Malware & ransomware recovery · Case Study
101 malware detections. 1TB of family photos.
Antivirus downloads, service changes and USB access were blocked. A free backup became crucial when ransomware struck two days later.
- Data at stake
- 1TB of family photos
- Initial work
- 15 hours
- Recovery
- Rebuild & restore
What made this PC so difficult to clean?
The case involved a reported 101 malware detections, including fake antivirus software. An unexplained VPN component was connected to an unfamiliar IP address geolocated to Russia. Who controlled that connection was not established.
Three cleanup routes were blocked
Antivirus download
An attempt to download Malwarebytes was blocked.
Service changes
Attempts to disable services were blocked too.
Offline installer
An offline-installer route using another laptop was attempted, but USB ports on the affected PC were blocked.
Why a full OS reinstall had to wait
There was no backup for the 1TB family photo library. Wiping and reinstalling the operating system would put the only copy at risk. Protecting those files had to come before a clean start.
It looked better. The concern remained.
After 15 hours of work, the PC appeared functional. Drawing on 25 years of experience, FixPoint Tech remained concerned and could not confirm it was clean.
The customer preferred to wait and see. FixPoint Tech explained the risk of further compromise and data loss, and offered a backup at no charge. The customer agreed.
Ransomware struck. The photos had a way back.
The photos were backed up at no charge, giving the family a recovery copy while the concerns about the PC remained.
Two days later, the customer called: the PC had been hit by ransomware. They were distressed, and the priority was helping them recover. The backup gave FixPoint Tech a way to rebuild and restore.
Recovery at no charge
FixPoint Tech carried out a full operating-system rebuild and restored the family photos from the backup. The backup, rebuild and restore were provided free in this case. The same customer went on to book three further jobs.
Case account supplied by FixPoint Tech.
The VPN's IP location did not identify an attacker. The later ransomware also did not establish that the earlier cleanup caused the attack or that anyone had deliberately retaliated.
Questions this case helps answer
A few useful answers.
Can a PC look normal and still be unsafe?
Yes. Normal behaviour alone cannot establish that a compromised PC is clean. Recovery may require a clean rebuild as well as protecting the data.
Can a backup help recover family photos after ransomware?
A usable backup can make restoration possible. Keep recovery copies protected from the affected PC and check the files before restoring them.