Users Online

· Guests Online: 8

· Members Online: 0

· Total Members: 188
· Newest Member: meenachowdary055

Forum Threads

Newest Threads
No Threads created
Hottest Threads
No Threads created

Latest Articles

Best ways to recover from a hacked system.

Best ways to recover from a hacked system.

Recommendation for W10 recovery when an apparent hacker on system startup messages you with something like..." There is a problem with your system.  Do not try to restart, or you may lose your data.  Call xxx.xxx.xxxx to fix the problem."  

 

A forced shutdown and restart does not work.  For these past infections, and assuming I can get the system up enough to run Malwarebytes, that will usually take care of the problem.  Not this time.  My next attempt will be to remove the hard drive (harder to do in an AIO) and then connect it to another system with Malwarebytes and clean the drive but first saving important data.  My last step if all of the above doesn't work is to regen the system.   

 

I'm sure I'm not the first to ask this question, but I've now seen this or heard about it from several other folks.  What are your best suggestions? 

 

 

+3
User avatarUser avatarUser avatar

Avatar of undefined
Last Comment
serialband
5/03/2024
Avatar of rindi
rindi
Flag of Switzerland image

4/26/2024

Immediately stop using the system. This typical for ransomware. Data is probably being encrypted & will then have to pay a big ransom to the criminals to get it decrypted again, and it will be not at all clear that you will even get the decryption if do pay.

 

You should do a clean OS installation, change all your logins, & restore your data from your backups.

Avatar of tonyadam
tonyadam
Flag of United States of America image

ASKER


4/26/2024

That is my usual final solution.  Thought you may have had an easier approach.  How do these hackers get around an active Norton app?

Avatar of rindi
rindi
Flag of Switzerland image

4/26/2024

No AV tool is foolproof. Particularly not Norton. Windoze Defender which is already built into Windoze is my choice, no need to get a 3rd party product which you even have to pay for!

 

Most of the time this happens if you open links in E-Mails, or visit hacked or bogus web-sites. 

Avatar of serialband
serialband
Flag of Ukraine image

4/26/2024

Unless you understand the internals of Windows so well that you know how every system resource work, it's better to just fully reinstall.

 

Do you need to recover the data?  Is the data visible from the other system?  If it is, just copy it off and reinstall, then copy it back.  The simpler thing to do for the future is to have a backup.

 

You've also mentioned past infections.  You're doing something wrong if this is a frequent thing.  You should not be relying on Malwarebytes to recover from an infection.  You should be avoiding them in the first place.

 

Viruses don't install themselves anymore.  It's usually some user interaction that causes it.  You generally have to click on something to start them.

 

In addition to having Windows Defender, you should have an AdBlocker.  I recommend AdBlock Plus for most users, since they won't have to unblock the settings for major known sites to retain access.  It's just less hassle to support a non-tech user.  I've had an adblocker on my primary browser since they first came out.  I also recommend turning off all remote images and all link previews in all your email programs.  I've had those off since at least 2000.  Prior to that I was using mail on the command line.

Avatar of madunix
madunix

4/27/2024

Suppose you suspect that your system has been infected with ransomware. In that case, it is very important that you immediately disconnect it from any network, including the Internet, to prevent the malware from spreading and possibly exfiltrating your data.

 

To avoid future infections, it is recommended that you practice good cybersecurity hygiene, such as avoiding suspicious links or email attachments, keeping your software and operating systems up to date, and implementing robust backup and recovery procedures.

Avatar of Lee W, MVP
Lee W, MVP
Flag of United States of America image

4/27/2024

You haven't posted any screen shots or pictures, but that sounds like a tech support scam, not a ransomware.  If you shutdown and log in as a different user, does it come back?

 

If not, then it's associated with account only.  Most of the times, if you kill the browser process and don't restore the pages when you start it, it goes away. But that doesn't mean it always will.  If it is a tech support scam, you could just blow away the profile and get rid of it.

