• Sometimes, a piece of ransomware that goes by a certain name, may have variants for which the decryptor
  does not work. You must carefully inspect the website and the description.
• Also, In some cases, there seems not to be a nice "instruction" on how to work with the decryptor.
  So, this section differs a bit from section 1 above (where most sites delivered adequate instructions).
• It can well be, that a decryptor listed below, is replaced by a decryptor found at the sites in section 1.
  Decryptors as offered by section 1, if availble, have preference above anything listed below.
• Allways crosscheck a certain decryptor below, with other sites (you should "Google" a bit).
• Allways carefully read any info in the sites listed below. Possibly some decryptor does not apply
  for your variant, and that would not be good.

Top 20: only just started.

Table 2: Listings of weblinks to ransomware file extensions (as found sofar:4):

Table 3: Listings of (what I think might be) relevant scientific articles (as found sofar:1):
(could change quite a bit).

4. Some commands you might find useful:

-Subsections 4.1 upto 4.8 deal on rather simple commands to view and filter on patches,
or how to set the Firewall on, or how to set NTFS permissions (icacls), or attrib,
and a few remarks on VSS.
This might be all a bit trivial info for you.

-Subsection 4.9 is about "SFC", the System Files Checker, and the "DISM" command.
These might be not so familiar to you, and they can play an important role in detection
of system damage (the OS), and reparation.

You can start a "command prompt" (cmd), run under an Admin account (for this time).
(use "Run as Administrator").
At the "C:\>" prompt, you can copy/paste some of the commands like listed below.
Some commands are for using Powershell, as is shown in the text below.

For example, it can be handy to grep (filter) the output, on a certain KB fix number, to see
if you indeed have it on your system.

For almost everything listed below, a GUI makes the same possible too.
However, using a prompt is more versitile, given the fact of the enormous
amount of commands and tools available today.
Indeed, below is only a very very limited subset of commands.

4.1 Checking patches/patchlevels on Win systems, from prompt:

C:\> wmic qfe list
C:\> wmic qfe get
C:\> wmic qfe get > c:\temp\patchlist.txt --output stored in c:\temp\patchlist.txt
C:\> wmic qfe list | find /I "text you want to filter output on"
C:\> systeminfo | find /I "kb"

C:\WINDOWS> copy WindowsUpdate.log C:\TEMP
Then you can just browse around, and search for kb's or other info, in C:\TEMP\WindowsUpdate.log
The latter one is a bit cumbersome, but quite informative.

Another interesting log is CBS.log in C:\Windows\Logs\CBS\. Here tools like sfc report their findings.

4.2 Checking patch/patchlevels on Win systems, using Powershell:

-- all fixes:

PS C:\> Get-HotFix

or:

PS C:\> Get-WmiObject -Class "win32_quickfixengineering"

-- only the latest:

PS C:\> (Get-HotFix | Sort-Object -Property InstalledOn)[-1]

-- other fix info:

PS C:\> Get-WmiObject -Class "win32_quickfixengineering" |
Select-Object -Property "Description", "HotfixID",
@{Name="InstalledOn"; Expression={([DateTime]($_.InstalledOn)).ToLocalTime()}}

4.3 Checking the status of the FireWall on Win systems, using command prompt:

C:\> netsh advfirewall show allprofiles.

4.4 Changing the FireWall status to "on", if needed, on Win systems, using command prompt:

C:\> netsh advfirewall set allprofiles state on

4.5 mpcmdrun.exe, if you depend on "Microsoft Defender Antivirus":

If Microsoft Defender Antivirus is your base defense policy, you really should take a look
at the "mpcmdrun.exe" command, to see how you can control the utility.
There are plenty of websites discussing Windows Defender.
A quite useful application of the latest Defender, seems to be the controlled folder access feature.
You might investigate that further.

4.6 Object access and icacls sessions:

Anything listed here, can be done using the GUI as well, like the file explorer.

Suppose you have datadirectories, like "E:\data", with subfolders like "E:\data\excel", "E:\data\administration",
then it's best to restrict access to those folders.

=>I would not advice to do anything at all with root locations, like "C:\" or "E:\".

=>However, it's best to remove "Everyone" and "Authenticated Users" (and "Users") from the NTFS
security listing, on folders like "E:\data\excel", "E:\data\administration" etc..
Remove any non system account, and leave your account or your group in place.
I would recommend to leave the OS entities in place (like "System").
Next you must add the right group (or for a personal user, the right account).

You can use the (file) explorer to modify NTFS permissions and remove or add accounts
to the permission listings (ACL's), and modify the permissions per account.

You can also use tools like "icacls", (the native) prompt command too.

C:\> icacls "C:\test" /grant MyPC\albert:(OI)(CI)F /T

The command above, gives the user MyPC\albert, Full Control (F) on the directory C:\TEST.
The command further gives Full Control (F) on any subdir, due to the "/T" switch.
(Instead of a local user of a Workstation or Server, the account may also be a Domain Account,
like for example "albert@antapex.org", or an AD group, Local Group, etc..).

The parameters in parenthesis, might seem weird, but they stand for Object Inheritence (OI)
and Container Inheritence (CI).

Did you noticed what a silly guy I am? Notice the "F" permission of Full Control in the command above.
It's practically never needed to grant "F" to a normal useraccount or group. Use "M" if you want the account
to modify files (R and W and other), but F is usually too much.
Simply use RX if you only want to grant Read permissions.

The following is only for inspiration, for you to build easy scripts, using icacls.

