[SOLVED] Infected hand-me-down laptop

[Wering1974]

I received an old Dell and noticed it was infected, including the Ramnit trojan. I am unable to complete a scan using either Defender or MBAM.


Two questions:

1. Will restoring to factory settings purge the infections?
2. It's currently running Windows 10, which I suspect is a cracked version. Will I still be restore the laptop to its original OS (Windows 7) then upgrade it again to 10?

Thanks!

[Corday]

Start by restoring from the Recovery Partition. You'll know the whole story.

[VividProfessional]

any new pc that comes into my possession I am to keep or sell on gets formatted (using dban) and a nice clean partition setup with the relevant version of windows.

[Corday]

VP & Deejay: The OP mentioned a cracked version. As an OEM unit he might or might not have a key sticker and if a recovery partition existed it would be a good start, After this he could upgrade and with V1909 available soon, it will take the same time as going clean with 1903 then upgrading. All this is assuming he can prove he has the right to a free copy of Windows 10.

[Deejay100six]

Ramnit pretty much disappeared back in the day but looks like it made a comeback.

If I remember rightly from malware training, Ramnit was unfixable and the only solution was to wipe the drive and start from scratch.

[Corday]

If the Recovery Partition is unmounted, Malware can't get to it.

[VividProfessional]

v1909 is available now, my machines at home downloaded it last night

[Wering1974]

Thank you all for the input. Here's what I can add:

1. I checked the laptop against Dell's website, it came pre-installed with Win7.
2. I found the recovery partition.

So (more) questions please:

1. I'm not that techy but can I assume the recovery partition is mounted since I can view it in Disk Management?
2. If it is, does it mean I need to reformat and do a fresh install?

[Gary R]

Ramnit is a file infector virus, not a trojan.

If infected, the only viable solution is to reformat.

Instructions for how to recover a Dell machine from its recovery partition on W7 machines can be found at ... https://www.dell.com/support/article...n-your-dell-pc

Once you have reinstalled Windows 7 it will need to be updated immediately, as the version you will now have installed will be a copy of the one that the machine originally had installed when it left the factory.

Do not browse the Internet until you are fully up to date.

[Wering1974]

I stand corrected.

That said, Ramnit is one 4 or 5 infections on the machine. Is the recovery partition safe from those?

Corday mentioned that if it's unmounted, it should be safe.


Since I cannot see it from My Computer and only through Disk Management, does it mean it's unmounted and safe to use?


Thanks.

[Wering1974]

BTW, since I connected the machine to my wifi at home, does this mean the rest of my machines have been infected as well?

[Corday]

Depends on whether you share files etc.

[Wering1974]

Originally Posted by Corday

Depends on whether you share files etc.

No, none shared from that machine.

You mentioned something about the recovery partition being unmounted. I do not see it in File Explorer. Does this mean it is unmounted?

[Gary R]

An infection is only ever active when your OS is booted.

Your Recovery Partition can usually only be accessed when your OS is not booted.

So, the only time you can access your Recovery Partition is when your infection is inactive.

That means, that infected files do not usually transfer between the Partition on which the OS is located, and the Recovery Partition.

It's possible, but you really have to go out of your way to do it, and the chances are excellent that the files on your Recovery Partition are exactly as they were when the manufacturer put them there.

The same cannot be said about infected files transferring across a Network I'm afraid.

If you haven't already done so, disconnect your infected machine from your Network, and then scan all the other machines on your Network with an AV scan.

If anything is found on any of the other machines, post back here, and we'll talk you through what needs to be done.

[Wering1974]

Thank you Gary. I will do as advised.

I also read that Ramnit can affect the master boot record. Will the recovery process fix that as well?

[Gary R]

Originally Posted by Wering1974

Thank you Gary. I will do as advised.

I also read that Ramnit can affect the master boot record. Will the recovery process fix that as well?

Yes it will.

[Wering1974]

Thank you Gary.

[Wering1974]

Originally Posted by Gary R

Instructions for how to recover a Dell machine from its recovery partition on W7 machines can be found at ... https://www.dell.com/support/article...n-your-dell-pc

I cannot pull up this screen so I followed the Windows 10 instructions instead:
https://www.dell.com/support/article...97920/en#WinRE


However, I do not have the option Factory Image Restore. I only have the following under Troubleshoot:

1. Reset this PC
2. Advanced options
   • Startup Repair
   • Startup Settings
   • Command Prompt
   • Uninstall Updates
   • UEFI Firmware Settings
   • System Restore
   • System Image Recovery

When I try to activate Windows, I see this error code: 0x8007007B. And as expected, it is referencing a different product key. It also refers me to an "organization's active server."




I have the product key (for Windows 7) that came with the machine. Should I just use DBAN to wipe and reinstall Windows 7 then upgrade to Windows 10?


I also found this resource:
https://www.microsoft.com/en-us/soft...oad/windows10/


Does that still work?

Thanks in advance!

[Gary R]

If you want to follow the instructions for W10, then you could select the Reset this PC option in the Troubleshoot Window.

This should re-install Windows 10. If you use this method you should not normally need to re-activate W10, since it should self-validate itself during the reset process.

See ... https://www.lifewire.com/reset-this-pc-2626216 ... and ... https://www.lifewire.com/reset-this-...hrough-2624538

[Wering1974]

Originally Posted by Gary R

If you want to follow the instructions for W10, then you could select the Reset this PC option in the Troubleshoot Window.

This should re-install Windows 10. If you use this method you should not normally need to re-activate W10, since it should self-validate itself during the reset process.

See ... https://www.lifewire.com/reset-this-pc-2626216 ... and ... https://www.lifewire.com/reset-this-...hrough-2624538

Is the Windows 7 OEM license already dead? I cannot use that anymore?