Hello all,
I'm fairly new to Webroot. I had a couple of questions on what is needed to recover a system that is hit by Ransomware. Sorry, I've searched until i'm sick of looking for answers. I decided to try posting my questions instead. If there is a guide for this already, can someone please point me in the right direction?
Say I get hit with Ransomware and my entire system is encrypted and no longer usable.
1. What steps do I need to do at that point?
2. Do I need to log into my.webrootanywhere.com/ from another PC and try to recover my system?
2. What information do I need to provide to Webroot support for them to try to remotely restore the system?
Basically I want to create an "emergency recovery kit" with details on recovery steps, Webroot contact information, my account info., etc. I want to keep this information external to my computer so that if it goes down, I have all the information needed to start the attempted recovery of my down system.
Thanks!
Solved
Details on how to recover from a Ransomware attack
Best answer by JP_
Greetings, @ . Happy to have you on our Community :robotvery-happy:
The best recommendation for not recovering from a Ransomware attack but preventing one rather is always Backups, Backups, and maybe just a few more Backups.
(Keeping them disconnected and offline is crucial)
The steps in this Article are probably going to about the best if you do happen to find yourself in that situation. If you have a Backup, then you have nothing to worry about.
Our Support Team should always be involved for all issues related to Threats. They'll get all the information they need be remoting onto your System.
For more information about Ransomware, visit our Webroot Threat Blog.
View originalThe best recommendation for not recovering from a Ransomware attack but preventing one rather is always Backups, Backups, and maybe just a few more Backups.
(Keeping them disconnected and offline is crucial)
The steps in this Article are probably going to about the best if you do happen to find yourself in that situation. If you have a Backup, then you have nothing to worry about.
Our Support Team should always be involved for all issues related to Threats. They'll get all the information they need be remoting onto your System.
For more information about Ransomware, visit our Webroot Threat Blog.
Show first post
@ wrote:
I expect you probably know this already but just in case ... are you aware of point #4 in the following article: http://www.digitalcitizen.life/4-ways-boot-safe-mode-windows-10 ?Thanks Muddy. But at the end of option #4 it says this;
"If you have modern PC with a UEFI BIOS and a fast SSD drive, there's no way you can interrupt the boot procedure with your keypresses. On older PCs, with a classic BIOS and no SSD drive, pressing these keys might still work though."
My laptop (which runs Windows 10) is UEFI and also has a SSD. That's the computer I was trying to access 'Safe Mode' on. I was finally able to get there in a less-than-optimal way, though. Apparently Windows 10 will boot into "Automatic Repair" mode (which leads to Advanced Mode and Safe mode restart options) after two unsuccessful boots. So this requires doing a 'Hard' reset twice. Seems a little extreme, but so far this is the ONLY way I have found to access 'Safe Mode' from a powered-off state in Windows 10. :@
Cheers,
BD
Hi Muddy7
No worries...the more the merrier...just let me know when.
Regards, Baldrick
No worries...the more the merrier...just let me know when.
Regards, Baldrick
Webroot SecureAnywhere Complete Beta Tester v9.0.24.49, imaged by Macrium Reflect v7.2
Yes, that was the point I was trying to make. That is why I added in my "Edit" paragraph that I was surprised that although I can't successfully execute Safe Mode with the F8 function key from my Windows 10 UEFI+SSD device (as expected), I CAN execute the Select Boot Device and the Go to UEFI function keys (unexpected)! Sorry! It seems my post was not very clear :(@ wrote:
Thanks Muddy. But at the end of option #4 it says this;
"If you have modern PC with a UEFI BIOS and a fast SSD drive, there's no way you can interrupt the boot procedure with your keypresses. On older PCs, with a classic BIOS and no SSD drive, pressing these keys might still work though."
My laptop (which runs Windows 10) is UEFI and also has a SSD. That's the computer I was trying to access 'Safe Mode' on.
Incidentally, on the subject of Ransomware attacks, I found, while browsing Google News, this article with an interesting slant on Microsoft's portion of blame for Wannacry and other malicious hacks: http://newsclick.in/wannacry-nation-states-and-what-president-microsoft-forgot-mention.
- One surprising fact it cites (surprising for me though perhaps not for others better informed on this subject): "...calls for banning cyber weapons...have been issued by Russia and China for quite some time. It is the US which has hitherto refused to move in this direction."
- One disturbing fact (again, for me!): "In India, it is estimated that even now, 70% of ATM's are running on old, unsupported XP"
- And the cental point of the article: the writer's (arguable) contention regarding Microsoft's discontinuing its support for old products: "Why should companies, whose products are still very much in the market with significant shares, be allowed to walk away from their products? Should its monopoly over a certain product allow it to force its users to pay again and again for new software licenses, which quite often add very little to the users? Or in the worst case, as in the Microsoft Vista case, even degrades their performance? The time has come to insist that if a company “abandons” its products, it must open source its software and allow others to provide the support."
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.