Users Online
· Members Online: 0
· Total Members: 188
· Newest Member: meenachowdary055
Forum Threads
Latest Articles
Articles Hierarchy
Best ways to recover from a hacked system.
Best ways to recover from a hacked system.
Recommendation for W10 recovery when an apparent hacker on system startup messages you with something like..." There is a problem with your system. Do not try to restart, or you may lose your data. Call xxx.xxx.xxxx to fix the problem."
A forced shutdown and restart does not work. For these past infections, and assuming I can get the system up enough to run Malwarebytes, that will usually take care of the problem. Not this time. My next attempt will be to remove the hard drive (harder to do in an AIO) and then connect it to another system with Malwarebytes and clean the drive but first saving important data. My last step if all of the above doesn't work is to regen the system.
I'm sure I'm not the first to ask this question, but I've now seen this or heard about it from several other folks. What are your best suggestions?
That is my usual final solution. Thought you may have had an easier approach. How do these hackers get around an active Norton app?
No AV tool is foolproof. Particularly not Norton. Windoze Defender which is already built into Windoze is my choice, no need to get a 3rd party product which you even have to pay for!
Most of the time this happens if you open links in E-Mails, or visit hacked or bogus web-sites.
Unless you understand the internals of Windows so well that you know how every system resource work, it's better to just fully reinstall.
Do you need to recover the data? Is the data visible from the other system? If it is, just copy it off and reinstall, then copy it back. The simpler thing to do for the future is to have a backup.
You've also mentioned past infections. You're doing something wrong if this is a frequent thing. You should not be relying on Malwarebytes to recover from an infection. You should be avoiding them in the first place.
Viruses don't install themselves anymore. It's usually some user interaction that causes it. You generally have to click on something to start them.
In addition to having Windows Defender, you should have an AdBlocker. I recommend AdBlock Plus for most users, since they won't have to unblock the settings for major known sites to retain access. It's just less hassle to support a non-tech user. I've had an adblocker on my primary browser since they first came out. I also recommend turning off all remote images and all link previews in all your email programs. I've had those off since at least 2000. Prior to that I was using mail on the command line.
Suppose you suspect that your system has been infected with ransomware. In that case, it is very important that you immediately disconnect it from any network, including the Internet, to prevent the malware from spreading and possibly exfiltrating your data.
To avoid future infections, it is recommended that you practice good cybersecurity hygiene, such as avoiding suspicious links or email attachments, keeping your software and operating systems up to date, and implementing robust backup and recovery procedures.
You haven't posted any screen shots or pictures, but that sounds like a tech support scam, not a ransomware. If you shutdown and log in as a different user, does it come back?
If not, then it's associated with account only. Most of the times, if you kill the browser process and don't restore the pages when you start it, it goes away. But that doesn't mean it always will. If it is a tech support scam, you could just blow away the profile and get rid of it.
If it's something else (I wouldn't rule out ransomware, but I've seen a LOT more tech support scam windows than ransomware, so I'm leaning that way), then why are you cleaning the hard drive? I mean, how you can possibly trust that Windows installation again? It's been infected by something tricky. The bad guys are always trying to find ways around anti-malware software… and it seems maybe they did if malware bytes didn't clean it… so what makes you CONFIDENT something else will clean it? If the user does ANYTHING sensitive on the machine - online banking, investing, email, or anything else they MIGHT not want someone else seeing, then you wipe and reload. (Heck, if it's really used for something important, you might just get a new PC - you don't know when exploits have been found to compromise BIOS or some other area of the computer that could persist across installations).
We all want to think we can fix anything, but there's a saying, I'm sure you've heard it, YOU (as in IT support) has to be right 100% of the time. A criminal needs to be right ONCE.
Have you tried booting in Safe Mode?
When I've run into these scenarios, I usually find that I can boot to a different user (may need to use the Utilman trick to create and enable another user) and clean up the problem. I have always found these to be pretty benign once you can log back in, BUT, that's no guarantee.
If you were being really cautious, do the copy data, wipe (don't skip this step!), reinstall from scratch.
If you are going to remove the drive, consider replacing it with a new SSD, especially if it presently has a HDD. They're not that expensive, it will make a big improvement in performance if they have a HDD, it will make the data copy easier (I'd get a USB-SATA case, under $15US from Amazon), and it means you won't be deleting the old data until you are sure you got it all.
Open Command Prompt in admin mode and run these:
1dism /online /cleanup-image /checkhealth
2chkdsk
3sfc /scannow
The first 2 are checks only, and should be quick if nothing's wrong. The 3rd one actually does fix things and will fix corrupted system files. If the first command detects errors, then run
1dism /online /cleanup-image /checkhealth
If the 2nd command detects errors, then run the following and reboot.
1chkdsk
Virus scanners only scan for known virus signatures. They won't detect new types if the company hasn't encountered them yet to figure out the signature to detect. It's an after the fact thing.
Install an adblocker or install a browser security engine that will intercept malware coming from websites.
“Carbonite are outstanding but very expensive”: last I checked, $57/year for file backup to cloud storage. I don't use it as my primary backup, but I think that's a very reasonable price, despite its shortcomings. Of course, “expensive” is subjective.
Again, thanks for all of the follow-up comments.
“Perhaps there was a hard drive sector failure”: if that were the case, it doesn't sound as if you've resolved it. Expect that it will return.
>> it appeared to correct itself. << what do you mean? it should help if you post what you saw, or what happened
If you don't know for sure what happened, you really should just back up your data and reinstall the OS. Whatever happened could sill bi lurking on your system to wreak havoc again.
Immediately stop using the system. This typical for ransomware. Data is probably being encrypted & will then have to pay a big ransom to the criminals to get it decrypted again, and it will be not at all clear that you will even get the decryption if do pay.
You should do a clean OS installation, change all your logins, & restore your data from your backups.