Jump to content

Ransomware attack aftermath

Izzdy
By Izzdy
in Programs, Apps and Websites
 Share
Posted

Hi, I'm not sure where to post this but I wanna my share experience dealing with this.  A bit of a context is that a friend of mine called me to look at her laptop. She said some files were corrupted and it turns out that EVERY file of her's are corrupted. *sigh*

 

The specifics of the type of file is an LMAS (.lma) type file. After looking around i saw a readme.txt file. Inside stated in short, pay 960 in bitcoin to some gibberish email. 

 

To be honest, I am not an expert to deal this sort of stuff and I just reset her laptop via Windows10 setting. 

 

Is there any benefits with my action taken there and I know the consequences that she will lose all of stuff. 

 

Please share your thoughts on this or any of you good people here have dealt with the same situation 

 

Current Build

CPU - Intel® Core™ i5-7500 Processor

Motherboard - MSI H110M Gaming Micro ATX LGA1151 Motherboard

RAM - Corsair Vengeance LPX 16GB (2 x 8GB) DDR4-2400 Memory

GPU - Zotac GeForce GTX 1070 8 GB MINI Video Card

Case - Segotep π Cube

Storage - Sandisk SSD PLUS 120GB 2.5" | Seagate BarraCuda 1TB 3.5" 7200RPM Internal Hard Drive | Western Digital - Blue 2TB 3.5" 5400RPM Internal Hard Drive

PSU -     Super Flower Leadex Silver 550 W 80+ Silver

Display(s) - 24" Class Full HD IPS Monitor (24MP68VQ-P)

Cooling - CRYORIG M9i | Cooler Master SickleFlow X 120mm Fan (Intake) | Cooler Master SickleFlow X 120mm Fan x2 (Exhaust)

 

Keyboard -  Corsair K70 RGB MK.2 Wired Gaming Keyboard

Mouse - Corsair M65 RGB ELITE Wired Optical Mouse

Sound - Edifier XM6PF

Operating System - Windows 10 Pro

PCPartPicker URL - https://pcpartpicker.com/list/3DhQkX

 

Spoiler

 

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

REINSTALL IT NOW.

 

Like full wipe a reset via the windows settings DOES NOT DELETE ALL FILES. That ransomware can easily still be on the system right now and go into action again. So get a usb stick, put windows 10 on it via the windows media creation tool, select custom install, delete and format all partitions and reinstall all that is needed.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

1.Never pay ransom

2.Always backup your data

3.Keep the backup offline,don't connect it to your PC when you don't have to

4.Properly wipe the drive and start a new.

A PC Enthusiast since 2011
AMD Ryzen 7 5700X@4.65GHz | GIGABYTE GTX 1660 GAMING OC @ Core 2085MHz Memory 5000MHz
Cinebench R23: 15669cb | Unigine Superposition 1080p Extreme: 3566
Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, jaslion said:

REINSTALL IT NOW.

 

Like full wipe a reset via the windows settings DOES NOT DELETE ALL FILES. That ransomware can easily still be on the system right now and go into action again. So get a usb stick, put windows 10 on it via the windows media creation tool, select custom install, delete and format all partitions and reinstall all that is needed.

The USB stick could be infected as well.

A PC Enthusiast since 2011
AMD Ryzen 7 5700X@4.65GHz | GIGABYTE GTX 1660 GAMING OC @ Core 2085MHz Memory 5000MHz
Cinebench R23: 15669cb | Unigine Superposition 1080p Extreme: 3566
Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, Vishera said:

The USB stick could be infected as well.

Hence why you should ALWAYS have a spare Windows USB install laying around somewhere

I mostly speak from my own past experience from similar problems. My solution may not work for you, but I'll always try my best to help as much as I can. If you want me to see your reply, make sure to quote my comment or mention me @WaggishOhio383, and I'll get back to you as soon as possible.

 

-- My PC Build --

Ryzen 7 2700x

AsRock B450 Steel Legend

XFX RX 590 Fatboy

Crucial Ballistix Tactical Tracer RGB 16GB 3200MHz
120GB Crucial BX500 SSD + 2TB Seagate Barracuda HDD

Corsair CX650M

Phanteks Eclipse P350x

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
1 minute ago, Vishera said:

The USB stick could be infected as well.

How? I'm just telling them to get a usb stick and put windows on it? Format the drive after and put malwarebytes on the system to check again.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
3 minutes ago, jaslion said:

How? I'm just telling them to get a usb stick and put windows on it? Format the drive after and put malwarebytes on the system to check again.

If the USB drive was ever connected to that PC,even after the reset,there is still a chance that it's infected.

A PC Enthusiast since 2011
AMD Ryzen 7 5700X@4.65GHz | GIGABYTE GTX 1660 GAMING OC @ Core 2085MHz Memory 5000MHz
Cinebench R23: 15669cb | Unigine Superposition 1080p Extreme: 3566
Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, Vishera said:

If the USB drive was ever connected to that PC,even after the reset,there is still a chance that it's infected.

That is true. Hence th malwarebyte scan and format. I mean there is only so much you can do up to a point. Best thing to do really is connect the hdd to a linux install and wipe them both that way. Then there is not trace left and then start reinstalling windows.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
Just now, jaslion said:

That is true. Hence th malwarebyte scan and format. I mean there is only so much you can do up to a point. Best thing to do really is connect the hdd to a linux install and wipe them both that way. Then there is not trace left and then start reinstalling windows.

The safest way is to use a live CD that loads it self into a RAM Disk,then you remove the clean drive with the live CD,

And only then start cleaning things up.

Hiren's BootCD PE is an excellent one to use,it even has tools to wipe the drive and several anti-viruses.

A PC Enthusiast since 2011
AMD Ryzen 7 5700X@4.65GHz | GIGABYTE GTX 1660 GAMING OC @ Core 2085MHz Memory 5000MHz
Cinebench R23: 15669cb | Unigine Superposition 1080p Extreme: 3566
Link to comment
Share on other sites
Link to post
Share on other sites
Posted
12 minutes ago, WaggishOhio383 said:

Hence why you should ALWAYS have a spare Windows USB install laying around somewhere

For me: External USB to SATA adapter and a 5.25" DVD-Drive, can't infect what you can't write to.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted
9 minutes ago, Vishera said:

The safest way is to use a live CD that loads it self into a RAM Disk,then you remove the clean drive with the live CD,

And only then start cleaning things up.

Hiren's BootCD PE is an excellent one to use,it even has tools to wipe the drive and several anti-viruses.

That is indeed the smartest.

Link to comment
Share on other sites
Link to post
Share on other sites
Posted

-> Moved to Programs, Apps and Websites

^^^^ That's my post ^^^^
<-- This is me --- That's your scrollbar -->
vvvv Who's there? vvvv

Link to comment
Share on other sites
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing Programs, Apps and Websites

×