Many malware runs in the security of the user which started it.
So, suppose you have MyPC/Joe and MyPC/Donald as accounts on your PC.
Next is a bit of a silly example, but it's only for demonstration purposes.

=>Suppose, if you want to do serious work, and access and modify datafiles in D:\DATA,
you might logon as MyPC/Joe.
The Administrator already set the permissions before, using the Modify permission
granted to MyPC/Joe:

C:\> icacls "D:\DATA" /grant MyPC/Joe:(OI)(CI)M /T

So, MyPC/Joe, can modify files in D:\DATA and all subfolders.

=>Suppose, you only want to browse the Internet, use mail, social media etc..,
then you might logon as MyPC/Donald.
The Administrator already set the permissions before, using the RX permission
granted to MyPC/Donald:

C:\> icacls "D:\DATA" /grant MyPC/Donald:(OI)(CI)RX /T

So, MyPC/Donald, can only list and read files in D:\DATA, but not modify it.

If you need to remove the NTFS permissions:

C:\> icacls "D:\DATA" /remove MyPC/Testuser /T

Yes, silly example ofcourse, but it was for illustrational purposes only.
But you can build all sorts of batch files, using icacls, operating on accounts and folders.

Using multiple accounts, for seperate sorts of work, looks a bit "paranoia" indeed.
Sorry for that. However, if you work it out, then it will work in protecting data.

The main point is: having good NTFS permissions on filesystem objects, really helps.

4.7 attrib command:

While NTFS permissions are more important, a simple way exists to make files read-only, and hidden.
This can be done by using the attrib command. A small chance exists that the enumeration algolrithms
of malware does not take attributes into account (which are just flags, and not ACL's).
Don't have high hopes of the effect, but It's really easy:

Suppose you have an excel directory and a photo directory within E:\DATA.
Then:

E:\DATA\exel> attrib +r +h +s *.*

makes all files flagged as hidden, read-only, and as systemfiles. In effect, with simple enummerations,
you don's see them anymore, and they are read-only (yes, I know, it's simple).

Using:

E:\DATA\exel> attrib -r -h -s *.*

returns the flags as the opposite (as they were before).

It's not hard to create a batch which can do that over a bunch of data folders.
Is this any good? No, not really. But it is an option.

4.8 Shadow copies of data:

This is about VSS: Volume Shadow Copies on Disk.

Did you know that most Windows versions (at least as of Win7), use a reserved part of diskspace
to store "shadow copies" of directories. Maybe your data directory is included in such "Shadow Copy".

Multiple copies of a folder can be stored, like from yesterday, one week ago etc..

From data in folders, VSS only copies changed blocks into VSS area, thereby limiting the needed diskspace
for storing files.

Simply from the file explorer, rightclick the folder you are interested in, and look in the menu
if you have the option to "restore a former version".

However, some modern ransomware instances try to destroy the Shadow copies as well, but most
do not. Maybe you are lucky, after a ransomware attack, and you do not have regular backups.
In such case, shadow copies might help you.

Check the Web to see what you can do with those "shadow copies". It's quite good.

4.9 The sfc and dism commands:

SFC, or the System File Checker, enables you to replace corrupted, or missing, systemfiles,
so it has nothing to do with datafiles.
Even if there are no complaints or any error messages, you can run "sfc".

The "dism" command has a similar functionality, and even much better compared to sfc.
Sfc will use a cached folder to replace files, while dism can practically use any location.

For later versions of Windows, you first must use the "dism" command. This holds for Win8.x and Win10.

- Start an elevated prompt (Run as Administrator).

- For Win8.x, Win10 run:

C:\> dism.exe /Online /Cleanup-image /Restorehealth

You see the /Online switch, meaning that dism tries to use "Windows Update" for any replacements.

If that does not work, e.g. online is not available or something, but you have any Win souce
available (DVD, networkdrive, sxs dir, or whatever) of the SAME version, then use:

C:\> dism.exe /Online /Cleanup-Image /RestoreHealth /Source:WhatEverSource /LimitAccess

where "/Source:WhatEverSource" could be e.g. "/Source:F:\win10".

For older versions of Windows, from an elevated prompt session, you can always try to use:

C:\> sfc /scannow

It's highly recommended to do a websearch on dism and sfc (certainly for dism), to learn more.

Old txt file with DOS/CMD commands:

The following one, is of my old txt files, containing dos/cmd commands, of which some maybe useful
in checking the status of the machine, services, processes, network, and other info.

I recently added "section 15", which is a small resume of handy commands to check your system.
If like to see it, try: Some dos/cmd commands.

5. Other info:

The following doc might provide some further tips. It's not really great, or something,
but it might (?) provide some useful info. I'am not sure.
But, there are indeed some sections with recommendations. So, I list it anyway.
But I just found out that I need to do some serious re-editing of that note.
There is way too much blabla in that note, so I make that better. But the core idea's
will be also found in the section 8.

Windows repair, data salvage, and some tips.

6. The usual cleanup procedure:

Nothing is perfect, and that certainly holds for this note...
It's not guaranteed the best options are presented in this section: It's my view only.

After you have noticed a "ransom message", the question is ofcourse, what to do next.
At this stage, it's quite likely you have encrypted datafiles, but the system itself might
be compromised too (e.g. damaged systemfiles), although the latter does not often happen.

If you have backups of data, you are relatively unharmed, since you can restore the data
at a slightly later moment. It's only a lot of hassle.

If possible, make a screendump, or write down important key items, from the Ransomeware Message
which usually was (is) displayed on your screen. (Usually, there exists .txt files as well, with the same
message, for example in folders where encryped datafiles are around).

