system restore without access to backup?

[jinjaninja]

I am trying to get my friends computer back up and running after he got a ransomware on his computer. All the previous backups are non functional and I can't log in normally as I get locked out right at start up. Any help is much appreciated.

 

[VistaKing]

Do you have a USB Flash Drive ?

 

[jinjaninja]

Yes sir

 

[VistaKing]

   Note

Backup your flash drive cause it will be wiped doing the steps below

Create a HitmanPro Kickstart USB flash drive, on a “clean” (non-infected) computer, download HitmanPro from the below link.

64-Bit Version OS :ar:
Download



32-Bit Version OS :ar:
Download



Insert your USB flash drive into your computer and launch the HitmanPro program .

Inside the program, click on the flying kick icon . Once you see your flash drive icon inside the program click on it and click on the Install Kickstart button ( this will wipe the flash drive ) click Yes to continue .

Once you're done remove the flash drive using the safely hardware removal inside the systray next to the time on the right hand side . Icon has a green arrow .

Plug the USB flash drive into the infected PC boot off the USB flash drive . Depending on the manufacture the buttons could be ESC , F9 , F12 .

On the HitmanPro Kickstart screen you will have 3 options . Select the 1st one " Bypass Master Boot Record [default] " and press Enter

When HitmanPro opens up

:ar: Click on the Settings button , uncheck Scan for Tracking Cookies click on the OK button

:ar: Click on the Next button

:ar: Click on No, I only want to perform a one-time scan to check this computer on the Setup page . Click Next once done .

:ar: Let it scan the PC once its done Click Next

:ar: Click Activate free license to start the free 30 days trial and remove all the malicious files from your computer then click Next

 

[VistaKing]

How we doing on the Scan ?

 

[jinjaninja]

I got an error while making the flashdrive #5,lock

 

[VistaKing]

Close all the windows . That error is when a file or window is opened from within the flash drive . Then retry creating the HitmanPro Kickstart .

 

[jinjaninja]

O tried it on a second computer and I am still getting same error message. All programs besides kickstart are closed

 

[jinjaninja]

Never mind. It decided to work

 

[VistaKing]

   Warning

You will need a USB FLASH DRIVE

   Tip

Download the Tool from a non infected PC

Farbar Recovery Scan Tool

Choose one that goes with your OS bit version . Save the file to a USB Flash drive

32-bit Version OS :ar: Farbar Recovery Scan Tool

64-Bit Version OS :ar: Farbar Recovery Scan Tool x64

   Note

Click the rb: button and right-click Computer .Select Properties . Look for System Type: which will say 32-bit Operating System or 64-bit Operating System

Plug the flash drive into the infected PC.

Enter System Recovery Options.

:ar: To enter System Recovery Options from the Advanced Boot Options:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select Repair Your Computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

:ar: To enter System Recovery Options by using Windows installation disc:
Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

:ar: On the System Recovery Options menu you will get the following options:

• Startup Repair

• System Restore

• Windows Complete PC Restore

• Windows Memory Diagnostic Tool

• Command Prompt

Select Command Prompt

In the command window type X:\FRST.exe (for x64 bit version type X:\FRST64.exe) and press Enter

   Note

Replace letter X with the drive letter of your flash drive.

   Tip

Type the commands below to see what your letter is for the USB drive and press ENTER after each command

Diskpart
List volume

The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file

Upload the FRST.txt file

   Note

FRST.txt file will be inside the root of the USB Flash Drive

 

[jinjaninja]

I got to the kickstart boot option menu but I can't select bypass master boot record.

 

[VistaKing]

Press 1 on your keyboard . If that isn't working do the steps on Post #10

 

[VistaKing]

Still having an issue ?