|
It boggles the mind that anyone would pay a ransom for an attack like this, especially a corporation.
I would assume that the machine is totally corrupted, format it back to the bare metal, and reload from a clean backup.
Software Zen: delete this;
|
|
|
|
|
Quote: and reload from a clean backup
Yes! But that assumes the victim was diligent in keeping up-to-date backups.
Get me coffee and no one gets hurt!
|
|
|
|
|
If they don't, to quote Larry Niven, "think of it as evolution in action."
Software Zen: delete this;
|
|
|
|
|
I will try to stay calm, but not promises... My blood is right now boiling of anger.
A relative has just been victim of the indian call centers. When he contacted me was already way too late.
The problem is... he had the NAS where the redundant data were plugged and active, even the USB hard drive I use to do the backups was connected (I know, I know... I have warned him several times). So... he has lost everything.
I have read about the buggers and they usually delete the data. The amount of data with the internet connection to India would have taken days, so my last hope is, that they erased the data with the "Windows delete" and "empty bin" and that it might be (at least partially) restored.
Any advices / tips / recomendations of software or maybe a company?
Or is it hopeless and there is nothing to do?
Please... I just look for constructive comments. It is done and I can only try to repair something. If you are just going to come with "USB offline" and similars... save your time and mine. I am not in the mood right now, I hope you understand.
[EDIT]:
Just in case, this can help someone in the future...
I could recover the data using FileScavenger. Tiny, intuitive and effective.
M.D.V. 
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
modified 3-Mar-18 16:20pm.
|
|
|
|
|
I have a license for and have successfully used GetDataBack[^], I use NTFS and not Simple. If only delete has been used you should be good. Used it after a Windows Format and most data back. I think the RAID and NAS versions are only needed if the set has been damaged from dead or incorrectly removed HadD's.
Michael Martin
Australia
"I controlled my laughter and simple said "No,I am very busy,so I can't write any code for you". The moment they heard this all the smiling face turned into a sad looking face and one of them farted. So I had to leave the place as soon as possible."
- Mr.Prakash One Fine Saturday. 24/04/2004
|
|
|
|
|
I suppose it was the Windows delete, my relative says he could see a tiny popup asking about the "permanent deletion".
The harddrive and the NAS contained the same data. I guess it will be easier to try the recovery with the hard drive (NFTS for Win7)
I am giving a look to that tool.
Thank you
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
How did the call center manage to delete his data? Did they get him to visit a malicious website? Sorry I cannot offer advice, but I am curious. He has my sympathy. ![Rose | [Rose]](https://codeproject.global.ssl.fastly.net/script/Forums/Images/rose.gif)
Get me coffee and no one gets hurt!
|
|
|
|
|
Conversation goes like this:
ICC: Hello, my name is Alex*, I am calling you from Microsoft** support. A problem with your computer has just shown up on the internet.
Victim: Oh dear, what can I do?
ICC: You need to download a security update from www.westealyourdata.com, and follow the instructions.
... victim downloads malicious piece of software giving ICCer access to PC
... victim is now doomed, loses data, gets scammed for money etc.
In reality the conversation may go on for some time; I always like to keep them talking for a while, until it is obvious they don't have a clue about PCs.
*or other western name, but with a pronounced Indian accent
** or other company
|
|
|
|
|
Thanks for clarifying!
Get me coffee and no one gets hurt!
|
|
|
|
|
I got one of the calls and and it started pretty much that way. I asked what the IP address they see and he replied "192 dot 168 dot ..." I stopped him right there and said no it doesn't you lying piece of ****. I set this router up myself and it uses a Class A private subnet for all addresses. That means there are NO 192 addresses in my entire network. What other lies do you have for me? He spluttered a bit at that point so I let loose one last spurt of expletives at him and hung up.
|
|
|
|
|
My response always stops them dead in their tracks, and they always end up hanging up on me, which I think is a lot more satisfying than the other way around. The conversation never lasts more than 2-3 minutes.
When they tell me my "computer has a problem", I always ask them which one, as I have a dozen desktops, laptops, tablets and phones, plus roughly 60 virtual machines running pretty much every version of Windows and a number of Linux distributions. Oh, and a Mac.