Next follows a number of cleanup procedures.

Method 1 (not recommended, only for very rare cases).

It's sometimes advised that the system should not be powered down, since maybe, "very maybe"...
the prime numbers used to build the crypto keys remain in Windows memory and have not yet been wiped out.
Some sort of tool, can then hopefully reconstruct the decryptor key.

Generally, this looks like wishfull thinking, and it would only work for a few ransomware instances.
At this point, I only know of one article stating success, using this methodology.

If you have data backups, then I do not support option (1).

Also, it's not a common, or publicly advised rule, and will only work in some cases.

Thus in general, procedure (1) is not the best answer, except in some rare cases.
But you still might persue this option, if you have found decryptor routines, and have no databckups.

Method 2. (Reasonable, but method 3 is better and safer).

So, if you look at the mainstream of articles discussing the next steps, it goes like listed below.
It's now assumed that you indeed have backups of datafiles.

-Shutdown.
-Disconnect the machine from any external storage (if that applies in your case).
-reboot to save mode with networking enabled.
-Logon to the system, and perform a thorough scan with your AV software.
(it could not hurt, if possible, to update the AV software with the latest malware database).
-It might be that the AV software reports that malware was found, and was cleaned up, or
that nothing was found at all.
-If possible, do another scan with a free edition of another AV manufacturer (optional).
-Reboot again in normal mode.
-Start a command prompt, as an Administrator, and perform the "dism" command or "sfc" command,
as was shown in subsection 4.9.
-It's likely you need to further cleanup Ransomeware message files, and the encrypted datafiles.
-If everyting looks OK, you can restore the backups of the datafiles.

Ofcourse, startup options of the system, and Registry entries were possibly faulty too,
but the AV scan/repair should have taken care of that.

So, (2) looks like a decent procedure. I personally agree, but I think (3) is more safe.

Method 3. (The best procedure, in my opinion).

But..., I would have recommended a full reinstall of the Operating System, again an AV scan, followed by
a restore of the datafiles.
This seems like an overkill for most cases. So, indeed. Option (2) above looks like a pretty decent procedure.

-It can be indeed be quite some work to install and configure special software, like bookkeeping software,
cashiering apps, or cadcam software, etc...
-A reinstalled system also seriously lags behind in security patches etc.. And it thus needs
special attention to this subject too.

So, normally, I advice a reload of Windows. But others say that this is unneccessary in many cases.
And they may have a point.

It's a bit strange, but I am somewhat uncomfortable now, in keeping the positition of a reload of Windows.

But, after carefull considerations, I still favour a complete reinstall of the Operating system,
and reinstall (or restore) of all applications.
But, I may make a serious fault here: If you would only have encrypted datafiles, while the OS
is "unharmed", my advice would be an overkill.

The deep reasoning behind a reinstall of Windows, simply is the fear of damage to the Operating System,
and e.g. faulty Registry entries, and all sorts of other stuff, which could keep lurking around etc..
But good AV software, with dism etc.., will all detect that. However, still not good enough for me.

In Resume:

- Only for very special cases, and no data backups: option (1). But it's a bit wishfull thinking.
- A reasonable approach: option (2). I agree to that. It's a methodology often found in articles on ransomware.
- The best approach: option (3). I still find this much better, in general. Just my opinion.

-In general: Reinstall the System (or restore image) + restore datafiles, EXCEPT if you know for sure, that in your specific case (with your specific ransomware), it's good enough to follow method (2). -Important: The above, represents my own view only. Most articles do not refer to a reinstall of the OS. They describe a procedure similar to method (2). So, if you prefer (2) above (3), that could be right. I only wanted to exclude any risks.

An advice of a reinstall of the OS, would not be quite fair, if I would not show a reasonably
easy method to do so.
So, this simple note will not be good enough without telling how to simply backup data files,
and how to make a system image of the OS (plus optionally all Apps).

7. A few words on how to backup and restore your PC/Laptop (private user):

All in this section might be percieved as rather trivial stuff. If indeed so, sorry about that.

7.1 Hot and Cold files:

=> When you have data folders which stores e.g. Word documents, Excel files, pdf's, photo's etc..
then these are "cold" files. No process is accessing them, unless you have one such file
open in an application. There is no problem to copy them from one disk to another disk (like usb disk),
and it's all a clean operation. Very simple.

=> Some other business datafiles, may not be "cold". Like database datafiles, or some datafiles
belonging to some accounting program. "Just" copy them, "just like that", from one disk to another,
may not lead to the desired result. This is because the datafiles are "hot", and a process, or many
processes, are accessing them (the files are "open").
Probably, some "records" inside such a file, are read, or are in the process of being updated etc..
If you think you have such software, then consult the manual (or internet), for specialized backup
commands or procedures.

For example, if I have SQLServer running (A database engine), and I have an "accounting" database (also
with that name), then from a SQL Server utility, like "the SQL prompt" SQL>, I can make a full backup
by a command like:

SQL> BACKUP DATABASE ACCOUNTING TO DISK="U:\BACKUPS\ACCOUNTING_18112020.BAK" WITH INIT

The database backend engine, then knows exactly how to handle such command.

The result is, a full backupfile, named ACCOUNTING_18112020.BAK, which gets created in the folder U:\BACKUPS,
which might be a networkdrive, or external USB disk, or other internal disk etc...
I cannot just copy the database files to U:\BACKUPS\, unless I shutdown SQL Server (and the files become "cold").

So, keep in mind that some business programs keeps files open, and just using commands like "copy", or using
OS graphical utilities (like file explorer), will not create consistent backups.
Often, you need utilities from the suite itself, or shutdown the service(s) of that App.

