Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ransomware]

A type of malicious software designed to block access to a computer system until a sum of money is paid.

2
votes
1answer
1k views

How to recover files encrypted by norvas ramsomware

I just caught a ransomware that encrypted many of my files and I need to get them back. Now they all end in .NORVAS and I can't find a way to decrypt them back. I tried with data recovery pro, shadow ...
0
votes
0answers
19 views

Files encrypted with af21 file extension

I have a set of files which got encrypted during the recent ransomware attack. All of the files have a common extension .af21 . I am able to play the video files using VLC, although they have the same ...
0
votes
0answers
51 views

How do I recover my data from a ransomware .rumba?

My laptop got infected with a ransomware. It add extension .rumba to my files. How do recover my data? I've tried all the method in the google first page of "How to remove .rumba" to no avail. I ...
0
votes
0answers
39 views

Windows 10 Controlled folder access, when turned on does it prevent games from saving in documents?

Its a feature of windows 10 defender, but it doesn't explain itself well. When turned on, it takes you to a page where there is a list of folders its protecting like Documents and Pictures. They cant ...
1
vote
0answers
139 views

Allow rundll32.exe in Windows 10 ransomware protection settings?

When trying to import photos from my phone, Windows' ransomware protection (controlled folder access) blocked rundll32.exe from writing to my Pictures photo. Would it be OK to put rundll32.exe on ...
0
votes
1answer
146 views

Requesting Advice On Preventing Ransomware (also very odd text in my win.ini cfg)

I had just recently prevented a ransomware attack and am still looking for malware as I am curious. I had looked in my win.ini file this morning and found some odd text that even Google Translate ...
1
vote
1answer
95 views

Laptop PC stuck at startup, formatted, now data unrecoverable, looks encrypted

Someone asked me to recover data from a laptop computer (Sony Vaio), after a format and Windows reinstall (Windows 8). Prior to that, the computer was malfunctioning : it was stuck on startup, at the ...
0
votes
1answer
312 views

Is it possible to remove BitLocker functionality from Windows?

Is there any way to remove BitLocker functionality from Windows? BitLocker has recently been used by ransomware to lock a friend's drive. He is now supposed to pay bitcoin to some hackers to get the ...
-1
votes
1answer
658 views

Randomly Named Files appearing in Hidden folders (virus?)

I have random hidden folders containing files with randomly generated file names I haven't created appearing in my Documents Folder (which is synced to OneDrive). e.g. OneDrive\Documents\2016-11-08 ...
2
votes
0answers
98 views

Duplicate files with weird extensions – ransomware?

I'm a little afraid to get bashed since this is super non-specific but this is exactly my problem. I'm finding weird file duplicates on my computer – with the same name as the original file but an ...
1
vote
0answers
112 views

Where can I find samples of Microsoft Office Word docs with malicious Macro? [closed]

I need to dynamically analyze macro ransomware sample on VM for my project. But I am unable to find them on Internet. So, can anybody suggest some links from where I can get a sample of "word document ...
1
vote
1answer
95 views

How to protect data on connected pendrive from Ransomware?

This question is specific to some measures that I have already taken with a pen drive as described below. I have a pendrive that’s always connected to my Windows PC. I run a script at logon that takes ...
0
votes
1answer
93 views

How to browse the net safely with Windows computers?

I have Windows 7 and Window 10 laptops. I'm thinking of a bullet-proof way to protect the computers from network threats such as the ransomware attacks that have been running wild during the last few ...
-1
votes
1answer
135 views

Windows 7: Can we keep internal HDD from being accessed by ransomwares with “disable” or “unmount”?

I'm trying to find an alternative way to protect my daily backup-disk from malware, while the HDD is still connecting to a SATA port on the motherboard. (This is temporally. I can't afford a portable ...
0
votes
2answers
1k views

How to decrypt files after BTCWare Gryphon?

My PC got affected by BTCWare Gryphon. I have tried different software such as Data Recovery Pro, 360 Document Protector, Kaspersky, and so on, but they couldn't help me. ID Ransomware claims that ...
0
votes
1answer
174 views

Decrypt files after Petya ransomware attack in 2017 [duplicate]

Does anybody know if the recent flavour of Petya ransomware (active in June 2017) is somewhat different from one that appeared back in 2016? I am only interested in the decrypting approach. This was ...
0
votes
1answer
101 views

Why is windows 10 encrypting so many files?

My current status: Paranoid. Monday night I had a friend over and we were making travel plans on my computer. A message appeared at some point asking about backing up encrypted files. I stupidly ...
1
vote
0answers
65 views

How do the ransomware viruses perform their encryption?

I know the classic setup ... open a file, click a link -- bam: malicious code execution. Oh noes! But how does that lead to "all my files are suddenly encrypted"? The operative word here is "...
0
votes
0answers
2k views

Disable wmic - Windows Management Instrumentation

Regarding Petya ransomware, I read that is advisable to disable vmic, afaik aka "Windows Management Instrumentation" in services.msc. But if I am stopping this, this will also stop "Security Center",...
0
votes
1answer
117 views

Is encrypted but online USB PenDrive safe from ransomware attack?

Using TrueCrypt I have encrypted the entire backup pen drive but it's always connected to my Windows 7 PC. As a result when normally dismounted it does not have a recognized file system. Only a drive ...
-3
votes
1answer
161 views

Have I been attacked by the WannaCry ransomware? [duplicate]

I am (deliberately) still running XP on my main home PC. Since the attack of the WannaCry ransomware, I have been unable to reach Windows Update (or any other Microsoft website) with Internet ...
2
votes
1answer
199 views

Access Windows 10 Safe Mode from startup

I have an Asus machine running up-to-date Windows 10. With all the Ransomware panic going around ittakes me back to when I was victim of a type-3 Ransomware attack (lockout). The way I managed to ...
-3
votes
1answer
3k views

How to protect my Window from Wanna Cry (Wanna Crypt) ransomware attack and how to remove Wanna Cry? [duplicate]

When i wrote this question in SuperUser there was not any information and solution about Wanna Cry attack in SuperUser. So this is not a duplicate question and has special information and useful ...
-2
votes
2answers
2k views

Should I do online transaction [WannaCry Ramsomeware]

Can I do online transaction safely without getting affected by WannaCry Ramsomeware? If I do, then how would I be affected? The site I'm trying is Amazon.
0
votes
0answers
142 views

Will you see ransomware activity like WannaCry in Resource Monitor? [duplicate]

I understand that in order to encrypt terabytes of data, a ransomware must work hard for hours on HDD and perhaps for under an hour on SSD. So it has to leave obvious signs of doing so.. right? ...
4
votes
0answers
1k views

Is this a ransomware?

I just got this window on my main computer: Apparently, it's from Windows. I checked, and the process EXE file is the original one (efsui.exe or something like that). However, I don't use EFS (I ...
1
vote
1answer
139 views

How does ransomware work? [closed]

If it's possible to get a full rundown on how ransomware usually works in encrypting files, that would be nice. I know ransomware encrypts all files with AES-256 for speed, but where does RSA come in?...
1
vote
0answers
52 views

Ransomware attack [duplicate]

My desktop has been hijacked by ransomware. They won't let me reach the login screen. Even tried safe mode, but I can't get past the virus. I have a bootable linux mint USB, can I boot it on the PC ...
5
votes
2answers
713 views

How to remove BUYUNLOCKCODE Ransomware [duplicate]

A ransomware appears to have been circulating for the past few weeks. It encrypts data files and creates a BUYUNLOCKCODE.txt ransom note in all directories where a file was encrypted. This ...