Software

Ask Software Development Questions and Get Answers ASAP

Ask a Computer Expert,
Get an Answer ASAP!

Just like 2 days ago my system was hacked by something

Customer Question
Hi, Just like 2 days ago...
Hi,
Just like 2 days ago my system was hacked by something called Sigma Ransomware. I thought this was no big deal for the last couple days because I could pretty much do what I've been doing. Until today my files seem to be messed up or inaccessible, at least some of them. Not even positive my screenshot will show. Let me know. Can you please help me? I don't even care if you have to login to my computer...anything please!!
Submitted: 1 month ago.Category: Software
Show More
Show Less
Ask Your Own Software Question
Answered in 6 hours by:
3/16/2018
Software technician: Eric Ewing, IT Pro replied 1 month ago
Eric Ewing
Eric Ewing, IT Pro
Category: Software
Satisfied Customers: 333
Experience: I am a technology professional with 20 years experience, and hold 15 industry certifications (from hardware/software repair to mobility to IT Security, and everything in-between!).
Verified

Hi! I'm Eric, a tech expert who's been paired with you through JustAnswer.com. I'm reviewing your question now, and will return w/ an answer soon!

Ask Your Own Software Question
Software technician: Eric Ewing, IT Pro replied 1 month ago

I am so sorry to hear this has happened to you!

Here's something we can try:

1 During your computer start process, press the F8 key on your keyboard multiple times until the Windows Advanced Options menu appears, and then select Safe Mode with Command Prompt from the list and press ENTER.

2. When Command Prompt mode loads, enter the following line: cd restore and press ENTER.

3. Next, type this line: rstrui.exe and press ENTER.

4. In the opened window, click "Next".

5. Select one of the available Restore Points and click "Next" (this will restore your computer system to an earlier time and date, prior to the SIGMA ransomware virus infiltrating your PC).

6. In the opened window, click "Yes".

7. After restoring your computer to a previous date, download and scan your PC with recommended malware removal software to eliminate any remaining SIGMA ransomware files.

To restore individual files encrypted by this ransomware, try using Windows Previous Versions feature. This method is only effective if the System Restore function was enabled on an infected operating system. Note that some variants of SIGMA are known to remove Shadow Volume Copies of the files, so this method may not work on all computers.

To restore a file, right-click over it, go into Properties, and select the Previous Versions tab. If the relevant file has a Restore Point, select it and click the "Restore" button.

If you cannot start your computer in Safe Mode with Networking (or with Command Prompt), boot your computer using a rescue disk. Some variants of ransomware disable Safe Mode making its removal complicated. For this step, you require access to another computer.

To regain control of the files encrypted by SIGMA, you can also try using a program called Shadow Explorer. More information on how to use this program is available here.

If the above steps don't get the job done, I regret to say that your files may be very difficult to recover. SIGMA uses the RSA-2048 encryption algorithm, which generates public (encryption) and private (decryption) keys. Since restoring files without the private key is impossible, criminals hide it on a remote server and demand a ransom to receive it. The cost of the decryption key and associated tool is $1000 in Bitcoins, however, the message also states that the cost will double after seven days. To submit payment, users are encouraged to visit SIGMA's Tor website and follow instructions provided. Note is that users can use a XAMP live chat to contact cyber criminals. They are also permitted to send several files to SIGMA's developers. The criminals then decrypt these files and return them as a 'guarantee' that decryption is possible. Bear in mind, however, that cyber criminals cannot be trusted. These people often ignore victims, once payments are submitted. There is no guarantee that your files will ever be restored and you will probably be scammed. Paying will simply support cyber criminals' malicious businesses and you will receive nothing in return. Therefore, we strongly advise you to ignore all requests to contact these people or pay ransoms. Unfortunately, there are no tools capable of cracking RSA-2048 cryptography and restoring files compromised by SIGMA. The only option is to restore files/system from a backup.