But the larger majority of datafiles on private machines, are Documents, Spreadsheets, pdf's, photo's,
or Dev. sources (.html, .php, C# sources etc.. etc..), which are all "cold", and can be copied
with ease, and no worries.

What is futher the topics in this section? How to create databackups, how to create a System Restore point,
how to create a System Image, how to repair boot entities, and how to restore backups.

7.2 This will be quite an Informal discussion:

When you dive into backup/recovery techniques, you will soon encounter terms as Retention period,
Full backups, Differential backups, Incremental backups, Snapshots etc..

Here you will see none of all that stuff. I'am not saying that it's good to leave that all that stuff.
But, I want a simple, but effective, method. I want a few decent and independent backups of my datafiles.
Indeed, this note is targeted for an "average", private, PC/Laptop user.

Maybe I am dumb, but I don't care about that. I like to play on safe, so let's say I have two independent USB disks,
and another PC (with a shared folder) on my network, which will also store backups of my (main) PC.
So, I have 3 backup locations. It's just an example.

You can also use a Storagefacility in the Cloud, but I advise to have local copies too.

So, we are not a large datacenter, and we just want a couple of independent backups.

Some recommendations: =>Especially to counteract ransomware: Ransomware is often able to ennumerate (discover) all storage you have available on your PC (like C:, D:, F:, U: etc..., and possibly even UNC paths). So, after a backup is Done, then (nicely) disconnect the backup device (like usb disk, or backup Server etc..). =>Also important: Having very recent backups is great. But keeping slightly older backups, (a few days old, a week old or so, all up to you) is highly recommended. =>Only rely on multiple media. For example, having only "1" backup device, is not good. =>It helps if you have "organized" (most) of your datafiles, in some main folder, and subfolders, where each subfolder contains some particular type of data, like: E:\DATA, and within E:\DATA, subfolders like E:\DATA\EXCEL, E:\DATA\PHOTOS, E:\DATA\ACCOUNTING, E:\DATA\MSWORD etc.. etc..

So, what you could do, for example, have one USB disk, which stores a week old backup, then backup
daily to the other USB disk. When a week has past, reverse the roles of those disks.
Then you always have backups of one week ago, together with very recent backups. Then, once in a while,
(say, every month), store backups at the backup server on your network. It's just a suggestion, no more.
You can figure out a simple roulation scheme, which suits you best.

7.3 Simple data backups:

Using the native "Microsoft Backup tool" is probably the best option to backup data.
Or, possibly, if you know how to use it, the well-known and very versitile "robocopy" utility.
However, I will illustrate the use of "xcopy" only. It's simple and practical.

=> Using xcopy to backup to e.g. an USB disk.

-I would love to discuss "robocopy", since it's a great backup tool, with enormous capabilities.
For such simple and small note as this one, time and space is a bit limited.
I can certainly advice to take a look at robocopy (it should already be on your systeem).
For example, it not only can copy, but also "sync" directory trees, and much more.

-Using the "Microsoft Backup tool". You can also follow Microsoft's recommendation for data backups.
It's probably the best option for data backup/restore. There are many webpages discussing this method,
so I will say nothing about it.
It's not only usable to backup files, but it can also keep a "history" of files as well.

I will do a step backwards (to xcopy), indeed a more primitive way, but which will always work,
on any version, on any Win PC.

-The standard tool "xcopy" is not so bad, actually. Next follows an illustrative example.
Suppose on a local disk (partition) E:, we have E:\DATA with subfolders. Suppose U: is
an external backup disk. Then by using, from the command prompt:

First, goto U: and if neccessary, create directory DATA.	U: cd\ md DATA
Goto the datadrive E: again, change to E:\DATA, and use "xcopy"	E: E:\> cd \DATA E:\DATA> xcopy *.* U:\DATA /S

E:\DATA> xcopy *.* U:\DATA /S

Do not forget the "S" switch with "xcopy", since this will make sure that all subfolders
in E:\DATA, will be copied as well to folders inside U:\DATA.
The command has many switches, also to copy new files only. However, this simple, maybe somewhat primitive syntax,
ensures a full copy from all what is in E:\DATA, is copied to U:\DATA.

It's quite the same, if you instead would use the File Explorer, and highlight E:\DATA,
rightclick, choose "Copy", then goto (highlight) U:\ (indeed the root), and choose "Paste".

I know that this is very simple, and somewhat primitive method, but it works, for small volumes of data,
and high volumes of data.

If the amount of files, or the total size, is really large, the third party tool "TeraCopy"
uses optimized algorithms for handling large volumes, or very large filesizes.

So, you have a way (via command prompt, or using the GUI) to backup all simple data objects to
a storage device as e.g. an USB disk.

Note for USB disks:
Most often they are formatted with the FAT32 filesystem. No problem in storing datafiles,
but FAT32 will not store the associated ACL's (the permissions). This is not a really large problem,
since if you restore to E:\DATA again, objects inherits the permissions of the the container (the folder).

To perfom a full restore, is exactly the other way around of the xcopy command shown above.

U:\DATA> xcopy *.* E:\DATA /S

In case of an attack, you should first have fully cleaned the system, and have removed all
encrypted files from the E:\DATA directory. Or just remove everything, and create E:\DATA again.
Then, perform the restore. Do not forget to check and adjust the NTFS permissions.

Remark: If you do not have backups, some folks say that you best backup the encrypted datafiles,
since you never know if a decryptor might become available at a later time.

