New answers tagged

1

Ransomware is spreading just because people is paying it, questions and answers help getting Ransomware a reputation that is likely to make people paying. It is much better investing some money in a good anti-virus than having to pay later to recover your data. If interrupting the process in the middle may be harmful (because developers wanted you not try ...


6

Shut the computer down immediately. Provided you're not about to pay the ransom, any data that the virus is processing is lost anyway. So just push down the power button and hold it, or unplug the wire. Install Ubuntu or another portable Linux distribution onto your USB stick. Last time I did this it did fit on 2GB stick. I was cloning my HDD to SSD with ...


53

What I would do: Suspend the proces. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (and if you're paranoid, Bluetooth too). Check open files by those processes to see which one it is currently encrypting. If it's a particularly important one, ...


130

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have the appropriate hardware for that readily available. Dumping just the right process should also work, but finding out which one may not be trivial (eg. the ...


9

[Mod Note: This answer is receiving a lot of flags, but is not worthy of deletion. This is a potentially valid course of action, though risky and potentially illegal in some jurisdictions. From a technical standpoint, this has a chance of being a way to preserve the data. Please see Meta for further discussion.] The best thing to do is nothing. Doing ...


7

In addition to the shutdown & copy approach others have mentioned there's another factor: The ransomware wants to hide what's going on until it's finished it's evil--thus the encrypted files are usually still readable as if they weren't encrypted until it's ready to demand it's ransom. Once you have located the files that matter and are encrypted put ...


51

Ransom-ware (or any encryption software for that matter) will not encrypt the file in-place, because the encrypted filesize will not match the unencrypted filesize bit-for-bit (unless it's just an xor shuffle, in which case it's not really encryption). More importantly, a spontaneous abortion of the encryption process (due to a shutdown, running out of ...


-2

In my opinion for the newer SSD is it better to do a full-zeroing on it with "zero" instead of "random" if you want to destroy al the data! BUT every single write to an SSD damages it slightly. Writing to every single erase block causes them all to be marked in use, which will prevent the drive's GC from functioning properly and performance will suffer. ...


0

Please don't mess up the software-targeted attacks and hardware-targeted attacks. Coldboot is a second one : no software is able to protect itself against it, because it's based on a hardware behaviour. The only thing you can do with relocating in-memory-stored privae data constantly and wiping out a memory used for a previous storage, but it will not save ...


6

Could malware interfere with the wiping process? If there is malware present on the system, then yes, it will be able to interfere with the memory wiping process. If a malicious process spawns many copies of itself in memory, it can prevent the processes which initiate memory wiping from executing, essentially causing the computer to hang. This is an ...


-2

I'm not an expert on this but in think it could be bypassed by force powering off the system while Tails is active or when it is still wiping memory.(This can take time, esp. if the system has lots of RAM)


1

No one has ever actually demonstrated successful recovery of overwritten data on a modern hard drive. It's an urban legend stemming from the days of hard drives with capacities orders of magnitude lower, which had enough inefficiency in their data storage that it was potentially an issue. See this Wikipedia article and its references.


7

Short answer: That won't work. You'll need to degauss it, which will render the drive unusable. Long answer: Sure. Get a powerful magnet, put it next to the hard drive, with N facing the drive. Then flip it around so S faces the drive. Then flip it again, then again. Do this a few thousand times a second. If you do it any slower or just put it near the ...


3

Not without opening the hard drive. This magnet reseller tried several magnets on a running hard drive, without any bad results. It would also probably not securely delete your data when holding magnets directly to the platter, altough it may flip some bits.



Top 50 recent answers are included