Ask Your Own Software Question
Customer reply replied 1 month ago
Let me work on this and I will let you know. Did I do something wrong to let this in? Did I open something wrong? Did I not use the right software virus protection?
Software technician: Eric Ewing, IT Pro replied 1 month ago

This particular virus ordinarily spreads via Craigslist or via an email purporting to be from Craigslist. Had you recently been using Craigslist? If not, I'll try and figure out if it has begun spreading via another method.

Ask Your Own Software Question
Customer reply replied 1 month ago
I use craigslist all the time to advertise my properties. Would it be from the site or by clicking on a response from an evil player off the site?
Software technician: Eric Ewing, IT Pro replied 1 month ago

Most likely the latter, since reports of this malware do not reflect a widespread issue.

Ask Your Own Software Question
Customer reply replied 1 month ago
Eric, unfortunately I got hung up on step 1 - the F8 button didn't do anything. Isn't there a way to just type like cmd somewhere or something to get that command prompt box or something? I restated the computer and kept hitting F8 or then CTRL F8 but neither worked.
Customer reply replied 1 month ago
I have windows 10 - does hitting the F8 button work on that?
Customer reply replied 1 month ago
Eric, where did you go? Need you! :-)
Software technician: Eric Ewing, IT Pro replied 1 month ago

Apologies! I've only just seen your response. Please try this to get to a command prompt on Windows 10:

The easiest way to begin the process of booting into Safe Mode with Command Prompt is from the Windows 10 login screen. To access this screen, you can either log out, reboot your computer, or press the Ctrl+Alt+Delete keys a the same time.

Once you are at the Windows 10 sign-in screen, you should hold down the Shift key on your keyboard and not let it go. While holding down the Shift key, click on the Power button () and then click on Restart.

When Windows 10 restarts, you will be at the Choose an Option screen.

Click on the Troubleshooting button to access the Troubleshoot options screen.

Now click on the Advanced Options button to access the Advanced Options screen.

Click on the Startup Settings option and you will now be presented with the Startup Settings screen.

Click on the Restart button. Windows will now begin to start, but you will be presented with a screen that provides various options you can select to specify how Windows should be started.

At this screen you should press the number 6 key on your keyboard to enter Safe Mode with Command Prompt.

Windows 10 will now boot and you will be presented with the normal login prompt. Enter your password, and you will be brought directly to a Windows Command Prompt rather than the normal Windows desktop.

From this prompt you can enter commands that you wish to execute, per step #2 in the original directions. Please let me know if that works!

Ask Your Own Software Question
Was this answer helpful?
Ask Eric Ewing Your Own Question
Eric Ewing
Eric Ewing
Eric Ewing, IT Pro
Category: Software
Satisfied Customers: 333
333 Satisfied Customers
Experience: I am a technology professional with 20 years experience, and hold 15 industry certifications (from hardware/software repair to mobility to IT Security, and everything in-between!).

Eric Ewing is online now

A new question is answered every 9 seconds

How JustAnswer works:

  • Ask an ExpertExperts are full of valuable knowledge and are ready to help with any question. Credentials confirmed by a Fortune 500 verification firm.
  • Get a Professional AnswerVia email, text message, or notification as you wait on our site. Ask follow up questions if you need to.
  • 100% Satisfaction GuaranteeRate the answer you receive.

JustAnswer in the News:

Ask-a-doc Web sites: If you've got a quick question, you can try to get an answer from sites that say they have various specialists on hand to give quick answers... Justanswer.com.
JustAnswer.com...has seen a spike since October in legal questions from readers about layoffs, unemployment and severance.
Web sites like justanswer.com/legal
...leave nothing to chance.
Traffic on JustAnswer rose 14 percent...and had nearly 400,000 page views in 30 days...inquiries related to stress, high blood pressure, drinking and heart pain jumped 33 percent.
Tory Johnson, GMA Workplace Contributor, discusses work-from-home jobs, such as JustAnswer in which verified Experts answer people’s questions.
I will tell you that...the things you have to go through to be an Expert are quite rigorous.

