Help! Ransomware destroyed my data, including Win 10 Pro OS. No HP Restore programs are working.

[kmpres]

Help!  Ransomware has destroyed my data!  Win 10 also erased.  Accidentally cleaned the hard drive without realizing it would take away the OS. My one and only backup image, on a WD Passport USB drive, won't restore without the OS, and because most of my software was downloaded, I have NO CD backups of anything, including OS.

All the data in my HP Probook 4730s is now gone. OS is gone and HP utilities also gone. I dutifully created a Win 10 Recovery USB stick but all it gives me are the Win 10 restore options, none of which work without an OS installed.  I tried them all and they either report no OS and abort or that the saved backup image OS (Win 10) is different from the factory image OS (Win 7 64-bit Ultimate) and then aborts.  What's up with that??  My system was completely cleaned out so why would the old factory installed OS conflict with the upgraded OS when both of them no longer exist?? 

If my HP utilities won't work and I have no operating system, how do I fix this??  I'm dead in the water so, please, any help you can provide will be GREATLY APPRECIATED!

PS:  My 10-year-old HP Pavillion G50 must now serve as download dummy until this is resolved.  Its a good system but its shackled by Vista and has numerous OS issues of its own.

Thanks! 

[ichi730]

Hi,

If you live within US and your computer is under warranty. You could call HP at 1800-474-6836. Kindly ask for a recovery media and explain properly what happened so they could document your case and provide what you need.

Regards..

[WAWood]

kmpres

According to the HP Product Page for your PC, it came preinstalled with Win7, not with Win10.

So, even though you must have done the Win10 Upgrade, when you went to make the recovery media, the PC used the information already preloaded at the factory - which was for Win7, not for Win10.  You can NOT make Win10 Recovery Media from PCs that were Upgraded, only from those that came with Win10 preinstalled.

Your best approach is to restore the PC using the Win7 recovery media and then, redo the Win10 Upgrade.

Since your PC was already activated with Win10, the Microsoft Activation Servers have a record of that, and after the Upgrade, once you get back online, the same servers will automatically reactivate your Win10 installation.

Good Luck

[kmpres · Accepted solution]

Thank you for your quick responses!  My tale of woe began after I'd received a ransomeware notice while doing a bit of online research.  I first ran McAfee but it came up clean.  I then downloaded MalwareBytes and erased the three files it found but it didn't erase the message from my screen.  I then tried System Restore but I apparently never set that up to make automatic restore points.  The only choice then was to prepare the system for my one and only image backup. The strategy is usually to erase all data to keep the malware from spreading, but to be super safe I elected to secure erase the HD not realizing that it would also completely erase my OS.  

I then found that my Windows 10 Recovery Stick would not restore my Windows 7 image backup.  Most programs are backwards compatible I thought but apparently not that one.  I called HP and even though my system was well out of warranty they contacted a company called Computer Surgeons for me who offered to send me a Recovery USB stick for $27 plus $5 shipping.  I readily agreed thinking it was a bargain compared to paying whatever the ransom would be if I had followed their miscreantic instructions.  The next day I found that prior to loading Windows 10 I actually had made a Windows 7 Recovery Disc, I'd just "put it in a safe place" that was so "safe" not even I could find it.  Of course I promptly forgot about it.

Two months after upgrading to Windows 10 I dutifully followed the OS's instructions to create a "Windows 10 Recovery Stick" thinking that it and my recent backup would be all that I'd need from then on.  Little did I know that the OS in the Recovery Stick (or disc) must match the OS in the image backup if they are work together.  

Once paired up correctly the restore went uneventfully.  I'm now re-enjoying Windows 7 which I think I will leave in the system for a little while before re-upgrading to Windows 10.  I also downloaded a full copy of Windows 10 using the link supplied in another response -- thank you for that.  I now have a means of re-upgrading to Windows 10 when the time comes. Since I found I no longer needed the recovery software from Computer Surgeons I asked them to cancel my order, which they did immediately.  Will keep them in mind for any future mishaps.

As for the bit of ransomware that caused all the trouble, I'm not sure which variant it was but it did not lock up my system, nor did it appear to actually encrypt my files, though I didn't take the time to examine them to be sure.  Nor did it give me a big countdown clock ticking away the seconds before its nasty little bomb would go off.  It instead blacked out my desktop photo and replaced it with a translucent text image that demanded I access some TOR site and await further instructions, which I of course ignored.  It also appeared to come to me through my home ISP using a "mymail" domain name that I created.  Nasty bit of trickery that.  It completely had me fooled.

So, lesson learned.  I will be making weekly backups from now on and matching them to the correct Recovery media.

Two unanswered questions remain:  Has my data actually been stolen?  Will there be any repercussions from my not having paid the ransom?

Thanks again for your help!

[TechJunky]

you might consider trying to get an installtiom media drive of widows ten from microsoft. you can make your own here. register it under your windows 7 product key and then use you r backup image to restore it to the last backup.

-techjunky