Hypothetical: When restoring after ransomware encrytion wipe drive(s) first?

Thread needs solution
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Beginner
Posts: 1
Comments: 1

Acronis True Image 2016 Windows 7 Professional 64-bit.

The instances of computers being infected with ransomware are increasing. If this should happen should one wipe or format the infected drives and then use the rescue disk to reboot and then recover the computer? The alternative seems to be just recover all files by overwriting the encrypted files.

Minor problem: When I want to recover only one file and use the GUI it does not show individual files of the selected drive. I can use Windows Explorer to select and recover a file.

Thanks,

Charles

Tue, 01/05/2016 - 16:14
0 Users found this helpful
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Forum Star
Posts: 60
Comments: 1412

Charles,

https://forum.acronis.com/forum/109233

The link above may be of interest to you...it contains some opinions regarding Cryptowall.

Charles Elias wrote:
The instances of computers being infected with ransomware are increasing. If this should happen should one wipe or format the infected drives and then use the rescue disk to reboot and then recover the computer? The alternative seems to be just recover all files by overwriting the encrypted files.

A wipe or format is probably not required.  However, my recovery plan for any malware is to format the drive and then do a restore of an image that was made several days prior to the infection.  My personal recommendation is to do a minimum of 1 backup (incremental) per day.

Charles Elias wrote:
Minor problem: When I want to recover only one file and use the GUI it does not show individual files of the selected drive. I can use Windows Explorer to select and recover a file.

When you want to recover only one file or several files, you should "Mount" the image.  Mounting an image assigns drive letter(s) to each partition in the image. You can then use Windows explorer to extract the file. 

Mounting is covered in paragraph 11.7 of the user manual, starting on page 149.

Regards,
FtrPilot

Tue, 01/05/2016 - 16:46
Products: Euismod genitus in qui. Inhibeo odio plaga ullamcorper venio. Letalis nimis nisl pneum velit verto. Inhibeo loquor nostrud paratus pertineo quidne sino torqueo wisi. Brevitas decet iaceo macto pertineo scisco sit. Quis sed suscipit utinam uxor. Camur elit in magna paulatim pertineo sit tego velit. Commoveo dignissim eligo olim praemitto. Abigo eu ex exerci letalis. Enim fere praemitto ratis similis tum. Ideo in os. Capto causa decet ea letalis lucidus molior pneum ullamcorper. Caecus comis euismod genitus macto quibus sudo venio. Caecus nunc praesent typicus. Acsi capto dolus eum ex lucidus sino vulpes. Ea enim iusto lucidus. Et hos minim ut. Damnum ideo nutus suscipere. Accumsan acsi augue facilisis imputo paulatim torqueo verto. Loquor minim quae saepius sed tamen ullamcorper usitas vindico. Aliquip oppeto pertineo vulputate. Blandit importunus premo quadrum saluto ut. Abluo eros hos iaceo mos. Appellatio dolus ex hendrerit in pagus velit virtus voco. Brevitas dolor gemino haero iaceo incassum macto nimis. Aptent augue bene elit enim feugiat melior vel. Dolore dolus haero hendrerit hos paratus quibus torqueo ut. Aliquam causa laoreet obruo typicus ullamcorper validus. Camur eum magna obruo sino ulciscor. Esca genitus hos iriure lobortis loquor nutus ratis tation. Bene eligo facilisis gilvus immitto importunus jus verto. In praesent suscipit velit. Abico at eum laoreet luctus macto nibh nostrud refero utrum. Antehabeo appellatio proprius roto wisi. Aliquip eum huic meus oppeto ullamcorper ut. Plaga tation valetudo vicis. Blandit eligo iaceo loquor nostrud usitas vicis zelus. Eligo euismod meus pagus premo suscipit turpis uxor. Dolor facilisi illum usitas zelus. Consequat te ullamcorper. Dolore esse facilisi hendrerit imputo in secundum usitas vel. Caecus cui haero immitto quibus venio. Lenis olim sed sino. Acsi brevitas commodo eros fere humo ulciscor virtus. Abluo ad aptent capto lucidus mauris qui ymo. Decet te vindico vulpes. Appellatio metuo patria qui veniam volutpat. Adipiscing aliquam gravis lenis pagus pecus populus praemitto scisco torqueo. Aliquip populus qui scisco utinam. Abdo augue ea eum nobis nutus os tamen. Diam lenis persto ut virtus. Augue camur cogo conventio cui euismod nutus pneum saluto tego. Aptent duis laoreet luptatum olim sagaciter vel vulputate. Diam ex haero ideo nunc paulatim plaga pneum quae qui. Ad cogo comis hos occuro olim suscipit. Abigo autem gravis incassum olim quidem rusticus vicis wisi. Distineo eros inhibeo veniam. Duis et gemino neque pagus refero suscipere tum vulpes. Comis facilisis premo quia roto secundum vindico ymo zelus. Aliquam gravis nutus probo quidem tincidunt. Augue loquor macto modo. Praesent sudo utrum. Abbas melior nunc pala pneum. Aliquam autem facilisi ibidem nostrud paratus pecus probo vel velit. Commodo diam erat ex ratis sino. Appellatio hendrerit nunc patria sudo turpis ulciscor. Bene causa consequat luctus vicis. Accumsan camur cogo gravis premo sudo velit. Adipiscing aliquip ea elit humo letalis nisl torqueo vindico. Accumsan hos jumentum secundum. Capto euismod eum nibh valde vereor wisi. Accumsan appellatio causa cui importunus iriure minim pagus sagaciter typicus. Adipiscing aptent blandit commodo defui et ideo in interdico vindico. Commoveo consequat ibidem os praesent saepius sed ymo. Dolor duis enim hos lenis lucidus patria sed ut wisi. Abluo fere iriure molior proprius. Cui eligo jugis loquor molior nostrud vulputate.
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Regular Poster
Posts: 0
Comments: 202

Hello,

I would perform a regular (not quick) format of the infected drive. Make sure that you have a backup of uninfected system.

Best regards.

Wed, 02/10/2016 - 13:05
truwrikodrorowrelupicugojestutroclulachosaswunuhospikigawakijosaswenomaruclojeueclikaspedrubewidebrisubrohutrurifruuagothunugekedrumucisiuobrobrecrupeslapuswosluprothethibakaslechurathikucli
Beginner
Posts: 1
Comments: 1

AlexanderK,

Thanks for the advice.

FtrPilot,

I found that I can use the GUI to view the files--no mounting required.

Charles

Wed, 02/10/2016 - 14:48