What Customers are Saying:

My Expert answered my question promptly and he resolved the issue totally. This is a great service. I am so glad I found it I will definitely use the service again if needed.

One Happy CustomerNew York

Wonderful service, prompt, efficient, and accurate. Couldn't have asked for more. I cannot thank you enough for your help.

Mary C.Freshfield, Liverpool, UK

This expert is wonderful. They truly know what they are talking about, and they actually care about you. They really helped put my nerves at ease. Thank you so much!!!!

AlexLos Angeles, CA

Thank you for all your help. It is nice to know that this service is here for people like myself, who need answers fast and are not sure who to consult.

GPHesperia, CA

I couldn't be more satisfied! This is the site I will always come to when I need a second opinion.

JustinKernersville, NC

Just let me say that this encounter has been entirely professional and most helpful. I liked that I could ask additional questions and get answered in a very short turn around.

EstherWoodstock, NY

Thank you so much for taking your time and knowledge to support my concerns. Not only did you answer my questions, you even took it a step further with replying with more pertinent information I needed to know.

RobinElkton, Maryland

< Previous | Next >

Meet the Experts:

Jess M.

Jess M.

Computer Support Specialist

670 satisfied customers

Computer Software Support specialist for more that 10 years

Chris L.

Chris L.

Support Specialist

505 satisfied customers

Certified Software expert with over 10 years experience.

IT Miro

IT Miro

Computer Scientist

497 satisfied customers

Bachelor's Degree in Information Technology, Microsoft Certified Professional

Jins M. N.

Jins M. N.

Computer Hardware Engineer

463 satisfied customers

12+ years experience. Expert in installing and problem fixing of softwares.

Kamil Anwar

Kamil Anwar

Software Specialist

456 satisfied customers

8+ Years of Experience. / CCNA (S), CCNA (W), CCNA (RS), MCTS, MBCs.

Steve Herrod

Steve Herrod

Computer Support Specialist

220 satisfied customers

Familiar with a wide variety of software and experienced in user training/support

Byron

Byron

Computer Support Specialist

164 satisfied customers

12 years in operations at a large law firm supporting both retail and specialty applications.

