HitmanPro.Kickstart – User Manual
Contents
1. most rescue CDs do not Kickstart boots your Microsoft Windows environment which already had access to your Wi Fi network Not all your hardware may be supported by a Linux environment HitmanPro Kickstart User Manual Page 21 SurfRight Revision History Initial release HitmanPro Kickstart User Manual Page 222. Figure 6 Warning message before formatting USB flash drive If you press the Yes button now the selected USB flash drive will be formatted and all necessary HitmanPro Kickstart files will be retrieved from the HitmanPro servers and written to the flash drive A progress indication is shown on the screen See Figure 7 for an example of this progress indication Create HitmanPro Kickstart USB flash drive HitmanPro Kickstart is the solution against police ransomware and other persistent malware that has taken your computer hostage or prevents normal computer use Boots your own ransomed operating system not a separate Linux system Bypasses ransomware on the master boot record MBR that prevents the computer from booting e Automatically runs HitmanPro without entering a Windows account or password e Kicks ransomware fake antiviruses and other fraudulent and malicious software from your computer Click here for more information about HitmanPro Kickstart 1 Plug in the USB flash drive where you want to install HitmanPro Kickstart on 2 Choose your USB flash drive that is not password protected P FLASH DRIVE USB 2 0 Flash Disk F 3 Install Kickstart Formatting Figure 7 Progress indication HitmanPro Kickstart User Manual Page 9 SurfRight Once the process has been completed a screen will be presented as shown in Figure 8 You can now remove the USB flash drive from the PC and
3. use it to remove the malware from a ransomed PC Create HitmanPro Kickstart USB flash drive HitmanPro Kickstart is the solution against police ransomware and other persistent malware that has taken your computer hostage or prevents normal computer use s Boots your own ransomed operating system not a separate Linux system Bypasses ransomware on the master boot record MBR that prevents the computer from booting e Automatically runs HitmanPro without entering a Windows account or password Plug in the USB flash drive where you want to install HitmanPro Kickstart on Choose your USB flash drive that is not password protected Install Kickstart Plug the USB flash drive into the ransomed PC you want to free Restart the ransomed PC from the USB flash drive Figure 8 HitmanPro Kickstart USB stick creation completed Figure 9 shows the contents of a freshly created HitmanPro Kickstart USB flash drive Organize v Share with v New folder Favorites MB Desktop ih Downloads S Recent Places HitmanPro35 Name HitmanPro exe Q HitmanPro_x64 exe Kickstarter exe Date modified 6 11 2012 15 09 6 11 2012 11 31 6 11 2012 15 09 Type Application Application Application Size 8 067 KB 15 228 KB 141 KB Figure 9 HitmanPro Kickstart USB flash drive contents HitmanPro Kickstart User Manual Page 10 SurfRight 5 Removing ransomware using the HitmanPro Kickstart USB fl
4. Pro application is improved actively and new versions are released on a regular basis To be able to use these new versions with the HitmanPro Kickstart USB flash drive you need to put these new versions on the flash drive You can download the new version of HitmanPro from our website www surfright com and copy the file to the USB flash drive Note that the filename must be either HitmanPro exe or HitmanPro_x64 exe See Figure 24 for an example of the files and their names on the USB flash drive S La J gt Computer HITMANPRO 07 lt Search HITMANPRO D D R lt a S 9 Organize v Share with v New folder fea Name Date modified Type Size Favorites E R Desktop HitmanPro exe 6 11 2012 15 09 Application 8 067 KB l Downloads HitmanPro x64 exe 6 11 2012 11 31 Application 15 228 KB Recent Places of Kickstarter exe 6 11 2012 15 09 Application 141 KB db HitmanPro35 3 items Figure 24 HitmanPro Kickstart USB flash drive contents Alternatively you can start the HitmanPro application in a non ransomed Windows environment directly from the USB flash drive If a new version of HitmanPro is available it will be updated on your flash drive automatically Note if HitmanPro Kickstart is used to boot a ransomed PC the HitmanPro application on your flash drive will not be updated automatically 6 1 Adding your own files to the stick You can add your own files to the stick if you like This way you can sti
