A ransomware locked my operative system on C. Are the other drives at risk?

Question

I think I have a ransomware avoiding me to access Windows, for each time I restart my PC Windows boots but no login window appears and I cannot perform any operation but selecting the power and the accessibility options, and even the network card seems to be disabled. This occurred for the first time after having enabled the safe mode and possibly detected a malware (I described the problem here).

The Windows OS which is no longer accessible is installed on C:\, whereas all data and most desktop applications are stored on D:\ (second internal drive), as well as Kali Linux, on dual boot; grub is installed on D:\ too.

I can still access them though: while booting from D:\ and using Kali Linux, I can still open the D:\ folder and do operations on data and media, and while booting live distros and rescue systems from USB stick I can access all the folders as well.

I didn't open the C:\ folder and I'm using the Unix-like environment (Kali Linux booted from D:). I wonder if it's sufficient to prevent my D:\ drive from being affected from the possible ransomware or if I should be more cautious and uninstall the D:\ drive from that PC as long as the threat is there.

My question:

Given that a ransomware affected Windows on the C:\ drive, might it affect data stored on the other drives as long as I use a different operative system or should I phisically separate them?

Answer 1

As explained in the comments, your problem doesn't sound like ransomware at all.

But if it were ransomware, you can not know if the files on other drives are save. There are countless of different flavors of ransomware out there which all have different strategies to find files worth encrypting. Some might search all available drives for files, some might only concentrate on known locations like C:\Users\. But you generally have to assume that any storage volume where the system has write permissions is a potential target.

Seeing that the files are still in the directories doesn't necessarily mean that they aren't encrypted. It is possible that the ransomware scrambles files without renaming them. You say you can "do operations" on them, but not what kind of "operations" you are talking about. Unless one of these "operations" is to open them with a viewer application and look at their content, you can't be sure the file is unharmed.

Answer 2

It's certainly possible that the ransomware had a self-replicating virus-like propagation action, and it could have dropped Trojan horses on any drives that were mounted when the ransomware attacked. I would consider quarantining all drives the infected machine had access to, at least until you know that the problem has been contained. This would include network shares.

To be safest in your recovery efforts, create a virtual machine that doesn't have network access, and perform your recovery efforts on copies of the affected disks. Some ransomware I've seen in the wild is written in .Net, and could theoretically attack files on a Linux box if it is run under Mono.

Answer 3

Firstly, Is your system asking for a ransom?

Ransomware is a "business crime" which is to say that the purpose of it is to make money.

To do that effectively they (the criminals) need to do 3 things.

First. They need hold something of yours of value to you hostage.

Second. They need to ask for money.

Third. They need to tell you how to get them the money you are asking for.

From what you describe it doesnt seem to meet any criteria of ransomeware.

It does sound like your windows install may be corrupt or you may have a more run of the mill virus.

Ransomeware acts by scanning your ENTIRE system for target files and then encrypts those files targeting things that they 'ransom criminals' think you would likely deem worth while to pay to get back. The early versions would scan and encrypt files on every drive letter. Newer versions scan local networks for UNC shares with write permissions.

The file deemed worth ransoming are usually document files, excel files, image files, etc. A while back I ran across a Ransomware that cleverly used some sort of 'opens with MS Word' system extension to target anything windows would open with microsoft word. The owners of that system changed the file association for DOC files to another program but DOCX file were still associated with MSWORD and got encrypted.

Encrypting possibly hundreds or thousands of potentially large files requires significant system resources and ransomwares typically try not to damage system files as that could effect system resources or how quickly it can encrypt or decrypt those files in the first place.

Once the handful of news accounts of ransomware not giving back files after ransoms are paid then people stop paying the ransoms and the criminals stop making money.

Every circumstance has variations but your situation doesnt sound like ransomware.

Answer 4

I would say that if you do not turn your Windows OS on, the risk to other drives and partitions is minimal. However, I concur with the idea that this does not seem like ransomware, as it is missing several key traits such as actually asking you for money/valuable items. If I was going to extract the data from the drive, I would actually remove the physical drive, insert it into another PC, and open it up in a virtual machine to be copied to a backup or flash drive.