Ofcourse, you can also copy just one file, or a selection of files, from "U:\DATA" to "E:\DATA",
or to another location. For example "U:\DATA\ACCOUNTING> copy june2019.xls E:\DATA\ACCOUNTING".
Here I simply used the standard "copy" command from the cmd prompt.

=> Using xcopy to backup to a newtworkdrive.

Ransomware is often able to ennumerate (discover) all storage you have available on your PC,
(like C:, D:, F:, U: etc..., and possibly even UNC paths).
So, that's also true for a "network drive", mounted on some shared folder on a Server (or other PC).
If you do a backup to a networkdrive, then after a backup is Done, then (nicely) disconnect
the networkdrive, or disconnect that Server (or the other PC) from the network.

You can do a similar action to a networkdrive (say F:), just like you did with the local USB disk.
Indeed, you can do everything from the GUI.

Let's see how you can do it From the command prompt. Suppose we have Server STARBOSS with a shared folder
"backups". Then the unc to that location is "\\STARBOSS\backups".

Suppose on STARBOSS the following account exists "STARBOSS\bckup".

Then you can try:

E:\DATA> net use * \\STARBOSS\backups /user:STARBOSS\bckup

Then STARBOSS asks for the password of the (local) account STARBOSS\bckup.

After you have entered the correct password, a drive letter returns, like say F:
Thus F: is now connected to \\STARBOSS\backups.

Now you can use the "xcopy" command, fully similar as we already have seen above:

E:\DATA> xcopy *.* F:\ /S

Or you can simply use the File Explorer for copy activities.

When ready making backups, delete the mount, e.g. via "E:\DATA> net use F: /delete"

For now, that's it about backing up data directories. It was all a bit primitive, maybe.
Ofcourse there are plenty nice backup/restore utilities. Maybe you like those better.
Or, maybe the cloud is your way to go.
The only keypoint is: have some good backups of your data.

Maybe you would say, that xcopy stuff, is stupid and from 1000 years back.
True, but it works. But..., Maybe you should see what the standard "Windows backup tool" has to offer,
if you don't know it already.
It's pretty simple, and works fine. I have nothing to write on the standard Windows backup tool:
It's practically too simple to work with (but it's quite good).

Indeed, if you take into consideration that what I listed above, is all manual actions.
It would be great if you could schedule a job for making backups. However, for a private user,
just manually kicking off backups, is not so bad either.

7.4 Creating a System Image:

A System Image is a snapshot of the Partition where Windows is installed on.
It can even be larger, by selecting more partitions when configuring this sort of backup.

So, it's usually a rather large sort of backup, taking up a lot of space.

-It's a good option for "Disaster Recovery" to recover the whole system.
-It's not indended for data backups (some datafiles, or data directories). For that, see section 7.3.

A smaller set of critical systemfiles and configuration, is called a "Restore Point".
A Restore Point is not equal to a System Image. A Restore Point is handy before new Apps
are installed, or before a patch is applied, or when you just want to have a reference point of the configuration
of the OS (including the Registry). On most Windows versions, it happened automatically, only on Win10,
you need to activate of having the creation of Restore Points automatically (somewhat strange really).

Me personally, am not particularly wild about a "System Image". However, having a reasonably recent version
available, could help out when your system dies (possibly by a serious diskfault or so, or by some ransomware which has
destroyed system files).

How good a System Image is for you, just depends. For me personnaly, reinstalling the OS, installing Apps,
and doing a bit of configuring, works good enough. Indeed, for me, only the "data" is Holy...
You know ofcourse that Albert is the author, so do be critical of whatever he writes..

So, you might have a complex configuration, with special applications, which are very difficult
or timeconsuming to install and configure. Then a System Image is really good.

Three more important points to consider:

- A system image should be stored on disk media, formatted with the NTFS filesystem, and not FAT32.
It's possible to use DVD's too (a bit old fashioned maybe). You can use a networkdrive as well.

- Restore from a system image goes via a boot of (a good or faulty) Windows, to a Recovery Environment.

- Creating a System Image, once every one, or two months, seems reasonable for a Private user.

How to create a System Image:

It depends bit on your Windows version. From Control Panel, you might find a Backup Applet, or File History applet,
or other applet, from which you can start to create a System Image.

How to Restore a System Image:

Usually, at the earliest boot time, you can go into "a special boot recovery menu".
Or, if Windows could not boot properly, it may automatically go to that recovery menu.

So, usually, we would have:

Recovery Menu -> Troubleshoot -> Advanced Options -> System Image Recovery

Repair Disk:

If you would have created a "Repair Disk", then you can also boot from that Disk (DVD, USB disk),
and a minimal Windows version starts up (WinRE), which will show a menu from which
you can also choose to perform a System Image Recovery.

It could be true, in some cases, that you first need to enter the BIOS, or UEFI Bios emulation,
and choose to boot from DVD or USB.

7.5 Creating a Restore Point:

From Control Panel, via the System applet, find the tab "System Protection".
The Items on this pane, all have to do with Restore Points, like creating a new one, or delete
older Restore Points, as well as to configure a drive/partition for allowing to create Restore Points.

In the same pane, you can apply an existing Restore point, in order to revert to the State of the OS
as it was, when that particular Restore Point was created.

It contains drivers, essential OS files, the Registry, and other info, which defines the state of the OS
at the time the Restore Point was created. But it's not a full System Image.

It generally can help if the install of some App patch, or App, or driver etc.. went wrong.
Restore Points are kept in a hidden folder called "System Volume Information".

