Announcement

Collapse
No announcement yet.

Ransomware ARGH

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Filter
  • Time
  • Show
Clear All
new posts
Previous template Next
  • #1

    Ransomware ARGH

    (crosspost from a non-techsupport thread)

    CW called me and said that he wanted me to take a look at his laptop -- he fell for one of those "MS Tech support" calls and now, he's got some form of ransomware on there that won't let him in without a password; they, of course, want moolah to "correct" this. My original plan was to nuke n' pave, then reinstall windows, as he said there's nothing too important on there, and he said the windows sticker on the bottom was there.

    Said CW neglected to inform me that the little MS sticker with the install code is so worn that the first two groups of characters are illegible x.x It seems that I should have asked him if the blessed thing was INTACT.

    If I try to access Safe Mode, anything diagnostics-related, or go back to "last good config," the laptop just reboots. I'm downloading several bootable rootkit killer ISO's from another comp now. Wish me luck. I should have a UBCD I can boot from and disable the password itself with at home if I can't get it working here >_>

    Any ideas beyond that?
    "For a musician, the SNES sound engine is like using Crayola Crayons. Nobuo Uematsu used Crayola Crayons to paint the Sistine Chapel." - Jeremy Jahns (re: "Dancing Mad")
    "The difference between an amateur and a master is that the master has failed way more times." - JoCat
    "Thinking is difficult, therefore let the herd pronounce judgment!" ~ Carl Jung
    "There's burning bridges, and then there's the lake just to fill it with gasoline." - Wiccy, reddit
    "Retail is a cruel master, and could very well be the most educational time of many people's lives, in its own twisted way." - me
    "Love keeps her in the air when she oughta fall down...tell you she's hurtin' 'fore she keens...makes her a home." - Capt. Malcolm Reynolds, "Serenity" (2005)
    Acts of Gord – Read it, Learn it, Love it!
    "Our psychic powers only work if the customer has a mind to read." - me
    Tags: None
  • #2
    I've got a couple of those here, actually. (Windows product key stickers with the numbers almost worn off.) I got lucky on one of them, by writing down what I thought it said, and then typing that in. It proved to be correct, so I then created a Big Ass Label[tm] and stuck it to the side of the box. Not sure what I'll do about the other one, because the sticker on that one's much worse.

    There are some utilities available on Teh Interwebs that (in theory) will pull the install code out of the registry. You might try searching on "recover Windows product key".
    "I often look at every second idiot and think, 'He needs more power.'" --Varric Tethras, Dragon Age II

    Comment

    • #3
      Need to get into Windows itself first

      UBCD will work for that, if all else fails, though it won't actually do anything about the malware.
      "For a musician, the SNES sound engine is like using Crayola Crayons. Nobuo Uematsu used Crayola Crayons to paint the Sistine Chapel." - Jeremy Jahns (re: "Dancing Mad")
      "The difference between an amateur and a master is that the master has failed way more times." - JoCat
      "Thinking is difficult, therefore let the herd pronounce judgment!" ~ Carl Jung
      "There's burning bridges, and then there's the lake just to fill it with gasoline." - Wiccy, reddit
      "Retail is a cruel master, and could very well be the most educational time of many people's lives, in its own twisted way." - me
      "Love keeps her in the air when she oughta fall down...tell you she's hurtin' 'fore she keens...makes her a home." - Capt. Malcolm Reynolds, "Serenity" (2005)
      Acts of Gord – Read it, Learn it, Love it!
      "Our psychic powers only work if the customer has a mind to read." - me

      Comment

      • #4
        Quoth EricKei View Post
        Need to get into Windows itself first
        You might be able to pull out the hard drive, put it in an external enclosure, and use something like Magic Jellybean to extract the key.
        Sometimes life is altered.
        Break from the ropes your hands are tied.
        Uneasy with confrontation.
        Won't turn out right. Can't turn out right

        Comment

        • #5
          I was able to use a windows ISO to nuke n pave, then ran mwb, sb, and a couple of others, but that still doesn't get me his license key. Tried taking the HDD out, but one of the case screws (laptop) was badly stripped. Gonna keep trying on that one. It does have an intact service code, it's possible we can use that to get a legit install code from Dell (Windows 7, it'll work just fine for 30 days with no code). Using the recovery partition to do this might have had a preset code, but I can't access it from the F8 screen/Repair screen even though it's there -- the Repair doohickey (F11/CTRL-F11 at POST) shortcut isn't working, either. He DOES have a funtional computer again, though, at least for now.