5. SurfRight A HitmanPro kickstart User Manual HitmanPro Kickstart User Manua SurfRight Table of Contents 1 2 Introduction to FETIP vs aie CAN sa tsccctecccsecscecescsceccpeccenecseusescaccscaccctacs tecascetcsceecsteccscaceveatascdeecteceitecsicetaecpiantecctearneaiaedes 3 What US VANS OUI WV ANS T 4 Why do I need HitmanPro Kickstart oc acescscectaccscncescseaceassceccacarercatsseco lt tacstencescecasessacticcaeacereatsacteuctacatcncosdetaccascctuecdearbieataeess 6 Creating a HitmanPro Kickstart USB flash drive 7 Removing ransomware using the HitmanPro Kickstart USB flash drive 11 Dek Example ransomware FS 11 Vall icessiccasccosceaesctscs easseavescacaveasiesassacoscucsssasusisucesecszccasseaeaceenasaseasaseseciaucitacgencaeecgsaseneaananeies 15 Updating the files on the USB flash drive 20 6 1 Adding your own files to the Stick sss 20 COMPD O eia e AEAEE EE EEE EE EAE OEE A EARE EA ENE EE A 21 HitmanPro Kickstart User Manual Page 2 SurfRight 1 Introduction to HitmanPro Kickstart This document describes how HitmanPro Kickstart can be used to rescue a ransomed PC The intended audience ranges from non technical users confronted with an inaccessible desktop to support employees needing a tool to remove malware from ransomed PCs The intention of this document is to describe how easy it is to create a HitmanPro Kickstart USB flash drive and how it can be used to rescue a ransomed PC HitmanPro Kickstar
6. X XXXXX XXXXX XXXXX which you received when you purchased HitmanPro Activation will register the product key to this computer Product Key Activate I do not have a product key License Information A Your license for HitmanPro has expired Type Free license Expiration date 2012 05 06 Figure 21 Trial expired Once HitmanPro has been activated successfully the removal process will continue if you press the Next button After some time you will see a screen similar to Figure 22 indicating that the malware has been successfully disabled or removed Z HitmanPro 3 6 3 Build 175 Figure 22 Malware quarantined HitmanPro Kickstart User Manual Page 18 SurfRight The malware removal process is now finished If you press Next you will see a screen as shown in Figure 23 Z HitmanPro 3 6 3 Build 175 im 14s Malicious software was partially removed from your computer Restart your computer to complete removal Figure 23 Malware removed reboot required Now remove the USB flash drive and press the Close or Reboot button Either of them will cause the PC to reboot After the PC has rebooted your PC will be free of ransomware It is advised that you perform another scan with HitmanPro to verify that all malware has been removed from your PC HitmanPro Kickstart User Manual Page 19 SurfRight 6 Updating the files on the USB flash drive The Hitman
7. age as shown in Figure 11 will be displayed HitmanPro Rickstart 1 6 tc 2012 SurfRight USB Boot Options 1 Bypass Master Boot Record default 2 Regular boot when bypass did not work Please enter your choice 1 HitmanPro Rickstart booting MER Read Figure 11 Default boot method After 3 seconds the system will continue booting from your hard drive and start your installation of Windows If you get a message like Figure 12 just choose Start Windows Normally The reason this message is displayed is sometimes because your Windows session did not shut down correctly the last time This has no effect on HitmanPro Kickstart Windows Error Recovery Windows failed to start A recent hardware or software change might be the cause If Windows files have been damaged or configured incorrectly Startup Repair can help diagnose and fix the problem If power was interrupted during Startup choose Start Windows Normally Use the arrow keys to highlight your choice Launch Startup Repair recommended Start Windows Normally Description Start Windows with its regular settings ENTER Choose Figure 12 Windows Error Recovery message SurfRight When Windows has booted you will either get a logon screen similar to the one shown in Figure 13 or if your system is configured to logon automatically your desktop will be started L b _ p 9 L iIngdoWwSsS 100 C WILT MUIT If you see a logon
8. ash drive Once you have created a HitmanPro Kickstart USB flash drive you can use it to rescue a ransomed PC For that you must first make sure that the ransomed PC is powered off Now insert the HitmanPro Kickstart USB flash drive into a USB port of the ransomed PC and turn on the power of the PC During the PC s startup enter the bootmenu of your BIOS and select the USB flash drive that contains HitmanPro Kickstart to boot from Note to enter the bootmenu of your BIOS you usually have to press either F8 F11 or F12 depending on the manufacturer of your BIOS Once you have selected the USB flash drive to boot from and pressed the enter key you will get the following message HitmanPro Kickstart 1 8 Cc gt h SurfFRight USE Boot Options 1 Bypass Master Boot Record default 2 Regular boot when bypass did not work Please enter your choice _ Figure 10 HitmanPro Kickstart bootmenu You can now enter 1 or 2 to continue booting from the hard drive The default way to boot is 1 which skips the master boot record of your hard drive If you do not press any key the process will continue after 10 seconds using the default boot selection Option 2 should be used if you have a custom bootloader installed on your hard drive that is located in the master boot record for instance GRUB HitmanPro Kickstart User Manual Page 11 If the process continues using the boot method 1 the mess