Up to now, I am not aware, if a Restore Point was indeed ever helpfull in restoring a system after
a ransomware attack. Opinions may differ, but a Restore Point is generally not helpful in system damage.

Indeed, that's a difference with a complete restore using a "System Image", because then it's evident
it will restore a system, completely back to it's former state (at the time the Image was created).
Anyway, Restore Points helped me (and other users) to revive from misconfiguring systems.

This all is minimum info, indeed. Only if you didn't knew it existed at all, it was perhaps a bit helpful.
Maybe you like to do a thorough websearch on the in-and-outs of Restore Points.

-Opinions may differ, but I think it has been made likely, that Restore Points are no suitable means
against ransomware (in case systemfiles would be damaged)

-A Restore Point is more apt for situations when you want to RollBack from misconfigurations,
or installations which went wrong. It's not a full Restore of the System.

8. Some Repairs.

8.1 A few remarks on WinPE/WinRE:

WinPE and WinRE, both are a sort of "mini Windows" Operating system, with a kernel, some API's,
drivers, user environment etc.., and you can use them for a range of operations.

WinPE is short for "Windows Preinstallation Environment", and WinRE is short for "Windows Recovery Environment".

WinPE's purpose, is slightly more geared towards installations, while WinRE's purpose,
is slightly more geared for recovery.

Most folks say that WinRE is based on WinPE, including tools for Recovery.
From that viewpoint, they are very similar, with, in headlines, just an accent shift.

For quite some time, most machines comes with a Recovery Partition, from which you can boot to WinRE,
so many machines already "have it". WinPE on the oyher hand, must be downloaded and linked
from the ADK related Microsoft site.
Sometimes, Microsoft slightly alters the links and contents of the ADK ("Assessment and Deployment Kit"),
of which WinPE is part of. A small bit of a hassle, but not a real problem.

Let's say, that both are quite similar, and both can be used for recovery operations, like booting
from media having WinRE/WinPE, and then e.g. copy data from a broken bootdisk to another disk.

This fact has nothing to do with ransomeware, or bootrepair. Indeed, it could just happen that
your machine breaks down, and will not boot anymore. With a DVD, or USB, with WinPE, you can still
boot and try to copy data to healthy media.
So, having a bootable DVD or bootable USB, with WinPE, is certainly valuable.
Although te above is true, it is often more easy, in case of bootproblems, to boot to
the Recovery Environment (possibly automatically, or by 3 erroneous boots, or some keysequence),
and by using WinRE, reinstall an Image, or troubleshoot bootproblems.

As you will see below, WinRE, once booted, runs entirely from a "ramdisk". Furthermore, it has basic
support for WiFi and some more noteworthy properties.

8.2 The Recovery Environment (WinRE):

-If Windows failed to boot 3 times in a row, it "usually" (or should), start the Recovery Environment.
You could also press the reset (on/off) button, three times in a row.
-If Windows really could not boot, it should start the Recovery Environment, depending on the damage ofcourse.
-There are ways to manually enter the Recovery Environment, from a running Windows, by holding shift and
selecting "Restart button" (if you can find it...), or e.g., by using the shutdown command:

C:\> shutdown /f /r /o /t 0

------Intermezzo (if you are interested... But you can skip it if you want.):

Let's checkout if you have the Recovery Environment.

Usually, folks use the DISKPART, or MOUNTVOL tools, to assign a driveletter to the "Recovery Partition",
and once easily accesible, you can browse around, and quickly discover that you indeed have
a Recovery Partition, like seeing a large file like INSTALL.WIM (or other filename).

I like to do it this way, namely via the boot manager:

From a (elevated) command prompt, run:

C:\> bcdedit /enum

=> If you get back records like:

path..................\EFI\Microsoft\Boot\bootmgfw.efi (note this line)
path..................\Windows\system32\winload.efi (note this line)

Then your system uses UEFI (or EFI) type of pre-boot.

=> If instead you see:

path..................\Windows\system32\winload.exe (note this line)

Then the machine uses BIOS/MBR (UEFI-CSM) type of pre-boot.

Now try this command:

C:\> bcdedit /enum all

The "all" option, shows, among other stuff, the full boot entries of the boot manager
If you see lines like:

device..............ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim
path................\windows\system32\winload.efi
description.........Windows Recovery Environment
..
description.........Windows Recovery
ramdisksdidevice....partition=\Device\HarddiskVolume1
ramdisksdipath......\Recovery\WindowsRE\boot.sdi

then at least your boot manager is (or was) aware of a Recovery Partition. Ofcourse, in exceptional cases,
one (theoretically) could have deleted the Partition, possibly by not knowing it was good for.

I like to show the use of DISKPART, but I leave it out here. In quite a few articles, one might read
that the Recovery Partition is always the Partition with number "so-and-so".
That is not true. So, on your machine, it could possibly have any number.

On the Recovery partition, a lot of files might be present, like INSTALL.WIM, WinRE.wim,
and boot.sdi etc.. However, the Manufacturer of your PC/Laptop, might have choosen for another
sort of configuration, since all sorts of scripts implement the restore of the image.

On my Recovery Partition, I see an INSTALL.WIM file (Windows Image File), but you might see
other filenames. Let's see what is in it:

H:\RecoveryImage> dism /Get-WimInfo /WimFile:INSTALL.WIM
...
Deployment Image Servicing and Management tool
Version: 6.2.9200.16384

Details for image : install.wim

Index : 1
Name : Windows 10 Pro
Description : Windows 10 Pro
Size : 28,792,536,024 bytes>
...