 

If it's something else (I wouldn't rule out ransomware, but I've seen a LOT more tech support scam windows than ransomware, so I'm leaning that way), then why are you cleaning the hard drive?  I mean, how you can possibly trust that Windows installation again? It's been infected by something tricky.  The bad guys are always trying to find ways around anti-malware software… and it seems maybe they did if malware bytes didn't clean it… so what makes you CONFIDENT something else will clean it?  If the user does ANYTHING sensitive on the machine - online banking, investing, email, or anything else they MIGHT not want someone else seeing, then you wipe and reload.  (Heck, if it's really used for something important, you might just get a new PC - you don't know when exploits have been found to compromise BIOS or some other area of the computer that could persist across installations).

 

We all want to think we can fix anything, but there's a saying, I'm sure you've heard it, YOU (as in IT support) has to be right 100% of the time.  A criminal needs to be right ONCE.

Avatar of CompProbSolv
CompProbSolv
Flag of United States of America image

4/27/2024

Have you tried booting in Safe Mode?

 

When I've run into these scenarios, I usually find that I can boot to a different user (may need to use the Utilman trick to create and enable another user) and clean up the problem.  I have always found these to be pretty benign once you can log back in, BUT, that's no guarantee.

 

If you were being really cautious, do the copy data, wipe (don't skip this step!), reinstall from scratch.

 

If you are going to remove the drive, consider replacing it with a new SSD, especially if it presently has a HDD.  They're not that expensive, it will make a big improvement in performance if they have a HDD, it will make the data copy easier (I'd get a USB-SATA case, under $15US from Amazon), and it means you won't be deleting the old data until you are sure you got it all.

ASKER CERTIFIED SOLUTION
Avatar of tonyadam
tonyadam
Flag of United States of America image

4/29/2024
Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
Avatar of serialband
serialband
Flag of Ukraine image

4/29/2024

Open Command Prompt in admin mode and run these:

1dism /online /cleanup-image /checkhealth
2chkdsk
3sfc /scannow

Open in new window

 

The first 2 are checks only, and should be quick if nothing's wrong.  The 3rd one actually does fix things and will fix corrupted system files.  If the first command detects errors, then run

1dism /online /cleanup-image /checkhealth

Open in new window

If the 2nd command detects errors, then run the following and reboot.

1chkdsk

Open in new window

 

Virus scanners only scan for known virus signatures.  They won't detect new types if the company hasn't encountered them yet to figure out the signature to detect.  It's an after the fact thing.

 

Install an adblocker or install a browser security engine that will intercept malware coming from websites.

 

Avatar of CompProbSolv
CompProbSolv
Flag of United States of America image

4/30/2024

“Carbonite are outstanding but very expensive”: last I checked, $57/year for file backup to cloud storage.  I don't use it as my primary backup, but I think that's a very reasonable price, despite its shortcomings.  Of course, “expensive” is subjective.

Avatar of tonyadam
tonyadam
Flag of United States of America image

ASKER


5/02/2024

Again, thanks for all of the follow-up comments.  

Avatar of CompProbSolv
CompProbSolv
Flag of United States of America image

5/02/2024

“Perhaps there was a hard drive sector failure”: if that were the case, it doesn't sound as if you've resolved it.  Expect that it will return.  

Avatar of nobus
nobus
Flag of Belgium image

5/03/2024

>>  it appeared to correct itself.   <<   what do you mean?  it should help if you post what you saw, or what happened

Avatar of serialband
serialband
Flag of Ukraine image

5/03/2024

If you don't know for sure what happened, you really should just back up your data and reinstall the OS.  Whatever happened could sill bi lurking on your system to wreak havoc again.

Comments

No Comments have been Posted.

Post Comment

Please Login to Post a Comment.

Ratings

Rating is available to Members only.

Please login or register to vote.

No Ratings have been Posted.
Render time: 1.68 seconds
10,912,135 unique visits