          Does Jellybean require an external drive, or can it scan the current one? The old registry file is probably toast since I did a new install.
          "For a musician, the SNES sound engine is like using Crayola Crayons. Nobuo Uematsu used Crayola Crayons to paint the Sistine Chapel." - Jeremy Jahns (re: "Dancing Mad")
          "The difference between an amateur and a master is that the master has failed way more times." - JoCat
          "Thinking is difficult, therefore let the herd pronounce judgment!" ~ Carl Jung
          "There's burning bridges, and then there's the lake just to fill it with gasoline." - Wiccy, reddit
          "Retail is a cruel master, and could very well be the most educational time of many people's lives, in its own twisted way." - me
          "Love keeps her in the air when she oughta fall down...tell you she's hurtin' 'fore she keens...makes her a home." - Capt. Malcolm Reynolds, "Serenity" (2005)
          Acts of Gord – Read it, Learn it, Love it!
          "Our psychic powers only work if the customer has a mind to read." - me

          Comment

          • #6
            Have you considered just getting a new copy of Windows 7? It is $99 (64 bit) or $89 (32 bit) on Amazon.
            "I don't have to be petty. The Universe does that for me."

            Comment

            • #7
              Quoth EricKei View Post
              Does Jellybean require an external drive, or can it scan the current one? The old registry file is probably toast since I did a new install.
              It can scan the current drive, if you can get into Windows, and I'm pretty sure I've used it on an external drive. But yes, since you did a fresh install, it's probably gone now.
              Sometimes life is altered.
              Break from the ropes your hands are tied.
              Uneasy with confrontation.
              Won't turn out right. Can't turn out right

              Comment

              • #8
                IA - Not my comp ^_^;> Getting hold of a usable (and legal, thanks to MS) ISO of Win7 is not an issue. Getting the proper install code is. I doubt my CW wants to buy another copy of Win7 unless there is no other choice.
                "For a musician, the SNES sound engine is like using Crayola Crayons. Nobuo Uematsu used Crayola Crayons to paint the Sistine Chapel." - Jeremy Jahns (re: "Dancing Mad")
                "The difference between an amateur and a master is that the master has failed way more times." - JoCat
                "Thinking is difficult, therefore let the herd pronounce judgment!" ~ Carl Jung
                "There's burning bridges, and then there's the lake just to fill it with gasoline." - Wiccy, reddit
                "Retail is a cruel master, and could very well be the most educational time of many people's lives, in its own twisted way." - me
                "Love keeps her in the air when she oughta fall down...tell you she's hurtin' 'fore she keens...makes her a home." - Capt. Malcolm Reynolds, "Serenity" (2005)
                Acts of Gord – Read it, Learn it, Love it!
                "Our psychic powers only work if the customer has a mind to read." - me

                Comment

                • #9
                  Quoth EricKei View Post
                  Said CW neglected to inform me that the little MS sticker with the install code is so worn that the first two groups of characters are illegible x.x It seems that I should have asked him if the blessed thing was INTACT.

                  If I try to access Safe Mode, anything diagnostics-related, or go back to "last good config," the laptop just reboots. I'm downloading several bootable rootkit killer ISO's from another comp now. Wish me luck. I should have a UBCD I can boot from and disable the password itself with at home if I can't get it working here >_>
                  Well, there are several programs that, if you can run them, will save the Windows install key to a text file.

                  Google:
                  windows key finder

                  I mostly use Magical Jelly Bean key finder

                  I make a point of running it on systems, copying the key file elsewhere, and then adding the info to a "master" file of install keys so I don't get caught out that way.

                  Comment

                  • #10
                    On jellybean -- screws on the laptop itself were stripped, I couldn't get the HD out without damaging the case, so I let it be.

                    I lucked out -- I was able to get in contact with Dell. They were willing to ship my CW a fresh set of install discs/codes at no charge, even tho his comp is out of warranty. I may have to re-reinstall (if it's a different edition of 7), as the Dell discs will contain specific extra features such as proper access to the Dell-specific diagnostics and restore partition.

                    Thanks for the help though, guys. This stuff will likely come in handy in the future!
                    "For a musician, the SNES sound engine is like using Crayola Crayons. Nobuo Uematsu used Crayola Crayons to paint the Sistine Chapel." - Jeremy Jahns (re: "Dancing Mad")
                    "The difference between an amateur and a master is that the master has failed way more times." - JoCat
                    "Thinking is difficult, therefore let the herd pronounce judgment!" ~ Carl Jung
                    "There's burning bridges, and then there's the lake just to fill it with gasoline." - Wiccy, reddit
                    "Retail is a cruel master, and could very well be the most educational time of many people's lives, in its own twisted way." - me
                    "Love keeps her in the air when she oughta fall down...tell you she's hurtin' 'fore she keens...makes her a home." - Capt. Malcolm Reynolds, "Serenity" (2005)
                    Acts of Gord – Read it, Learn it, Love it!
                    "Our psychic powers only work if the customer has a mind to read." - me

                    Comment

                    Previous template Next
                    Working...