9. can to check this computer Reaistrati E mail Address Confirm E mail Address Please e mail me important product notifications and opportunities to save on enhancements to my online security Figure 17 HitmanPro install window On this screen you can select whether you want to install HitmanPro on this PC or if you want to scan this machine without installing the software to your hard disk Figure 18 Setup Would you like to store a copy of the HitmanPro program file on this computer Yes create a copy of HitmanPro so I can regularly scan this computer recommended Automatically scan the computer daily during startup Create a shortcut on the desktop Create shortcuts in the Start menu No I only want to perform a one time scan to check this computer Reaistrati E mail Address Confirm E mail Address Please e mail me important product notifications and opportunities to save on enhancements to my online security Figure 18 Start without installing to local hard disk HitmanPro Kickstart User Manual Page 16 SurfRight If you press the Next button system scanning will begin and if malware is detected a screen as shown in Figure 19 will be shown indicating what malware is present on your system Z HitmanPro 3 6 3 Build 175 Figure 19 Malware detected You can now select the Next button to quarantine the malware In this way the malware is moved into a
10. cue CDs that boot a Linux variant and offer you specialized tools to scan your disk However for most non technical people using these CDs is too difficult and may cause damaged Windows systems if the user does something wrong That s why we developed HitmanPro Kickstart It is designed to be easy to use for non technical people without making sacrifices to the power of the HitmanPro anti malware solution All you need to do is boot up your system using the HitmanPro Kickstart USB flash drive and you re ready to go The programs on the flash drive will ensure that you boot into your own familiar Windows environment and start HitmanPro there All the required drivers for your devices and all wireless network passwords who can remember them will be readily available There is no need to become familiar with the tools of another operating system for instance Linux Also you do not have to perform manual actions like editing the registry that may cause your Windows system to become unbootable For a more elaborate feature comparison between HitmanPro Kickstart and currently available rescue CDs see section 7 HitmanPro Kickstart User Manual Page 6 SurfRight 4 Creating a HitmanPro Kickstart USB flash drive To create a HitmanPro Kickstart USB flash drive you need to have access to a computer allowing you to start HitmanPro you also need a USB flash drive with a capacity of at least 32Mbytes Note the contents of the USB flash driv
11. e Association 73 Onpa matar P voucher Use Payariacanri amp pha qpa 20 rM 0 zirea de 73 cmime e r k phos dins k mond erie o gt niefnet chars ka cicecques el Ce Yosser XA hh erva We 749 10E 114 x wie 04 hkuguu Z BATO L du aro d ARR TEMA Bore or O DAE dey 14 10 18 4 wut i Pay with Ukash or Paysafecard OE TT Your PC is blocked due to at least Q Okash OVa eet RR K Toone of the reasons specified pausafe ii below E g YOU COMDUICE Ws byty LO KC CMS a Culd pornography Paser 100 MURO Ukesh of Porat prar voucher f S C blod j wording a c C e we mancnals and cqured to ng and y aunan and wi is andi retanves If we TINA hour sour infommanan wv he sere kayon Sorel authores You will be chanpedt ami bonyi tert ter np te 5 years H T tine d I regisier 4 vex iaip hn Ihe zevi col yene HT Figure 1 Examples of ransomware HitmanPro Kickstart User Manual Page 5 SurfRight 2 Why do I need HitmanPro Kickstart Once ransomware has become active on your system it pops up every time you restart your system and blocks access to your desktop There is no way to start your antivirus program or any other program to try and remove this nasty piece of software So how do you get rid of the malware There are multiple boot CDs or rescue CDs that can be used to try to remove the malware from your system but they all boot into an environment that is not your usual one For instance there are res
