Posted on Oct 29, 2015
SGT Writer
3.03K
24
17
4
4
0
Posted in these groups: Cpu 1 Cybersecurity
Avatar feed
See Results
Responses: 7
Cpl Tou Lee Yang
1
1
0
You use a standard account. My brother-in-law received a similar message, except the ransomware stated that the FBI has lock his computer down and he needed to make a payment of $80 or so dollars to have it unlock. I turned his computer off ran the Malwarebytes and remove the program. I told him to create himself a standard account so that he won't have programs taking control of his computer.
(1)
Comment
(0)
SGT Writer
SGT (Join to see)
9 y
So this is something that normally happens to users who do everything on a single account, which is Admin default ? Why wasn't that in the article ?
(0)
Reply
(0)
SSG Sr Security Analyst
SSG (Join to see)
9 y
Well users usually create their first account which will be an admin account and there there is the account called "admin" which is created by default. You can go into the registry and disable the account and I would also disable the guest account as well.
(0)
Reply
(0)
Avatar small
Cpl Software Engineer
1
1
0
I've been a victim of it. First thing is not to panic. The malware gave a "deleting" files dialog followed by a "pay me" to recover the files dialog. It didn't really delete the files, it hid them. I had to boot into safe mode, remove the malware entries in the registry and unhide the files . I was back up and running in less than an hour.
(1)
Comment
(0)
SGT Writer
SGT (Join to see)
9 y
Thanks for sharing. MalwareBytes is awesome. Did it move the files to the $RecyclingBin folder in the C:\ Folder?
(0)
Reply
(0)
Cpl Software Engineer
Cpl (Join to see)
9 y
Nah, it hid them in place.
(0)
Reply
(0)
Avatar small
SSG Sr Security Analyst
0
0
0
Most of the time, it can be trivial to reverse the malware. But there are times when the con has done it proper and has fully encrypted your filing system and recovering it is nigh impossible. At this point I would hope a proper backup has been done. If you're caught with all your sensitive and valuable data encrypted by a hacker, you messed up.
Personally I would never pay the fee. I would try everything in my power to reverse the malware or just roll back to a known good. If you can't do either one of those, then wiping is your best bet. It can be very difficult (depending on the sophistication of your attacker) to tell if they installed a kernal level root kit or something. Best to just wipe and not chance it.
(0)
Comment
(0)
SGT Writer
SGT (Join to see)
9 y
I've still got a lot to learn about root kits. Do you have any good resources to recommend for learning more about it?
(0)
Reply
(0)
SSG Sr Security Analyst
SSG (Join to see)
9 y
I don't know of any resources off the top of my head that are just for root kits. Usually any source from a .edu domain is a good start. You can peruse the SANS white paper collections. There's bound to be a great paper on root kits in there. More than one I'd wager.
(0)
Reply
(0)
Avatar small

Join nearly 2 million former and current members of the US military, just like you.

close