So, it has an Image for Win10 Pro. It actually is a "capture", or snapshot, of a template machine,
of which the Manufacturer thougth is was a good model to install on multiple machines.
Anyway, it's very likely you have such "capture" too, on a (hidden?) Recovery Partition.

------End Intermezzo.

So, what is the Recovery Environment good for...?
After the machine boots to the Recovery Environment, on Win10 you see a screen similar
to the figure below:


Figure 1: Recovery Environment.




In all honesty, all the options shown, speak for themselves. For example, you can restore an Image,
or apply a "Restore Point" (not a full image), and other options like starting a command prompt,
or perform a "Startup Repair".

-When there were bootproblems, ofcourse you might first try the repair suggested by "Startup Repair".

-If "Startup Repair" did not helped us out, then we can try more advanced repair options,
by using the command prompt. See section 8.4.

8.3 Creating bootmedia:

In general, folks then quickly think about a DVD or USB disk/flashdrive.

=>DVD:

If your PC/Laptop has a DVD player, it's easy to create a Repair Disk containing WinRE,
and recovery options (including command prompt with boot repair commands).
However, DVD is much less popular compared to a few years back.
In Europe, so I observe, many modern PC's/Laptop's don't even have them no more.

To do so: Just start Control Panel, find the Backup applet, and search for "Create repair disk".
It's really that easy.

- You cannot only boot to the Recovery Environment, but also:
- After booting using the DVD, you can try to salvage datafiles in case the harddrive
really cannot boot nomore. For example, on the command prompt, you can "copy" or "xcopy"
files to healthy media.

=>USB:

(1). Some people advise a small but nice tool called Rufus. I think it's great too,
but especially if you want a bootable USB, together with an image of an Operating System (like Win10, Linux),
that you want to install on a target machine (for Windows you always need a license).
There are plenty sites explaining Rufus or similar tools.

(2). Here is another way (read the Warning):

You can download the "Media Creation Tool" which has as an option to "burn" a bootable Win10 setup usb,
with the intention to setup (a licensed) Win10 instance on a target machine.

Just Google around, in order to find the correct download page from Microsoft.

Once downloaded, you would have an executable with a name similar to "MediaCreationTool20H2.exe",
which enables you to install Win10 from USB, among other options.

Warning:
Be careful not to select the option "Install on this PC", but choose as destination the USB flashdrive.
This USB drive, needs to be at least 8GB, and all information which existed on it, will be gone,
so be sure it's a new USB flashdrive, or that it's OK to loose that information.

(3). Using "Deployment tools and Windows Preinstallation Environment".

In this subsection, we will create a bootable USB with Windows PE. This example is based on Windows 10.

Windows PE (or WinPE, and a similar OS called WinRE), is a "Thin OS", with basic functionality, like
having a kernel, NTFS/FAT drivers, mass-storage drivers, networking functionality, and some API's.
What's more, after the PE boot, it runs from a RAM disk in memory. So, you could even change the USB,
for another USB stick.

In case your machine seems completely lost, you might boot using this USB stick, and access
Disk partitions which are still good, to save data.

Step 1:

Make sure you have a (reasonably modern) USB stick of sufficient size, like 6GB or 8GB.

You do not need to use DISPART to create partitions, or do anything else with this USB.

Step 2:

Download the Windows 10 "Deployment tools and Windows Preinstallation Environment".

For Windows 10, you might try (I hope that this link remains valid...):

Download and install the Windows ADK.

You can select what to download, but in fact the Windows Preinstallation Environment is good enough.

Step 3:

We are next going to use a few commandline scripts. The first one ("copype") will create a directory on your harddisk
and copy/unpack the neccessary files to that directory.
The second one ("MakeWinPEMedia"), formats the USB stick, writes a bootrecord on the USB, and copy the neccessary files
(from that directory which "copype" used) on that USB drive. That's all, actually.

Remember, this example is for Win10. For Win8, Win7, it's quite similar, but not entirely the same procedure.

From the "Start menu", run "Deployment and Imaging Environment" icon.
Basically, it starts a CMD prompt, but some essential environment variable are set too.

From this location (in my example, it can be slightly different in yours):

C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment>

Run:

copype x86 c:\winpe

In my case I have x64 machines, but in the mindset of "copype", x86 and x64 is all collected in the parameter "x86".
Also, on the commandline I told "copype", to place the objects in "c:\winpe".

After "copype" is ready, next run:

MakeWinPEMedia /UFD c:\winpe H:

where (in my case) H: is the drive letter associated with the USB drive.

In the "MakeWinPEMedia" session, we will see:

WARNING, ALL DATA ON DISK DRIVE H: WILL BE LOST!
Proceed with Format [Y,N]?Y
Formatting H:...

Setting the boot code on H:...

Copying files to H:...

Success...

So, we managed to create a bootable (Win10 based) "Windows PE" environment, which will boot
into a graphical "mini" Windows, which per default will also start a cmd window.
It's pretty cool to have a bootable USB, with full disksupport.

In case you have a BIOS machine, (or BIOS/UEFI or UEFI-CMS machine), in setup, you can change the order
of bootable devices. For testing purposes, you can put USB as the first bootable candidate.

8.4 Using commands for bootrepair:

9. An example ransomware attack with encryption:

Still busy selecting a reasonable example, for analysis. And still busy with the "body" of this section.

I am certainly not deep into Cryptography, but I know of a few elementary facts. Hopefully you know them
as well. If not, you can try one of my other simple notes first. Then you can take a look at this note.
Then pay special attention to the chapters 1 and 3 of that note, covering some basics of sym and asym encryption,
and it says something about AES and RSA.