12. e will be erased during the creation process First start HitmanPro You will see a screen similar to the one shown in Figure 2 SurtRight Ser HitmanPro cloud antimalware DrWeb Bitdefender B Check your computer for all forms of malicious software including viruses trojans IKARUS rootkits worms spyware fake software and keyloggers G Data B Emsisoft amp Click Next to scan for malicious software Figure 2 HitmanPro main window Press the Kickstart button A screen as shown in Figure 3 will be presented Create HitmanPro Kickstart USB flash drive HitmanPro Kickstart is the solution against police ransomware and other persistent malware that has taken your computer hostage or prevents normal computer use Boots your own ransomed operating system not a separate Linux system s Bypasses ransomware on the master boot record MBR that prevents the computer from booting cally runs HitmanPro without entering a Windows account E sunvesrouze a Dal LEE T Plug in the USB flash drive where you want to install HitmanPro Kickstart on Figure 3 Starting the HitmanPro Kickstart creation HitmanPro Kickstart User Manual Page SurfRight Now insert the USB flash drive you are using to write the HitmanPro Kickstart files to As soon as one or more USB flash drives are detected a selection screen as shown in Figure 4 will be presented All available target USB flash drives will be shown on this scre
13. en itr anPro 3 3 6 3 Create HitmanPro Kickstart USB flash drive HitmanPro Kickstart is the solution against police ransomware and other persistent malware that has taken your computer hostage or prevents normal computer use s Boots your own ransomed operating system not a separate Linux system s Bypasses ransomware on the master boot record MBR that prevents the computer from booting s Automatically runs HitmanPro without entering a Windows account or password s Kicks ransomware fake antiviruses and other fraudulent and malicious software from your computer Click here for more information about HitmanPro Kickstart pijuitte 1 Plug in the USB flash drive where you want to install HitmanPro Kickstart on 2 Choose your USB flash drive that is not password protected P FLASH DRIVE USB 2 0 Flash Disk F Figure 4 Target USB flash drive selection Now select the USB flash drive on which you want to place the HitmanPro Kickstart files and press the Install Kickstart button as shown in Figure 5 Create HitmanPro Kickstart USB flash drive HitmanPro Kickstart is the solution against police ransomware and other persistent malware that has taken your computer hostage or prevents normal computer use Boots your own ransomed operating system not a separate Linux system Bypasses ransomware on the master boot record MBR that prevents the computer from booting Automatically runs HitmanPro w
14. et more safely but also helps in the fight against organized crime So essentially when your PC has been infected with ransomware you will see a message supposedly from the police FBI or other authorities demanding that a fine must be paid to unlock the computer Most of the time your desktop is no longer accessible and you cannot start any other program See Figure 1 for examples of ransomware screenshots HitmanPro Kickstart User Manual Page 4 SurfRight O Politie gt Z K Se E BUNDESPOLIZEI Activite illicite demelee H Qucdecett T fir Scherbet in dar stavrateccectra TK eaten datos b te Ge g P oaie Ge oe E 2 amp el l pr T Iy Zr a deu Tm H pnt a Wr L L Rr 1 a E LPE dre p w rr N rat 0 9 Kr ra D wet Ke re he re r o r D r e Tour bevve be Mre a ide f cerai vous thewes payer le reeaerereement dr 100 eurns kashi ou puis je acheter un Rad dii E Mon pam Re N Rew toes ten otea zes Perae Lr en N Ad 1 ME de ieten lea A Erra Te Ge pamat L L mita oo 6 Rea rrr e Ast s om eee K eee cee Covel rere le kere A parer ee Y e ores par a as OA mm ae te Ome Lefen Caper ee Tapie Ame van ee ee ee ed ee bere Capote agree o J Paret a ache Ge Pern rte md Pont N fers oat eves KYN Comps amp parner aK Y Coe poysate O as ma N rad PEK a pry ar OE ee ee hr ee cee R sason paree Kwe Ket kra m KATE ret Z ages eae agree pe Vous teasa paes
