Pretty much what the title suggests.

I understand its quite vague so apologies.

I'm just not sure if it's able to install something that will sit elsewhere on the machine (as in not on the C:) which could then restart the encryption.

Asking as one of the techs is about to re-image a machine and believes this will kill the problem (pxe boot wim)


  • since you might have gotten infected by executing code that is not on the partition you plan to re-image... – Marcus Müller Jun 8 '18 at 15:16
  • Ransomware isn't really about stopping you from using the computer, its about locking away data you care about. So yes, re-imaging will work, but it won't recover the data that has been locked (unless that data is on the image) – Nathan Merrill Jun 8 '18 at 21:10
  • Thanks aware it wouldn't recover the data, was just worried that as the offending script wasn't on the machine's C:\ would all be a waste of time :/ – David Golding Jun 11 '18 at 14:51
  • If you're going to re-format and you have more than one drive, I'd reformat all of those drives. If only C, then answer below is fair: wiping will remove ransomware. – bashCypher Jan 11 '19 at 22:57

In short: yes, this would suffice under common circumstances. Of course you cannot get your data back, but it would prevent the program from launching again.

Reimaging usually replaces all programs on the C: drive and resets Windows and its settings completely. The list of programs to be executed upon startup is in system files, so reimaging will prevent the malware from launching unless you click it again.

If user data is kept, if there is another drive, or if the malware came from something like an email attachment, reimaging will not replace those files. If you accidentally click it again, or if the malware has embedded itself into other files that are not replaced by reimaging, then you will be reinfected.

In a very obscure case, it might also have embedded itself into places like the BIOS or other firmware, but I have not heard of mainstream malware doing that so that would be very unlikely. (If this were the case, you would probably have to throw the hardware away; but again, I have not heard of this happening yet.)

If your disk image is simply a backup, then be careful that your disk image does not contain the ransomware. Backup your backup before you operate on it!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.