+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: How to Remove a basic Ransomware (/showthread.php?tid=4278651)
How to Remove a basic Ransomware - Blood_Hawk - Jun 10, 2014
How to remove a basic Ransomware virus on your Computer
I will providing multiple methods since there are multiple ways of doing this.
Method 1
1. Shutdown your Computer
2. Hit F8 when your computer is starting up, or access Safemode in any way your operating system supports.
3. Choose Safemode or Safemod with Networking
4. When the desktop appears then you know Safemode works, however, if safemode doesn't work then it's because the virus deleted a file essential to running in Safemode, skip this method.
5. However if Safemode does work, continue following the steps.
6. Open Task Manager, go to the start-up option and find the virus name and then disable the virus from running again on next re-boot. Or you can find the virus location and delete it from there.
7. When the virus is disabled then re-boot and then you should be all fine.
Method 2
1. Start your browser then access your browsing source and type in "procexp" and download it.
2. Run procexp while virus is running, however, if the virus blocks this then this method doesn't work for you.
3. When procexp is open then find the virus and kill it.
4. Usually viruses doesn't block this process.
Usually one of these 2 methods should work for the basic ransomware viruses.
* - we r num 1 - Jun 10, 2014
You need to post sources because this was obviously stolen.
* - UnOriginalUsername - Jun 10, 2014
Nice tutorial I guess but most ransomawre these days are a bit harder to get rid off.
Usually the ransomware I test can be removed from safe mode.
* - Blood_Hawk - Jun 10, 2014
(Jun 10, 2014 03:48 PM)Wzards Wrote: You need to post sources because this was obviously stolen.
Dafuq? How? I've had experience with ransomware. I didn't steal this..
* - Aura - Jun 10, 2014
Quote:Method 2
1. Start your browser then access your browsing source and type in "procexp" and download it.
2. Run procexp while virus is running, however, if the virus blocks this then this method doesn't work for you.
3. When procexp is open then find the virus and kill it.
4. Usually viruses doesn't block this process.
Are you dumb if you're infected with a Ransomware you won't even have access to a web browser ... do you know what a ransomware is ?
* - Vanilja - Jun 10, 2014
So what if the ransomware blocks safe mode?
* - we r num 1 - Jun 10, 2014
(Jun 10, 2014 03:53 PM)Aurа Wrote: Are you dumb if you're infected with a Ransomware you won't even have access to a web browser ... do you know what a ransomware is ?
Exactly yet he has experience with it...
I could have better methods to counter ransomware with only my little knowledge in malware.
* - Quest™ - Jun 10, 2014
He's just trying to be helpful don't bash him. Just teach him what he doesn't know.
* - Aura - Jun 10, 2014
(Jun 10, 2014 03:54 PM)Google Hangouts Wrote: He's just trying to be helpful don't bash him. Just teach him what he doesn't know.
When you don't know what you're talking about, you don't post "tutorials". It's just false information and you're doing more harm than good.
* - Null Byte - Jun 10, 2014
Uh, just so you know task manager doesn't list all persistence locations. You could have a hijacked system file in which case you'd have to use a hash check to find it. Also, if it's installed as a driver, you're fucked with the first method too. Now lets look at the second method. What makes you think you'll have access to a web browser that can download files? That's a huge, inaccurate assumption.
This guide really needs some work.
* - Quest™ - Jun 10, 2014
(Jun 10, 2014 03:55 PM)Aurа Wrote: When you don't know what you're talking about, you don't post "tutorials". It's just false information and you're doing more harm than good.
Very true that's why I don't post tutorials.
* - Blood_Hawk - Jun 10, 2014
(Jun 10, 2014 03:53 PM)Saixen-© Wrote: So what if the ransomware blocks safe mode?
It says "Basic Ransomware", the ransomware would have to delete a file that is essential to run in safemode, i guess most basic ransomware wouldn't do that. However if so, then you would have to restore windows and have a file backup service with your files.
* - Null Byte - Jun 10, 2014
(Jun 10, 2014 03:54 PM)Google Hangouts Wrote: He's just trying to be helpful don't bash him. Just teach him what he doesn't know.
What's worse then not helping someone? "Helping" them with false information. He's just wasting their time.
* - Aura - Jun 10, 2014
(Jun 10, 2014 03:57 PM)Blood_Hawk Wrote: It says "Basic Ransomware", the ransomware would have to delete a file that is essential to run in safemode, i guess most basic ransomware wouldn't do that.
Once again you're dumb.
Even "basic" ransomwares block access to your web browser so solution 2 is useless.
* - Null Byte - Jun 10, 2014
OP I think it would be in your best interest to close the thread. You're really lucky Corso isn't here or else you'd probably be crying in the shower right now.