15. i ga n dt ia pers es OC mwa Ge RER Td of Ge Bremen Oe THRE l G SEISTA s EESE The 1 z E DAR otre ordinateur estbloqu GE _ ATTENTION Votre arinaler ast Sioqu an raison chy OAR da in loi da in France On rivit kes aubora S r riea n tee T pa poe ria waa che tim PARIT curls NRP BT Cas 711 PREP mhi contenu pomngraphicquue swe is particnation cas minawa LS pomagaphe maitani an aoine cias erraria iia accor be el ias EI TP 00 aet pr wue par Tarola an 227 23 hs Code p ns ife la Fonos Caa as aca Hu kopral mar LR TLE clan KTR faia La portion eet prir Francea Cai asi purs pir une Bh mar penchant del amp Sars farani deaa rhian mikimAtia aar ia vinistion das draia CR ER Y La punition est Srince Caia ani piri par una nriman RP tie amp are N a T T T H ES Gut 3 jours veni L Garde ore haine de srar 4 LN alL veut rk 3 M L x aparani Ba vous na PER pas Nemenda nu OMe moaca mern minua detent ao H a Vous puuru payer Tarare notre pateraite Geer lade dus vouchers ou Payserecerd sur La scene 100 euma pals RE ure boma ma bee codes oP ancl Porshen owe draku sem ddbboqu la foi apro un ciie de lauper dcas LP rouse in port de venie piua proche Cuetec Ukida Payah 10 cuu y a PORT Foveve un code Lkash de 19 dhiires ou Un code Bale vard ce 16 chitres r computer has beer O peul cn Gchater un voucher Lara niee wd Federal Bureau of Investigation SS International Polic
16. ithout entering a Windows account or password c Kicks ransomware fake antiviruses and other fraudulent and malicious software from your computer Click here for more information about HitmanPro Kickstart 1 Plug in the USB flash drive where you want to install HitmanPro Kickstart on 2 Choose your USB flash drive that is not password protected FLASH DRIVE USB 2 0 Flash Disk F 3 amas Figure 5 Target USB flash drive selected HitmanPro Kickstart User Manual Page 8 SurfRight A warning as shown in Figure 6 will be presented indicating that all contents of the selected flash drive will be erased before the HitmanPro Kickstart files are written Create HitmanPro Kickstart USB flash drive HitmanPro Kickstart is the solution against police ransomware and other persistent malware that has taken your computer hostage or prevents normal computer use s Boots your own ransomed operating system not a separate Linux system Bypasses ransomware on the master boot record MBR that prevents the computer from booting Automatically runs HitmanPro without entering a Windows account or password Kicks ransomware_fake a FLASH DRIVE USB 2 0 Flas Click here for mor The USB flash drive will be reformatted before installing 1 Plug in the us HitmanPro Kickstart Warning Reformatting will delete any data stored on the USB flash 2 nass your krn Are you sure to want to proceed
17. ll use all the remaining space that is left on your USB flash drive once you have turned it into a HitmanPro Kickstart flash drive Just as long as you leave the files HitmanPro exe HitmanPro_x64 exe and Kickstarter exe on the flash drive adding your own files to the contents of the drive will not interfere with the HitmanPro Kickstart functionality HitmanPro Kickstart User Manual Page 20 7 Comparison The following table lists a number of HitmanPro Kickstart s features and compares them to currently available rescue CD s Feature Free product Easy to use by non technical computer user Bypasses Master Boot Record Sector 0 bootkits Uses multiple anti virus engines Zero day detection using behavioral scan No need for virus definition updates Fast scan takes less than 5 minutes on average Access the internet without having to enter your Wi Fi 2 network credentials Uses the Windows drivers that are needed for your specific 3 hardware no matter how old or exotic your system is Creates restore point to revert changes Replaces infected system files with clean versions Creation of bootable medium integrated in single application Sustainable updatable medium Full fledged product instead of trimmed antivirus subset Rescue CD X KKK KK KX KKK XIX N X SurfRight m HitmanPro Kickstart X X XI XI X X XI XN X XI N X X 1 i w Some rescue CDs do combine multiple antivirus engines
18. screen similar to the one shown in Figure 13 you can either select a user and logon or if you wait approximately 15 seconds HitmanPro will be started on your Windows logon screen as shown in Figure 14 HitmanPro Kickstart User Manual Page 13 SurfRight If you selected a user the environment of that user will be started and HitmanPro will be started in that environment see Figure 15 Z HitmanPro 3 6 3 Build 175 lt HitmanPro cloud antimalware Figure 15 HitmanPro started on user s desktop Note For the removal of ransomware it makes no difference if HitmanPro is started on the logon screen or if it is started in a user environment Once HitmanPro has started you can press Next to start the scan and if malware is found remove it HitmanPro Kickstart User Manual Page 14 5 1 Example ransomware removal SurfRight Now let s demonstrate the removal of ransomware using the following example where a PC is ransomed by Moneypack ransomware as shown in Figure 16 This operating system is locked due to the violation of the federal laws of the United States of America Article 1 Section 8 Clause 8 Article 202 Article 210 of the Criminal Code of U S A provides for a deprivation of liberty for four to twelve years Following violations were detected Your IP address was used to visit websites containing pornography child pornography zoophilia and child abuse Yo
