Need to wipe ransomeware infected SSD. Have some concerns.

killerhornet25

Distinguished
Jun 13, 2013
19
0
18,510
Hi guys,

A couple months back my computer was infected by a ransomeware virus, so I swapped drives and now I have an infected 240gb SSD sitting around that I don't know what to do with. I was wondering if it is possible for me to wipe the infected SSD so I can use it again. I am worried that if I hook it up to my computer with the new drive, it will reinfect the computer.

Specifically, it was Cryptolocker 3.0, and it was a Corsair Force GS 240 SSD.

Everything that I am reading says that I should never reformat an SSD, so I was wondering what safe course of action I can take, even as far as to how I should wipe it in the first place

Thanks guys!
 
Solution


Boot the system, then connect the infected drive. If you don't run anything from that infected drive, you are good.
Wipe all partitions and format.

killerhornet25

Distinguished
Jun 13, 2013
19
0
18,510
Thanks for the answer on how to format Harry. Now I am just wondering if it would be safe for me to hook it up to my new computer to reformat, since it was plugged in at the time that my previous one was infected.
 

USAFRet

Titan
Moderator


Boot the system, then connect the infected drive. If you don't run anything from that infected drive, you are good.
Wipe all partitions and format.
 
Solution
To protect your new drive you could install Rollback Rx. there's a free version. It will take a snapshot of your system. Then you can restore your new drive to it's previous state before windows boots to delete anything that happened. I used an older utility like this, GoBack. Any problem I would just revert back to a previous time and it fixed anything except broken hardware. The new utility uses few resources, and little drive space. GoBack saved every change so it used a lot. Unlike System Restore this works if Windows wont boot. I once installed and removed 5 versions of AOL in an hour using GoBack. AOL was gone without a trace. This will also keep you from getting locked out again.
 
I am surprised there was no mention of using the Windows backup/restore feature. It works for me. No need to secure erase. No need to format. No need for extra utilities.

The only problem is convincing users to use the Windows backup/restore feature. The means having backups performed on a regular basis. I have mine set to perform a back up every Sunday morning. It runs in the background while I do something else. No muss! No fuss! No bother!
 

USAFRet

Titan
Moderator


Since this was a drive that had already been replaced...
Wipe and use as needed.
 

USAFRet

Titan
Moderator


Oh, exactly.
But can't recreate what wasn't created in the first place.
 
The utility I mentioned will run if Windows wont boot, if your password is encrypted and you can't get into Windows then how is Restore going to help? It also makes a restore point daily, more often in the paid version. It makes an image when it restores so you can go forward and retrieve files you want to keep. I'm pretty sure Windows doesn't do any of those things. He could have solved the ransomware problem in about 30 seconds if he had this. It also makes an image any time a .exe program runs. Did I mention it's free?
 

USAFRet

Titan
Moderator


There are multiple applications that do that.
Macrium Reflect - a Full disk image once a week, an incremental every night at 2AM.
Casper, the same. Full, incremental, differential.

Additionally, SyncBackFree does similar on a file/folder basis. Copies over to another drive on whatever schedule you desire. Only writes from A to B what is different.

However, you need to do this before the stupidness happens.
 
My point was he needed something installed to protect his new drive before he connected the old corrupted one. It doesn't matter to me which utility he uses. Just that Windows Restore isn't enough. I didn't see anyone else here telling him how to avoid having the problem again.
 
william p: I hope I understood you correctly.

You forgot about creating a Windows emergency boot utility which can be done during the initial Windows installation. It can be saved to an optical disc, USB flash drive, or an external drive. I give each of my customers either an emergency optical disc or USB flash drive. It is inependent of the primary boot drive. In addition, a user can schedule backups. A user can chose where to save the backups and restore points. They can be saved to a secondary data storage device or to an external drive. Never save backups and restore points to the primary boot drive.

 
william p: The articles you referenced is an old one published in December 2013. I guess you have not kept up with developments.

In 2012 the Gameover Zeus botnet was turned loose. The botnet became the sole distribution channel for Cryptolocker. During the Summer of 2013 the malware was initially used against banks and financial institutions in numerous countries. The ransom demand varied between $10,000.00 and $40,000.00 USD. The financial institutions tried to keep it quiet. The US Department of Justice, US Department of Homeland Security, and the FBI started a joint investigation with the UK's National Computer Crime Agency, Interpol, and law enforcement agencies in Australia, Germany, France, Japan, and Ukraine. They were assisted by SecureWorks, a private computer security firm.

During the latter part of 2013 the attacks shifted from financial institutions to other businesses and eventually filtered down to consumers. There was entirely too much hype. At the time Symantec and several other companies added Cryptolocker to their anti-virus applications. Since then the better anti-virus applications can detect Cryptolocker and variations such as CryptoWall.

Meanwhile, forum threads and blogs were full of individuals who were hit by the malware. They were looking for solutions. The solutions which were proposed were not very good and usually did not work. The reason for that was that Cryptolocker kept making improvements to overcome the solutions. There is only one solution which I will get to in a moment.

On Monday, June 1st, 2014, the law enforcement agencies conducting the joint investigation swung into action. They took control of Gameover Zeus and Cryptolocker and shut them down. The administrator of Gameover Zeus was arrested. Since then there have been almost no or very few reports of Cryptolocker infecting computers. There are other smaller, less ambitious gangs operating that use variations but the number of infections has decreased dramatically.

One of the surprising things about Cryptolocker is how it was distributed. Fake emails, social media, and webpages with executable attachments were all used. Web sites like Disney, The Guardian newspaper in the UK, and Adobe were also used. Imagine a child visitng the Disney web site and clicking on a harmless looking link that initiated the trojan.

In the event a computer is infected there is one solution that works. The solution did not come from consumers. It came from the business enterprise sector - IT managers and IT techs. In the forums they were reporting successfull recoveries without any special applications or utilities while others were reporting unsucccessful recovery attempts. The difference between successfull and unsuccessful recoveries can be summed up with just a single word - Backups.

william - Based on your comments I'm guessing you are not thoroughly familiar with the Windows backup/restore features.

There are several types of backups performed by Windows. The one that needs to be done is the 100% full conplete backup for all drives connected to a computer. That way a copy of everything is saved. That means family photos, videos, games, and everything else is saved in case of an emergency. The backup must be written to an external storage device that is disconnected from the pc once the backup is complete. An emergency boot disc and the backup work perfectly.

 
Believe it or not I am aware that you can backup your files, use a boot disc and restore "reinstall" Windows. I 'm also aware you will lose any files or programs or data not saved. I don't think I ever said that wouldn't work. I do consider it a last resort. The utility I mentioned (or others if you prefer something else) are a good first line of defense, and will USUALLY resolve most problems in a few seconds. With very little data loss. I've actually never had to use a boot disc and restore Windows, so I guess you have the advantage of me there.