Malware Takeover

Would using Rufus possibly help? If so, do I need to burn ISO to a DVD or can I use USB drive? I do have an external USB connected DVD drive.

BIC said:

Would using Rufus possibly help? If so, do I need to burn ISO to a DVD or can I use USB drive? I do have an external USB connected DVD drive.

Click to expand...

What you need most is another "clean" computer. Maybe a friend or other family member.

Then just take your USB stick to the other computer, wipe it, then make the Win 11 installation media.




Then... you can just do a Clean install of Win 11 on your 2TB drive.

I have several other PCs and have already been creating the media from them.

BIC said:

I have several other PCs and have already been creating the media from them.

Click to expand...

During the clean install... just "delete" all the partitions on the 2TB drive.
Then, hopefully the install will over-write enough of the drive to kill the ransomware.



Using 3rd party backup software, prevents these kinds of problems.
But you "must" make the backup software bootable rescue media. With out that, you won't be able to access your backups when Windows won't boot, or when you get ransomware.





Here's some other things that may help...

Ghot said:

View attachment 105308


During the clean install... just "delete" all the partitions on the 2TB drive.
Then, hopefully the install will over-write enough of the drive to kill the ransomware.

Click to expand...

I don't ever get offered that option during the re-install process. It heads me in that direction, then circles me back to the beginning of the process. See screenshots in Post #35. Can a third-party app delete the partitions?

BIC said:

Can a third-party app delete the partitions?

Click to expand...

Not for free.
You can make a free bootable version of GParted live CD or USB.
But it will need to be able to "see" the drive.

All the 3rd party partitioning software, now charges to be able to make it's bootable media.

Here's my copy of Minitool Partition Wizard bootable ISO image...
It might be able to "see" your 2TB drive ?

Burn to a CD or use RUFUS to put on a USB stick.

You'll need to temporarily disable Secure Boot, so this can boot.
Turn Secure Boot back on to install Win 11.








Try "format" during the install... that may get you to the "delete" partitions part.
I honestly don't remember. Last time I installed Windows was in May 2020 (Win 10).

I just did an In-Place Upgrade, to get from Win 10 to Win 11.

I use backup software... religiously.
Which, seriously cuts down on the number of times you need to install Windows.






From the way MS is headed, I'll probably have to a clean install of Windows 12.
Win 10 was different enough to need a clean install, coming from Windows 7.

I think Win 12 will be different enough from Win 11, to need a clean install.

In 26 years, I installed OSes four times.
Win 98 SE, Win XP, Win 7, Win 10. That's it.
Backup software plus the In-Place Upgrades, pretty much cover everything else.

I bought the HP desktop about 6 months ago with a OEM Intel 1TB SSD. I thought I could add a second 1TB, but couldn't so I replaced 1TB with a 2TB WD SSD. Aside from Windows not having the driver, I had no problem installing Windows 11.

BIC said:

I bought the HP desktop about 6 months ago with a OEM Intel 1TB SSD. I thought I could add a second 1TB, but couldn't so I replaced 1TB with a 2TB WD SSD. Aside from Windows not having the driver, I had no problem installing Windows 11.

Click to expand...

That's why I still use 2.5" SSDs. No drivers required.
I'll be 68 in two and a half months. I don't need to go that fast anymore.

I probably "can't" go that fast anymore.

@BIC

This will also create partitioning software on bootable CD or USB...



This is Linux based. The drive lables will be different.
Go by the drive "sizes". Assuming the 2TB shows up.

BIC said:

I do backup periodically to an external hard drive. Probably been a couple of weeks, I won't lose much, maybe a few files, none critical. Any downside to trying a restore point first?

Click to expand...

I haven't read all the post yet but I did read some of the post that mentioned about secure erasing your drive then clean installing Windows. If your backup drive wasn't connect at the time your computer was infected this is what I would do. I would secure erase the drive. When done I would restore my backup image. To repeat myself, Only if the backup drive wasn't connect when the computer was infected. It's also possible that the drive isn't infected and that some files got corrupted when you shutdown the computer.

@Winuser , the backup drive was not connected when the incident occurred. I previously noted this was a ransomware scam, not an actual malware installation. See Post #15. They try to get you to call their phone number. I did not, I just shut the PC down and restarted a few times and got rid of it. The PC seems to be running fine except when I try to run the rootkit scans with Defender & Malwarebytes. Then both programs crash after 15-20 minutes.. All other full scans, including Defender, Malwarebytes, MicroTrend House Call & ESET were all clean.

In the advanced troubleshooting screen, as soon as you click troubleshoot it should be there.


You probably cannot see the drive during windows setup because of intel raid drivers. (duh, I had forgotten this. I am on amd so I always forget about intel stupid raid drivers. We could have saved so much time, I had completely been an idiot I'm sorry. )

Let's do this:

Go into the bios under configuration and there should be an option for the drive to be marked as raid. Change this to AHCI.

Then windows setup should be able to see the drive, you should be able to wipe first via the list disk command as before, and you should be able to wipe it and then clean install windows.

And no changing to ahci wont hurt anything, it just saves you headaches in the future.

I'm heading out of town, I'll get to the RAID drivers when I get back. Thanks.