19. secure store and can no longer start If you are a home user and there is no valid license present on your system and this machine has also never used the free HitmanPro trial license then you will see a screen as shown in Figure 20 Here you can either activate the 30 day free license or you can enter the product key you have purchased HitmanPro 3 6 2 Build 173 64 bit Product Activation Activate your copy of HitmanPro to remove malicious software Please enter in the field below the product key in format XXXXX XXXXX XXXXX XXXXX which you received when you f purchased HitmanPro Activation will register the product key to this computer Product Key Activate I do not have a product key Activate free license This one time license is valid for thirty days License Information A HitmanPro is not activated Cancel Figure 20 Activate free trial If the system you want to rescue had already used a HitmanPro free license previously and this license has expired or your computer is used in a business environment you will see a screen as shown in HitmanPro Kickstart User Manual Page 17 SurfRight Figure 21 To be able to remove the malware you need to enter a valid product key that you have purchased n sf HitmanPro 3 6 2 Build 173 Product Activation Activate your copy of HitmanPro to remove malicious software Please enter in the field below the product key in format XXXX
20. t lets you start your computer from a USB flash drive to remove malware that has ransomed locked your computer and does not allow you to access it HitmanPro is a second opinion scanner designed to rescue computers that have become infected with viruses spyware Trojans rootkits and other threats despite real time protection from up to date antivirus software HitmanPro Kickstart User Manual Page 3 SurfRight 2 What is ransomware Let s first describe what ransomware does The following description is from the Europol website A ransomware attack typically poses as a pop up window on your screen claiming to come from a law enforcement agency and accuses the user of visiting illegal websites The screen is frozen and the message reads that it will be unlocked only on payment of a fine Demands are very often specific to the country of the victim pretending to be issued by local law enforcement agencies and written in the local language Despite payment of the fine however the computer will not be able to be unlocked until the machine is successfully disinfected This type of attack was first detected in 2011 and has affected thousands of innocent citizens Ransomware is big business generating millions of euros for organized criminal groups This money is then used to finance further criminal activities all over the world Combatting this kind of malicious software not only enables citizens to browse the Intern
21. ur computer also contains video files with pornographic content elements of violence and child pornography Spam messages with terrorist motives were also sent from your computer This computer lock is aimed to stop your illegal activity You have 72 hours to pay the fine otherwise you will be arrested You must pay the fine through MoneyPak To pay the fine you should enter the digits resulting code which is located on the back of your Moneypak in the payment form and press OK if you have several codes enter them one after the other and press OK if an error occurs send the codes to address ffen MoneyPak Figure 16 Moneypack ransomware Once the PC has booted following the procedure described in section 5 Removing ransomware using the HitmanPro Kickstart USB flash drive you will see the HitmanPro start screen similar to Figure 14 or Figure 15 HitmanPro Kickstart User Manual Page 15 SurfRight Now press the Next button to start scanning for malware If this is the first time HitmanPro has started on this machine you will see a screen as shown in Figure 17 Setup Would you like to store a copy of the HitmanPro program file on this computer Yes create a copy of HitmanPro so I can regularly scan this computer recommended Automatically scan the computer daily during startup Create a shortcut on the desktop Create shortcuts in the Start menu No I only want to perform a one time s
Download Pdf Manuals
Related Search