hey how you doing my name is steve regan with CSO online and yesterday i infected
this computer with ransomware today i'm going to try and fix it and
i'm going to show you how the first thing i'm going to do here is reboot
windows 10 in the safe mode but it's not as simple as rebooting your computer and
pressing f8 there's actually things you have to do so you can see my screen and
what i'm going to do is come down here to the Start button and I'm going to
press power but before I hit restart I'm going to hold the shift key now there
are times while those systems rebooting that you're not going to be able to see
my screen from the live feed so we've got a camera over my shoulder as you can
probably tell and we're going to record this so after I reboot the computer into
safe mode once I set the options you're no longer going to see the live feed so
I'm going to describe you what I'm doing what I'm seeing that way you'll still
have a basis of what's going on so hold down the shift button and I'm going to
click restart now that the computers back up you'll see that you have three
options to pick from the first thing I'm going to do is click troubleshoot now
once that screen comes up you're going to click Advanced Options and then
startup settings from this point on you're probably not going to see a live
stream but once you're in the startup settings you're going to see a list of
things that could do for you and a little button that says restart just
click restart this will put your computer into a selective boot mode and
what's going to happen is once it boots out of BIOS and comes right back into
the operating system you're going to be shown a list of things so this list
requires your function keys f1 f2 etc and the one you want to press for Safe
Mode is f4 so once that startup settings screen comes up press f4 on your
keyboard and it's going to boot your computer into safe mode safe mode is a
very basic loading of Windows only the bare minimums put up and the reason
we're booting in the safe mode is because I'm going to try to install some
antivirus scan my computer and see if I can't
remove locky that way now that's not going to decrypt my files I'm still
going to need backups for that but it makes no sense for me to load backups on
to my computer or load files on my computer if locky still there because
it's just going to encrypt them and I'm not going to be able to get those back
all right so we've rebooted in the safe mode if it looks weird to you don't
worry about it so once um safe mode is loaded you need to install some
anti-malware and what I've done is downloaded and installed malwarebytes
anti-malware and hitman pro both are free I've also updated both software
versions and now I'm going to run scans on the system with them now my hope is
that by doing so I'm able to find and remove locky
but there's no guarantee but we're going to try it anyway
the passive scan with malwarebytes detected locky and it went to remove it
it required a reboot the reboot took me back into my normal desktop so I went
through the whole process again booting back in a safe mode and now that all
that's done what I have in front of me is malwarebytes open again and I'm in
safe mode so I'm going to come over here to scan and I'm going to select the
custom scan and I'm going to configure that to scan all of drive C and all of
drive E and if you remember drive e is my at-at storage that got encrypted by
locking and the reason I'm doing that is to make sure that if there is anything
hanging about it's going to be found on the the left side of the screen here
from our bytes check the box that says rootkits and then hit scan this scan
will take some time so just relax and let it run and then once it's done we'll
move on alright so after about 46 minutes malwarebytes is done and hasn't
found anything and the next step is to install hitman pro update that and then
run it as a scan remember malwarebytes already found block E which is a good
thing so now we're going to let hit Pro run because let's just see if
there's anything else that needs to be gotten or anything else we need to take
care of alright so I ran hitman it took a few minutes for that to run it found
like some cookies and other stuff but nothing major
we've rebooted out of safe mode or back at our regular desktop we've got this
hideous looking a background here which if you right-click select personalize as
you can see in the screen I'm streaming to you right there you just pick all
that from right there but what I'm going to do now is restore my computer to a
previous state I'm going to right click go to system and it's going to bring
this up I'm going to click on system protection you see system restore and lo
and behold right here I have an automatic restore point from before this
computer was infected it's going to warn you once started you can't stop that's
fine I'm just going to say yes and it's going to prepare to restore the system
this will take some time so we're going to let this run and I will be right back
alright so we started the system restore and just like a cooking show how they
put it into the oven and suddenly the finished products waiting for you well
the finished product is waiting for you because yesterday while we were
infecting one laptop with ransomware we actually infected two laptops with a
with ransomware because why break one machine when you can break multiples as
you can see I have a pretty bleak background that's because when I did the
system restore I didn't have anything on this computer at all and if we look in
the My Documents everything's gone so I am going to right click on my Start
button I'm going to go to control panel and I'm going to select backup and
restore because what I'm going to do is restore my files from a backup that was
the external backup I had mentioned earlier so I'm going to select another
backup come here pick the top one because that's what I
want to browse for folders so when I made the backup it was on the
administrator account which means everything I needs in the Documents
folder there add that folder select next and I'm going to tell it to go to
Steve's document folder now we're not going to do a direct replacement hit
restore finish when you open documents here you obviously have to go to the
thing it's going to tell you down that permission I do
there you go all the files that were encrypted have been restored to give you
an idea of the pain rather than just reimage the machine like your IT
department would do we did this to manual way and it took about four and a
half hours and that it's not including the time I'm going to spend now to
download and install Microsoft Office again and things like that but the big
win here is that I was able to recover my files for the backup and I'm going to
get all that stuff back and I didn't have to pay two thousand dollars for
more information about ransomware and of course all the other updated news about
ransomware and things like that you can look that up on CSO online again my name
is Steve Reagan and this is recovering from ransomware see you soon