I always remain polite and cooperative (as far as they can tell), so I'm always mildly amused when it becomes obvious to them they're not going to get anywhere with me.
|
|
|
|
|
You are too, too polite!  What I would say cannot be reported here - this is the Lounge! 
Get me coffee and no one gets hurt!
|
|
|
|
|
Rather than "polite", I think the term is "passive aggressive". In the end, I have the last laugh. 
|
|
|
|
|
Yes, that is quite satisfying but I don't think that kind of person deserves politeness in the slightest and they won't get any from me.
|
|
|
|
|
Oh, I agree, they don't deserve politeness, but when their job is to be one the phone, and in the end they hang up on someone who's remained polite throughout, I rather like to think that it's more effective at making them question their own life choices.
|
|
|
|
|
I would do the same, but I have never got a call like that.
When I reached there, my relative was buying the ITunes Code they wanted. But then I took over the conversation and started making obvious that they were lying. Pity is... it was already too late for the data. Had my relative called me at the begining 
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
I had a 2-3 minute argument with one guy when I told him he did not work for Microsoft, and he knew nothing about computers. Quite amusing really.
|
|
|
|
|
Richard MacCutchan wrote: he did not work for Microsoft
Richard MacCutchan wrote: he knew nothing about computers
Sounds legit to me.
I'm retired. There's a nap for that...
- Harvey
|
|
|
|
|
If you get any call like this tell them to f*** off.
|
|
|
|
|
Quote: with a pronounced Indian accent
I do believe that may apply to a good proportion of legit Microsoft software guys!
Get me coffee and no one gets hurt!
|
|
|
|
|
Just wondering do Microsoft guys would really call in reality and say that your system has a security breach please fix it! i mean they are busy guys, why they would care any one and there are so many Windows users around the world, how one could track and see who is having security breach
|
|
|
|
|
So have they actually deleted data, or encrypted it? I don't understand what the motive would be for anyone calling others over the phone, only to delete data in some unrecoverable fashion.
I don't know about your/his NAS's capabilities, but if this was a Windows machine, I'd be looking for volume shadow copies. See vssadmin.exe, or ShadowExplorer for a GUI version.
|
|
|
|
|
They have deleted. When I came over and switched the PC on again I could see the different devices and they were empty. Windows login was protected with a password due to the remote management tool of them, but the rest was all reachable.
dandy72 wrote: I don't understand what the motive would be for anyone calling others over the phone, only to delete data in some unrecoverable fashion.
Money... plain and simple dirty money...
dandy72 wrote: only to delete data in some unrecoverable fashion.
that's what I hope they were not that professional, and I can maybe (with luck) recover something.
dandy72 wrote: but if this was a Windows machine,
it was a windows 7 machine
dandy72 wrote: I'd be looking for volume shadow copies. See vssadmin.exe, or ShadowExplorer for a GUI version.
Thank you very much for the tip, I will have a look
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
Nelek wrote: Money... plain and simple dirty money...
So I still don't understand. How do these guys profit from data being deleted and unrecoverable?
Nelek wrote: it was a windows 7 machine
You also mentioned a NAS however - unless the NAS machine is itself running Windows 7, it wouldn't be creating volume shadow copies.
Still, let me know if this helped - this is a really poorly known and under-appreciated feature, and has allowed me to recover files long thought to be lost (including some files some people would rather have not had me recover for them)
|
|
|
|
|
dandy72 wrote: How do these guys profit from data being deleted and unrecoverable?
They try to make you believe that if you pay you get the data back. A sort of ransom. The problem is... they can'T beacuse to copy the hard drive a lot of time would be needed.
If the drives would have been encrypted, then there is still a possibility to recover it. Another thing is if the actually give the code after getting the money or they just ask for more.
About the NAS... I don't think it was doing shadow copies, not sure if that NAS was even able to do them. Anyways thank you, I will dig about the feature a bit. Since I suppose I will have to bring everything back to life, I will try to make some changes.
M.D.V.
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
