1

I’ve been hit by Ransomware several times this year, and I’m going nuts trying to stop it. About a month ago I got hit, and I did a complete rebuild of my Windows 10 machine. Fresh OS and installed minimal programs. No warez or anything like that. I also installed iDrive for some cloud backups.

A couple of days ago I did a Remote Desktop session and for some reason I looked at settings and noticed I didn’t have any virus/ransomware protection. At this point all of my data looked fine. I tried turning on the virus settings and then after a reboot, bam my files got taken hostage.

Since I had backups, I didn’t even bother to try to “fix” things, I just did a fresh install. A short while ago I remoted into the machine and noticed some messages in the system tray. Along the lines of

  • UAC was turned off pending a reboot
  • Virus protection off
  • Firewall changes made

I’m going to reboot in safe mode (when I get home), but it’s obvious I’ve been hit again.

How can I protect myself after a fresh Windows 10 install? Is there a step by step guide I can follow? Is there a way to verify the programs I’m installing are “safe”?

Improve this question
3
  • Are you wiping the drive before you restore (opposed to deleting or formatting)?
    – kenlukas
    Commented Dec 9, 2021 at 19:55
  • 1
    Is it possible that someone with physical access to your machine is installing the ransomware? Since it sort of looks like you usually get infected while you are away from your machine, that might be a real possibility. Another thing: do you use a normal user account or an administrator account for regular everyday use?
    – nobody
    Commented Dec 9, 2021 at 22:29
  • Did the answer CBHacking gave help you? Then tick-mark it as answer so others know ... or if not, would be also great to hear from you if you're still facing issues.
    – Matt
    Commented Dec 10, 2021 at 8:56

1 Answer 1

Reset to default
1

Some obvious candidates:

  1. Another person with physical access.
  2. Another person using remote desktop or other remote access protocol, who has your password.
  3. A Trojan in one of your installers (rare, but not unheard-of, in software from legit sources).
  4. An unpatched vulnerability in the operating system or something you're installing on it.

For #1 and #2, you might need to change your login password to something more secure, limit physical (e.g. by locking the door) and/or remote (e.g. by turning off RDP or only allowing it from certain IPs) access to the machine, and/or remove a problem person from wherever they are.

For #3, try installing fewer programs, and especially try only installing extremely common ones (e.g. Firefox is fine, your favorite software for editing PDFs maybe isn't), to see if the problem occurs again. Trickle out the things you install. You should also re-download the installers (if you haven't been doing so each time) rather than using pre-downloaded files. Finally, make sure your AV is fully updated and running before doing each installation; there's no guarantee it would catch anything but it's worth a try.

For #4, you can try downloading the latest Windows install media directly from Microsoft rather than using an old installer. The new installer will have tons of patches built in. You might also want to make sure that the first thing you do is run Windows Update and make sure you get all the security updates before doing anything else.

You can also potentially mitigate #2 and #4 using a firewall (either at the router or the Windows firewall) or NAT (at the router). If the attacker is on the Internet (or even the local LAN) but can't connect to the vulnerable app/service on your machine, then they can't run their exploit. At a minimum, this may give you time to install updates that close any vulnerabilities.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .