Block, SkipCaptcha, Upload, Automoderated users, Check users, delete, edit, Moderators, move, oversight, protect, ratelimit-exempt, rollback
19,945
edits
Changes
→Cleanup: expanding
To begin recovering a personal computer from a ransomware infection, users should begin by isolating the effected computer. It should be disconnected from the Internet and any local network. Any flash drives, external hard drives, and other editable storage devices should be disconnected from the computer as well. The following are some possible steps which could be taken.
To begin recovering a personal computer from a ransomware infection, users should begin by isolating the effected computer. It should be disconnected from the Internet and any local network. Any flash drives, external hard drives, and other editable storage devices should be disconnected from the computer as well. The following are some possible steps which could be taken.
====Using disk image====
====Using disk image====
#Once isolated, try starting up the computer to the recovery CD, DVD, or flashdrive bootable device. For example, if DriveImage XML was used to create the image, use a boot CD such as [[Hiren's BootCD]] or [[UBCD4Win]]. ''(Note: the users should ensure they can boot to the external media before connecting their backup drive. In Hiren's, simply start up, then connect the drive. In UBCD, boot up, then shut down, connect the backup drive, then start the boot disk again.)''
#Once isolated, try starting up the computer to the recovery CD, DVD, or flashdrive bootable device. For example, if DriveImage XML was used to create the image, use a boot CD such as [[Hiren's BootCD]] or [[UBCD4Win]]. ''(Note: the users should ensure they can boot to the external media before connecting their backup drive. In Hiren's, simply start up, then connect the drive. In UBCD, boot up, then shut down, connect the backup drive, then start the boot disk again.)''
#Open the program used for imaging, and go through the restore initialization process. Users should always take their time and be cautious during this process. A mistake at this point could make them loose everything.
#If the ransomware prevents this, the user will need to "flash" (rewrite) their BIOS or replace their motherboard before proceeding. This is a fairly rare issue.
#Open the program (on the boot disk) used for imaging, and go through the restore initialization process. Users should always take their time and be cautious during this process. A mistake at this point could make them loose everything.
#Once the restore is complete, shut down the boot disk system, and disconnect all external storage devices.
#Once the restore is complete, shut down the boot disk system, and disconnect all external storage devices.
#Try starting the computer normally. If all goes well, the system should be exactly as it was when the disk image was taken.
#Try starting the computer normally. If all goes well, the system should be exactly as it was when the disk image was taken.
#If any other drives were effected by the ransomware, users should either use the same restore process from backups, (using a boot disk with the internal drive disconnected) wipe the disk(s) entirely (again, using only a boot disk), or keep the devices as they are, without connecting them to any computer, in case a flaw in the ransomware is later found, permitting data recovery.
#If any other drives were effected by the ransomware, users should either use the same restore process from backups (using a boot disk with the internal drive disconnected), wipe the disk(s) entirely (again, using only a boot disk), or keep the devices as they are without connecting them to any computer, in case a flaw in the ransomware is later found, permitting data recovery.
#If the ransomware comes back, it is probably on another storage device, such as a flashdrive, or in the [[BIOS]]. If it is in the BIOS, the user must either attempt to flash the BIOS, or simply replace the motherboard, then restore their drive contents again.
#If the ransomware comes back, it is probably on another storage device, such as a flashdrive, or in the [[BIOS]]. If it is in the BIOS, the user must either attempt to "flash" (rewrite) the BIOS, or simply replace the motherboard, then restore their drive contents again.
====Using file backups only====
====Using file backups only====
Without a full backup, a new operating system is needed. Therefore, users will probably need to do something along these lines:
#Insert an operating install disk, and boot to it, with all external storage devices disconnected.
#Format the drive (using NTFS format)
#Go through the install process, which will take some time to complete
#Once done, start the newly installed system, and configure it as desired. Then, copy on the file backups, as desired. When possible, some users prefer to put off entering their OS license key as long as possible, in case the ransomware comes back.
====Without backups====
====Without backups====
If a user has no backups, recovering the data can be very difficult, if not impossible. Some ransomeware contains flaws, permitting data recovery without paying the ransom. Doing some web searches may be wise, to see if a solution has been found. Also, some security companies will sometimes buy release keys and publish them for free, to cost the publisher money. Looking for such a key could also be advantageous.<br />
Users may also want to try using a boot disk and see if data is truly encrypted, or just "locked." In some cases, ransomware does not encrypt the data, so the files can be copied onto an external storage device using the boot disk.<br />
Sometimes, although ethically questionable, the pragmatic solution is to simply pay the ransom. Unfortunately, once the ransom is paid, the publisher has little incentive to provide the key. Sometimes, they may do exactly what they promise.
Other times, they may not provide the key, may demand more money, or provide a key which temporally released the data, but then locks it again. If the data is released, there is no guarantee that the computer is not still spreading the ransomware to other computers, either. If the ransom is paid and an unlock key is provided, it is often advised that they immediately back up their data using a boot disk, before using their computer further. Also, reinstalling the operating system may be wise, to ensure that the ransomware is gone.
====Other information====
If any memory devices are infected, then connected to a clean system, they can infect that system. Therefore, users should be careful to only access clean devices on clean systems. If a storage device is in question, the computer's hard drives can be disconnected, and using a boot disk alone, the user can attempt to verify that the device is clean (or not). If the ransomware attacks the BIOS, however, even this may not be safe to attempt.
==References==
==References==
{{reflist}}
{{reflist}}
[[Category:Malware]]
[[Category:Malware]]