=>Suppose you are a ransomware "developer" (criminal), then would you not like to use asymmetric encryption?
For example, you could use one key of the pair to encrypt the files, and you would not care at all
if researchers would find that key. Because they need the other key of the pair, to decrypt the files.
But that key is completely out of reach, because it may exist at some Control Server, or somewhere else
which makes it inaccessible.

If this would have been setup in a rather primitive way, then absolutely some hurdles exists.
First, asymmetric encryption is pretty slow, and secondly, a hardcoded asym key is rather long and might "stands out"
in the entity (like a file) which represents the ransomware executable.

=>Another approach might be, that once the malware is activated, it may request a Public key from
a Control Server. Next, it creates an AES symmetric key, which it uses for the encryption of files.
This process is relatively fast. Once it is done, I will encrypt the AES key, with the the former Public key,
which makes the symmetric unaccessible and not usable for decryption.

Especially since 2013 (likely after the original Cryptolocker malware, of 2013), slightly different
approaches exists among the "newer" ransomware variants.

10. Appendices.

10.1 Specifics of the Top 20.

There exists lots of ransomware, at least a couple of hundreds identifyable instances.
Some good analyses speak of around 900 - 1000 variants today.

I personally am particularly interested in how to "undo" the damage, using a decryptor, if one
is available. Next, I want to know which exploit they used (if any), and/or how
they got elevated privileges (if any).

Ofcourse, the used file extensions (after encryption) are important too, since it may help in
identifying the malware, and thus the possible decryptor key, if it exists.

Table 4.

1. STOP:

=>Synonyms:
DJVU

=>File extensions after encryption:

=>Possible Related executables:

=>Most active period:

=>Created file system objects:

=>Used exploit(s) (if any):

=>Using external Servers (download):

=>Encryption:

=>Targets:

=>Further description:

=>Decryptor:

=>Possible Solution, if you do not have data backups:

2. Wannacry Ransomware:

=>Synonyms:
Wcry, WannaCry, WanaCrypt0r, WCrypt, WCRY: using the NSA discoverd EternalBlue exploits and variants (?)

=>File extensions after encryption: Often: .WNRY, .WNCRY, .WNCRYT, .WRCY

=>Possible Related executables:
wnry.exe, wcry.exe, wcrydl.exe, wannacry.exe, taskhsvc.exe (=TOR server)
=>Most active period:
2017, 2018
=>Created file system objects:
Possibly a folder in Program Files\RAND_install_STRING
Possibly a working folder is created like [random number].WNCRYT
Ofcourse the encrypted datafiles.
=>Using exploit(s):
CVE-2017-0144
SMB exploits, among others.
One important delivery vector was the option
of Anonymous user (null session),
=>Using external Servers (download):
Yes, using TOR
=>Encryption:
Using WinApi + third party
for using RSA and AES algorithms
=>Targets:
Initially: XP, Win2K3
Without MS17-010, higher Windows versions might be victim too.
It turned out that Win7 systems were massively infected.
=>Further description:
Wcry will enummerate all local and network drives mounted on the system.
Where is access, encryption of datafiles follows.
Exploit Resolved with MS17-010.
Newer and patched systems: likely no problems expected.
However "copy-cats"/"variants" will likely to remain.
=>Decryptor:
I have not found a complete solution. But that does not say anything, ofcourse.
=>Possible Solution, if you do not have data backups:
Immediately after infection, do not reboot the system.
Please see: Blog Malwarebytes discussing options.

3. Clop Ransomware:

In fact a series of ransomware variants, resemble the "clop" model.
It's a very dangerous one, and it seems that here too (nov. 2020) no decryptor is available.

So, "clop" is actually a number of similar variants. Also, browsing through some tech analyses,
it seems to me that the Clop variants are all quite similar to "Ryuk" ransomware.
For example, both try to stop hundreds of Windows services (using "net stop" commands),
and try to "kill" Shadow storage by "vssadmin" commands.
Also the encryption module seems very similar.
Both are a rather remarkable combintion of .bat and exe commands (or functions).

Some articles say that Ryuk is delivered as a payload of the Emotet and Trickbot malware,
or other malware. It's likely that the "clop" variants are delivered in a similar manner.

=>Synonyms/variants:
Ransom.Win32.CLOP.THBABAI
Ransom.Win32.CLOP.D
Ransom.Win32.CLOP.E
Ransom.Win32.CLOP.I
Ransom.Win32.CLOP.B
Ransom.Win32.CLOP.K
Ransom.Win32.CLOP.L
Ransom.Win32.CLOP.C
Ransom.Win32.CLOP.A
Ransom.Win32.CLOP.F

=>File extensions after encryption: Often, or exclusively sofar: .clop

=>Possible Related executables:
Files in name similar too this example: "C:\users\Admin\AppData
\Temp\Ransom.Win32.CLOP.dd8b499da9cafd369bc5dfbf18749f8dc5c1da8b.exe" .

=>Most active period:
since early 2019, and still very active.
=>Created file system objects:
Not yet known to me.
=>Using exploit(s):
Not yet known to me.
=>Using external Servers (download):
Not yet known to me.
=>Encryption:
RSA
=>Targets:
In principle any Windows machine.
=>Further description:
=>Decryptor:
I have not found a any solution or decryptor. But that does not say anything, ofcourse.
=>Possible Solution, if you do not have data backups:
Not available.

Still busy with Table 4. It's not really that interesting
for a reader, except if I would have seen a decryptor for a certain ransomware.

Still busy...

---

Hope that you had any use of it....

---

EOF.



;