Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ransomware Removal Problem


  • Please log in to reply
11 replies to this topic

#1 izombie616

izombie616

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:18 AM

Posted 01 October 2014 - 09:44 AM

Hello, I have a computer infected with the ICE cybercrime ransomware and I am trying to use the hitmanpro kickstart to fix it. My problem is when I go to create the kickstart USB the program does not recognize that I have a USB plugged in. It just stays on step 1, insert USB drive. I have tried disconnecting and reconnecting the drive and still nothing. The drive has files on it, and the driver is up to date.  Its a 4GB 2.0 flashdrive and its the only one I have, but could this be why it wont register the USB? 



BC AdBot (Login to Remove)

 


#2 xXToffeeXx

xXToffeeXx

    Bleepin' Polar Bear


  • Malware Response Instructor
  • 6,087 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:The Arctic Circle
  • Local time:01:18 PM

Posted 01 October 2014 - 10:06 AM

Hi izombie616,

 

What operating system is the infected computer running?

 

xXToffeeXx~


~If I am helping you and you have not had a reply from me in two days, please send me a PM~

 

logo-25.pngID Ransomware - Identify What Ransomware Encrypted Your Files [Support Topic] - If we have helped you out and you want to support what we do, you can do so here

 

 ~Twitter~ | ~Malware Analyst at Emsisoft~


#3 izombie616

izombie616
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:18 AM

Posted 01 October 2014 - 04:07 PM

Um I believe windows 7. Not sure if its 32bit or 64bit but it wouldnt let me use the 32bit anyway because the laptop I'm trying to make the flash drive on is 64. 



#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,077 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:18 AM

Posted 01 October 2014 - 06:04 PM

You should download the HitmanPro.Kickstart version that corresponds to the bit-type of the Windows version you will be using to download and create the Kickstart USB drive before using it on the infected computer.



This is a quote from one of the developers of HitmanPro.Kickstart...

The Kickstart flash drive always contains both the 32bit and 64bit versions of HitmanPro. During the boot process it is determined what type of Windows is on the (infected) machine, and the proper version of HitmanPro is selected. This way, you can use the same Kickstart flash drive on different versions (32 / 64 bit / XP / Vista / Win7) of Windows.
 
So during creation of the flash drive it is not important to know what version of Windows is on the infected machine you are about to use the flash drive for.
Hitmanpro on USB FLash drive help? - Post #7 by Edwin Engels (eengels)

Are you sure you want to use a 4GB 2.0 flash drive? When using HitmanPro.Kickstart, the USB flash drive will be formatted and all necessary files will be retrieved from the HitmanPro servers and written to the flash drive. HitmanPro.Kickstart's installer writes proprietary code to the MBR so the usb drive cannot be reformatted until the MBR is rebuilt.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 izombie616

izombie616
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:18 AM

Posted 01 October 2014 - 07:18 PM

I originally downloaded the 32-bit, but when I went to open it, it said that I am using a 64-bit and it took me to the download page but did not open the program. So I just downloaded the 64-bit. And I dont usually use flash drives so I dont mind the files being erased. The files on it were just to confirm that the thing works.



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,077 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:18 AM

Posted 01 October 2014 - 07:31 PM

Ok.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 izombie616

izombie616
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:18 AM

Posted 01 October 2014 - 07:32 PM

But the main thing is, whether 32 or 64 bit, the USB isnt showing up to make the kickstart USB. And I'm not sure how to fix it and I havnt found that problem anywhere else. It shows up on my computer, I can add files and whatever, it just wont show up in the program.



#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,077 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:18 AM

Posted 01 October 2014 - 07:36 PM

If you encounter problems using HitmanPro.Kickstart, please Contact HitmanPro Support directly.

Erik Loman (erikloman) and Edwin Engels (eengels) are two SurfRight Reps. who visit BC on occasion to answer questions and provide assistance.
- Edwin can be contacted by email at edwin@surfright.com
- Erik can be contacted by email at erik@surfright.nl

As SurfRight Reps, they would be far more familiar with any issues encountered using HitmanPro than any of our staff or forum members. Both have been very helpful to every one I have referred to contact them.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 izombie616

izombie616
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:18 AM

Posted 01 October 2014 - 08:07 PM

Ok, I will contact them. Thank you.



#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,077 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:18 AM

Posted 01 October 2014 - 08:13 PM

You're welcome and good luck. Feel free to post back if HitmanPro.Kickstart doesn't do the job.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 izombie616

izombie616
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:08:18 AM

Posted 06 October 2014 - 05:51 PM

I never got the flashdrive to work, but I just used the rKill program on a disc to shut down the ransomware and downloaded hitman pro onto the infected computer. All better now.



#12 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,077 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:08:18 AM

Posted 06 October 2014 - 05:56 PM

Sometimes persistence pays off.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users