and I’m just suffering from confirmation bias and forgetting the times when I don’t have to whitelist?

NO

Luckily I had done a backup just the day before so nothing much to be lost.

As I said the files inside the backup folder were not infected so was able to use the backup, but it has made me more aware and now the only time by backup drive is connected to the computer is when I’m actually doing a backup.

Would I have paid a ransom had I not had a recent backup and lost everything **NO **

Mine is a home computer with personal papers and family photos some irreplaceable but same would have happened if the house burn down or the computer was stolen, no way back from that.

Don’t know how I would have reacted had it been my business with all important and confidential information on it. Much against my principle probably have taken a chance on paying the ransom.

Hopefully I will never have to make that decision in the future.

Another way to protect your computer from ransomware is to run your browser in a sandbox environment. This causes anything your browser writes to be saved in a virtual sandbox area and not on the real computer. The browser thinks it’s writing to the real location, but the virtual sandbox environment saves that write to the sandbox. When the browser exits, the sandbox is deleted. If a virus tried to write to your computer, it would only write to the sandbox and not affect your computer. Sandboxie is one product which provides this capability.

The advantage to the sandbox can also be an inconvenience. Since everything written is thrown away when the browser exits, that means things you might want to save are also deleted. Things like cookies, saved passwords, saved form data, web page cache, downloaded files, etc. will all be deleted. Usually the sandbox environment will let you save off the downloaded files if you want. But you can run the browser sandboxed or not, so it can still run it normally if you need.

So by [mostly] avoiding dodgy sites, not clicking the link in the email from Paypal saying that my account will be frozen, and not clicking any link that comes in an unsolicited email, I have a high chance of avoiding problems then?

I’d say a near-100% chance. At least until something new is invented.

  • Avoid emails supposedly from friends, too, if they look suspicious.

That last part hasn’t been true for years. From 2012–

More recently–

Nevertheless, the screen shot I supplied was an offshoot from a site that tends to spawn porn sites and such scares, and was recorded less than a year ago.

If you do a search about ransomware infection you’ll find that many if not most people got caught not by visiting dodgy sites but just normal computer use.

I think mine came with my kids automatic Minecraft update.

:frowning:

I got the notice from a site where I was watching fishing movies. If it had been a porn site I could have understood it, but this was not.