[AlanHo]

One of my elderly friends has fallen victim to a telephone call security scam.

She was told they had detected problems on her laptop - but because she had indeed been suffering from slow internet access she thought it was her service provider. After being shown all the red markers and yellow warning triangles in the event log she was suckered into downloading some software to give them access to the computer,

After several minutes demonstrating all the problems they had "found" they asked for £65 to rid it of problems, she refused to pay and put the phone down.

Today when she switched the computer on it booted to a warning screen stating that all her files had been deleted - or some such message. It does not boot to her desktop and does not respond to mouse or keyboard inputs. Fortunately she assures me she does not have any personal stuff stored on the computer or use it for banking etc. But she is distraught that she may have lost all her photos, personal correspondence to friends and family and her collection of music.

I have asked her not to switch the computer on again and I will collect it from her on Friday to see what I can do.

The question is - what can I do.

I know enough about computers to remove the hard drive from her laptop and mount it in an external enclosure to be able to look at it from a spare Win7 computer I keep for playing around with. I have no worries about infecting my spare computer with malware - I will reformat the hard drive and use Acronis to recover its hard drive from a safe back-up after I have finished playing with the infected laptop hard drive.

[Shambles]

Sounds like the Cryptolocker ransomware.

Easy to sort out if it is.

Whitehats recover, release keys to CryptoLocker ransomware | Ars Technica

[Lorian]

Might not be cryptolocker of course,  See if it boots to safe mode (Press F8 a few times whiles its booting) without the "ransom banner" as a first step.

[Phil №❶]

Use Linux and simply copy her photos, then use your correction methods. Educate your friend to never accept telephone advice, unless it's coming from you. 

[AlanHo]

Our friend Christine visited today and brought her crippled laptop. I spent the day trying to rescue it.

It booted up to a black screen displaying a small window which said "This computer is locked and cannot be used until you enter the password which we will provide upon payment of our technical assistance fee. You are allowed 5 attempts after which the hard drive will be deleted and cannot be recovered" There was a box awaiting the entry of the password.

This is not the same display of CryptoLocker - or any other ransomware info I found on google search.

Trying to boot into safe mode didn't work - the computer still stalled at the Ransom screen so I was not able to use a ransomware removal tool.

I then booted the computer with a Ubuntu disk which looked promising.  The directory tree of the hard disk could be seen with the various sub-directories - but they were all empty. Looking at properties you could see the size occupied by each directory but not the number of invisible files it contained.

I then removed the hard drive and mounted it in an external USB drive connected to my spare Windows 7 PC.

I was surprised to see that again the directory tree was visible in Windows explorer complete with the files - but the files wouldn't open without me first taking ownership of them one by one.

Having done that with all her valuable Documents, pictures and music, I copied them all to a spare 128 GB SSD to keep them for later use.

Rather than spend countless hours messing with the disc to try and get Windows and her software working - and realising that there was something really nasty hidden on there - I decided to format the disc, create two now partitions C and D and reinstall Vista from the Notebook's recovery disc which fortunately she had retained.

I then moved her documents, music, pictures, downloads and favorites  folders to the D drive and copied across all her valuable data.  Then I set up the internet, Malware protection, downloaded her most used software and got it all working. Her son is capable of getting her iTunes and Skype installed and working.

I have told her that she will not get the Notebook back until she buys an external hard drive for taking regular backups. I am taking her to PC World tomorrow to buy a 1TB Seagate portable USB hard drive. I have a spare licence on an older version of Acronis I no longer use. I will install Acronis and then show her how to take weekly backups.

[FatBoy]

Great work, Alan!   

I cringe sometimes when I see these stories, and how scum scammers prey on the vulnerable people.  Unfortunately, the people being scammed should become more sceptical about unknown people trying to "help" them.

[Dazzler]

Love your work Alan

Don't forget to create a bootable thumb drive rescue media, if the system becomes locked again you'll need the rescue media to be able to restore an image or clone

Aeomi is one of my new favourites and it's free Best Free Backup Software for Windows 10, Windows 8.1/8, Windows 7, Vista, XP

Aeomi PE builder free PE Builder - Create Bootable USB or CD/DVD based on Windows PE with AOMEI PE Builder

[Phil №❶]

I use that one as well.

[AlanHo]

Don't forget to create a bootable thumb drive rescue media, if the system becomes locked again you'll need the rescue media to be able to restore an image or clone

Aeomi is one of my new favourites and it's free Best Free Backup Software for Windows 10, Windows 8.1/8, Windows 7, Vista, XP

Aeomi PE builder free PE Builder - Create Bootable USB or CD/DVD based on Windows PE with AOMEI PE Builder

Thanks for the reminder Craig - but I have created an Acronis rescue DVD because there is something flaky with the laptop when booting from a USB drive.  Later this morning I will take a full Acronis backup and keep it myself for when the inevitable happens.

Since posting my OP I have upgraded the laptop from Vista 32 bit to Windows 7 32 bit because one of the sites she frequents will not work on IE lower than IE10. Vista flatly refused to load IE10 which became its death sentence. The laptop now has IE11 and seems to be running quite well.

You've got it sorted Alan, Win7 is a far better system than Vista as well

[EmpiriuS88]

You've got it sorted Alan, Win7 is a far better system than Vista as well

My advice, just go for Windows 8.1. Same as Windows 7, only start menu is one more click away

I just installed 8.1 over 7 since it started buggin me with non genuine crap.

You've got it sorted Alan, Win7 is a far better system than Vista as well

My advice, just go for Windows 8.1. Same as Windows 7, only start menu is one more click away

I just installed 8.1 over 7 since it started buggin me with non genuine crap.

As Alan probably had a spare copy of win7 laying around that would logically be why win7 was installed 8.1 takes a bit of getting used to and being that Windows 10 should be out in some months to follow they will still have the opportunity to get the free upgrade from 7 to 10 if wanted

[AlanHo]

Get a lottery ticket Craig - your guesswork is spot on......

 

[ibrokeit]

Thanks Alan - information like this is always good to know.

What surprises me is that the files themselves weren't encrypted - that you were able to see them, and open (once you had changed ownership - I have run into something similar when I did a Win re-install once).

I guess they were relying on people not knowing what to do when they got the screen - other than to pay up... so didn't worry about it.   Maybe they decided the extra effort would not be worth the number of 'failed' ransom demands for that reason vs. the number of 'successful' ones.

Who knows.

[Lakes]

Good on you Allan.
can't you track the Crook down too?
then we can re name you Sherlock Ho

[Dazzler]

Good on you Allan.
can't you track the Crook down too?
then we can re name you Sherlock Ho

 

[Aussie Keith]

Although you have triumphed over evil (well done), my 2c.

With these sorts of issues it might be possible to restore the computer by resetting the master boot record like so:

MBR - Restore Windows 7 Master Boot Record - Windows 7 Help Forums

Alternatively: EasyBCD - NeoSmart Technologies which used to be free to control the boot process.

Or if that doesn't work, something like parted magic: Download Parted Magic - MajorGeeks

I've used parted magic quite successfully in the past for retrieving data, its not a bad gadget.

Update, there still is a free Easy BCD variant.