Ransomware

R

raylaw21

New Member
Jul 15, 2005
32
So last night my Dad click on or downloaded something he shouldn't have and someone took over his computer (Window 8.1 desktop. They downloaded some sort of software on his system. What is really bad is that my Dad then got a phone call from someone claiming to be Microsoft( caller id says: Skype#) and they wanted money to fix the computer. Some crazy amount too like 300 dollars. Luckily my Dad hung up on them and shut his computer off. The only problem is now when we start the computer it goes to a random log in screen asking for a password that the scammers want to get paid for. Now I can get into Windows recovery mode but every time I tried to do something Windows says that there is no Admin account.So the hackers must of deleted that account. They won't even let me get into safe mode either. I do have a windows 8 disc that I can install if I can find to get it to run.

My question is what are my options? Replace the HD? Throw the computer away? Is there a way I can crash the system completely so I can reload the OS? Any advice would be helpful.
 
jercra

jercra

No longer respects DeChambeau
SoSH Member
Jul 31, 2006
3,152
Arvada, Co
Does he have backups of his important data?  If so you can just boot to a windows CD (or Linux if you can't find a Windows disk) and format the drive and the computer will be fine.  He'll also want to reset all of his passwords if he had any of them stored on the computer in the browser cache or PW programs.  Also, tell your dad that you don't have to install anything to watch internet porn.
 
CaptainLaddie

CaptainLaddie

dj paul pfieffer
SoSH Member
Sep 6, 2004
36,911
where the darn libs live
He could remove the hard drive and plug it into a Mac or Linux system and recover his important data that way -- if it isn't already gone (because I'm sure these folks trying to get a ransom from him are honest and will happily hand his data right over).
 
Couperin47

Couperin47

Member
SoSH Member
Jul 14, 2005
16,601
The state whose symbol is a pile of rubble...
CaptainLaddie said:
He could remove the hard drive and plug it into a Mac or Linux system and recover his important data that way -- if it isn't already gone (because I'm sure these folks trying to get a ransom from him are honest and will happily hand his data right over).
Click to expand...
 
Nope, in almost all cases this software has encrypted virtually all the files on the HD and without the public key he can't recover a damn thing, if he was incredibly lucky and was hit with 'incompetent ransomeware' there's a slight chance, the fact that they scanned his drive, found his phone # and actually called him means this was not a 'script-kiddie', it's the work of sophisticated Internet mafia, mostly located in E. Europe and their software is NOT 'incompetent'.
 
SumnerH

SumnerH

Malt Liquor Picker
Dope
SoSH Member
Jul 18, 2005
32,023
Alexandria, VA
CaptainLaddie said:
He could remove the hard drive and plug it into a Mac or Linux system and recover his important data that way -- if it isn't already gone (because I'm sure these folks trying to get a ransom from him are honest and will happily hand his data right over).
Click to expand...
 
It sounds like something akin to CryptoLocker, which encrypts lots of files (e.g. Office files) and then sends the key to a central server.  You pay to get the decryption key back.  If that's the case, accessing from another OS won't help you access those files, though it'll let you get to other files.
 
http://en.wikipedia.org/wiki/CryptoLocker
 
SumnerH

SumnerH

Malt Liquor Picker
Dope
SoSH Member
Jul 18, 2005
32,023
Alexandria, VA
If he's lucky it might be CryptoDefense:
 


[SIZE=13.63636302947998px]research by Symantec discovered that CryptoDefense contained a major design flaw, inadvertently allowing the private key to remain stored on the computer within the user's [/SIZE]Application Data[SIZE=13.63636302947998px] folder due to the behavior of Windows' encryption API[/SIZE]
Click to expand...
 
Couperin47

Couperin47

Member
SoSH Member
Jul 14, 2005
16,601
The state whose symbol is a pile of rubble...
canderson said:
I can't help but that's scary as fuck they called him.
Click to expand...
 
Yep. Need to endlessly preach: backup image on a separate HD  and decent serious AV, the Webroot SecureAnywhere would have almost certainly popped up a huge GET ME OUT OF HERE the second he stumbled to that web page, and it's friggin 5 bucks this weekend. Most of the free AV options these days are too limited... just scanning at download isn't enough anymore...
 
R

raylaw21

New Member
Jul 15, 2005
32
 
jercra said:
Does he have backups of his important data?  If so you can just boot to a windows CD (or Linux if you can't find a Windows disk) and format the drive and the computer will be fine.  He'll also want to reset all of his passwords if he had any of them stored on the computer in the browser cache or PW programs.  Also, tell your dad that you don't have to install anything to watch internet porn.
Click to expand...
 


How can I boot from a windows CD? Which we do have. I can't get into safe mode or any other mode since they deleted Admin account. Also we do not need any of the files on his computer if that helps.
 
jercra

jercra

No longer respects DeChambeau
SoSH Member
Jul 31, 2006
3,152
Arvada, Co
When you first boot the computer you should see a screen that says  "press F2 (or F12, or Del or something) to enter setup" or something along those lines.  That will take you to the bios where you can change your boot order to put CD ROM first in the list.  Some computers also just have a separate boot selection screen the you can access by hitting some other key before it gets to its current boot.  If yours does then you can just hit that key and select the CD ROM.
 
wibi

wibi

Member
SoSH Member
Jul 15, 2005
11,848
raylaw21 said:
How can I boot from a windows CD? Which we do have. I can't get into safe mode or any other mode since they deleted Admin account. Also we do not need any of the files on his computer if that helps.
Click to expand...
 
Trash the HD, buy a new one and reinstall windows on that drive. 
 
wibi

wibi

Member
SoSH Member
Jul 15, 2005
11,848
Couperin47 said:
 
This advice is akin to telling someone to install a new engine in their car the first time it needs new spark plugs...
Click to expand...
 
A new HD costs the same as a new set of spark plugs.  Your analogy might work if HD costs were the proportionally the same as an engine to a car. 
 
Couperin47

Couperin47

Member
SoSH Member
Jul 14, 2005
16,601
The state whose symbol is a pile of rubble...
wibi said:
 
A new HD costs the same as a new set of spark plugs.  Your analogy might work if HD costs were the proportionally the same as an engine to a car. 
Click to expand...
 
Except that the logical comparison is between the cost of the new HD ($80 to $120) vs the cost of a reformat & MBR rebuild if even necessary (rarely) which is ZERO ... I'm not screwing NGKs or Champions into a laptop nor am I plugging Seagates or WDs into a 4 or 6 banger...
 
You must log in or register to reply here.
Top Bottom