< Previous | Next >

Related Software Questions
I haven't used my Skype account in years figured out the
I haven't used my Skype account in years figured out the email reset the password ***** still can't get in tried to get in using my phone number it doesn't work try to create a new account it says pho… read more
Pete
Pete
Engineer
Bachelor\u0027s Degree
1,129 satisfied customers
Trying to add a signature page document to the original
Trying to add a signature page document to the original document not containing my signature page at the end of the document … read more
Michael Rademacher
Michael Rademacher
MBA
4 satisfied customers
I'm trying to create a page for JEWELELS BY CYNDI I'm trying
hello, I'm trying to create a page for JEWELELS BY CYNDI I'm trying to create a page from my primary FB account … read more
Jeevan DSouza
Jeevan DSouza
Professor
PhD
3 satisfied customers
I have a question about skype Not sure for it works and have
Hi I have a question about skype Not sure for it works and have a meeting on Monday … read more
David L.
David L.
Bachelor\u0027s Degree
6 satisfied customers
My gmail account was, I changed it to. I tried to reset my
Hi, my gmail account was***@******.***, I changed it to***@******.***. I tried to reset my password ***** i can't, because your asking for the new password ***** the original gmail account that has th… read more
Steve Asher
Steve Asher
AAS Network Infrastructure
55 satisfied customers
My facebook account was hacked & I am now blocked out of it?
my facebook account was hacked & I am now blocked out of it? … read more
Richard
Richard
IT Manager
IT Manager, Consultant
3,395 satisfied customers
Are you an agent for Paypal? I cannot remember! I have buy a
Yes, I need to have a question to Paypal return funds… read more
Jeevan DSouza
Jeevan DSouza
Professor
PhD
3 satisfied customers
My asus since i 1st purchased it will not load windows 7, a8
my asus since i 1st purchased it will not load windows 7 … read more
Mr.Med
Mr.Med
1,045 satisfied customers
When I try to record my speech using cool edit pro a pop up
When I try to record my speech using cool edit pro a pop up comes up and read: A device has been used that is out of range for your system. I have been using cool edit pro for years on a weekly basis.… read more
David L.
David L.
Bachelor\u0027s Degree
6 satisfied customers
Which Adobe Elements program supports Canon 80D raw files? I
Which Adobe Elements program supports Canon 80D raw files? … read more
Eric Ewing
Eric Ewing
IT Pro
333 satisfied customers
I am trying to create a photo album slides with music using
I am trying to create a photo album slides with music using a software other than powerpoint. Is there a free software like movie maker for Windows 10?… read more
Jeevan DSouza
Jeevan DSouza
Professor
PhD
3 satisfied customers
Are you a NORTON personnel? I have Norton anti virus yearly
I get this message from Norton's your data is at rick and then it says fix it which do but it doesn't back up is the item ay risk it seems everything is ticks with a green sign except that … read more
Michael Rademacher
Michael Rademacher
MBA
4 satisfied customers
I am having problems with Word and Excel. I'm running 10. I.
Hi, I am having problems with Word and Excel. I'm running 10. I … read more
Michelle
Michelle
Manager operations
Bachelor\u0027s Degree
1,276 satisfied customers
I forgot my password. Pic windows 10. Gateway have no idea
I tried to get a code, but my landline phone do not accept messages. I am working now with ipad … read more
Richard
Richard
IT Manager
IT Manager, Consultant
3,395 satisfied customers
I bought 30:00 of tokens for gsn grand casino game and lost
I bought 30:00 of tokens for gsn grand casino game and lost them, Apple tells me they are still there on face book, how can I retrieve them … read more
David L.
David L.
Bachelor\u0027s Degree
6 satisfied customers
Trying to see if any updates to Dragon 15.00.000.076. Serial
trying to see if any updates to Dragon 15.00.000.076 … read more
David L.
David L.
Bachelor\u0027s Degree
6 satisfied customers
I cant find my product key. Asus model number,
as of today trying to set up my logitech surveillance … read more
Mike Taylor
Mike Taylor
42 satisfied customers
I lost Skype connection with my people in Moscow.I Comcast
I lost Skype connection with my people in Moscow.I Comcast yesterday, he came, observed my PC, made a telephone call and reported that my Skype connection is BLOCKED, and it will be restored next day,… read more
arsufi2002
arsufi2002
Bachelor's Degree
322 satisfied customers
Disclaimer: Information in questions, answers, and other posts on this site ("Posts") comes from individual users, not JustAnswer; JustAnswer is not responsible for Posts. Posts are for general information, are not intended to substitute for informed professional advice (medical, legal, veterinary, financial, etc.), or to establish a professional-client relationship. The site and services are provided "as is" with no warranty or representations by JustAnswer regarding the qualifications of Experts. To see what credentials have been verified by a third-party service, please click on the "Verified" symbol in some Experts' profiles. JustAnswer is not intended or designed for EMERGENCY questions which should be directed immediately by telephone or in-person to qualified professionals.

Disclaimer: Information in questions, answers, and other posts on this site ("Posts") comes from individual users, not JustAnswer; JustAnswer is not responsible for Posts. Posts are for general information, are not intended to substitute for informed professional advice (medical, legal, veterinary, financial, etc.), or to establish a professional-client relationship. The site and services are provided "as is" with no warranty or representations by JustAnswer regarding the qualifications of Experts. To see what credentials have been verified by a third-party service, please click on the "Verified" symbol in some Experts' profiles. JustAnswer is not intended or designed for EMERGENCY questions which should be directed immediately by telephone or in-person to qualified professionals.

Show MoreShow Less

Ask Your Question

x