Microsoft's Patch Tuesday to end beginning with Windows 10.  This change goes for both security updates and non-security updates.

http://pcsupport.about.com/od/termsp/g/patch-tuesday.htm

Security Update: New malware and threats to PC security

Destroying your hard drive is the only way to stop this super-advanced malware

"Kaspersky published a detailed report Monday about Equation, which it considers the most advanced group of attackers to date and whose activity spans back to 2001 and possibly even to 1996. Even though the company stopped short of directly linking the group to the U.S. National Security Agency, there are significant details that point to such links."  PCWorld

A couple of years ago I published a blog post about the Stuxnet worm which infected and wreaked havoc to the Iranian centrifuges that were attempting to develop nuclear fissionable material for Iran's nuclear program.  Groups studying the code for the worm attributed the code writers to clandestine players, the CIA or NSA.  The problem was the code escaped and was utilized by crime groups to infiltrate the general PC population. Today there is a new threat that delivers it's threat by modifying the firmware of your hard drive.  Firmware is the low level code that acts as the interface between the software and hardware.  It is contained in the chips solder into the hard drive's interface board.  Once installed it is impossible to remove.  Formatting and re-installing the operating system has no affect and the malware remains in the chip ready to deliver it's payload.

http://www.pcworld.com/article/2884952/equation-cyberspies-use-unrivaled-nsastyle-techniques-to-hit-iran-russia.html?null

http://www.pcworld.com/article/2885192/fanny-superworm-likely-the-precursor-to-stuxnet.html

Help for the Cryptolocker (FBI) virus

The Cryptolocker virus made the news last year.  It is a particularly destructive malware program that encrypts, Word, Excel, PDFs and JPEG files to name a few and tries to force you to pay a ransom for the key to unlock your files.  Without the encryption key there is no way to recover your files without a good backup.

A client of mine was attacked last year, it occurred over a weekend so by Monday all of her documents, spreadsheets and pictures were locked and unusable.  I was able to remove the malware but it was too late for her files.  At that time I noticed that she had Carbonite and it was in the process of backing up the encrypted (changed) files.  I stopped Carbonite and she was able to contact Carbonite tech support and recover her files by restoring a back up that occurred prior to the date of infection.

The good news about Cryptolocker is that a group has somehow acquired the ransom keys used to unlock the files.  If you are attacked, submit to them a file that is encrypted and they will provide you with the key needed to unlock your files.  Be alert and please have a good backup.

http://www.wehatemalware.com/attacked-by-cryptolocker-help-is-here/

Google Chrome browser targeted

Recently I have seen an uptick in malware targeting Google's Chrome browser.  In each case the malware was delivered while the user was attempting to download a program they had Googled searched for. The delivery method for a lot of the new malware is distribution via junk email attachments, malicious torrents and particularly free applications. When searching for software using a search engine, the first listings in the search will be ads or sites that purport to be a download site for the desired software.  In most cases the listings are either scam sites which attempt to direct trick you to download alternative software/malware, or they deliver malware in addition to the desired program. Always carefully check the link provided if you click the link to ensure that the address is the website of the developer or manufacturer of the download you desire.

2 new Intel K CPUs, Gamer Desktops, high end components, DF Core i5-4690K, 3.5 GHz and Core i7, 4790K 4.0 GHZ

Tech News: Microsoft announces Window 10

Microsoft yesterday 09/30/14, announced the newest version of it's desktop operating system, Windows 10. Now for those of you counting, Windows 9 should have been the next occurrence.  The rumored OS was code named "Threshhold" during the Microsoft planning and early development process.  That code name, like a number of recent Microsoft ones, came from Microsoft's Halo franchise.

Microsoft went instead with Windows 10 because they wanted to signify that the coming Windows release would be the last "major" Windows update. Going forward, Microsoft is planning to make regular, smaller updates to the Windows 10 code base, rather than pushing out new major updates years apart. Windows 10 will have a common code base across multiple screen sizes, with the UI, (user interface) tailored to work on those devices.

The new operating system, which will see the return of the Start Menu and feature multi-tasking functionality by way of multiple desktops, was announced in a press event held by Microsoft. Later today 10/01/14, the Windows 10 Technical Preview will be available to download from the Windows Insider Program website.

http://windows.microsoft.com/en-us/windows/preview-coming-soon

It appears that Microsoft is taking a cue from Apple.  

People don't like change!

You have to give Apple credit for maintaining a standard Graphical interface.  Aqua is the GUI and primary visual theme of Apple's OS X operating system. It is based around the theme of water, as its name suggests, with droplet-like elements and liberal use of translucency and reflection effects.  It made it's first appearance in July 2000.  Since then Apple has announced many new OS's but all maintained the Aqua primary theme.  I have always argued that these were not new OS's but rather bug fixes and enhancements.


Windows 7 was a smooth transition from previous versions and it's 64 bit architecture offered improved performance and capabilities over Windows XP and Vista.  However it didn't energize business to upgrade and move from Windows XP.  Maybe because of Windows XP's success Redmond thought they needed to make a radical departure from previous versions of Windows.  BAM!!!  Windows 8.  Windows 8 is not a bad OS however, enterprise users (Windows base) were frustrated by it's radical departure from previous Windows versions.  Users had to learn to navigate a new operating system before being able to accomplish their work load and tasks.  Lot's of complaining, thanks a lot Microsoft!

Microsoft is expected to release a preview test build of Windows 10 sometime in the next few days. The company is expected to finalize Windows 10 by the spring of 2015, according to sources.


Advertisement

Microsoft Dynamics GP 2013R2 offers a solid proven accounting foundation with a consistent user experience across all modules.  GP offers everything needed for a business to start and has the capability to grow and meet current and future business needs.  It offers unparalleled productivity and collaboration with Microsoft Office and SQL Reporting Services allowing one to automate reports and emailing as well as access to data in formats needed by you the customer.

Product of Choice – Microsoft Dynamics GP 2013

Microsoft Dynamics GP 2013 offers a FULLY integrated ERP solution with the customization flexibility to meet your organizations growing demands to provide multi-entity support.  Ease of use, flexibility, integration and the ability to report quickly and accurately while utilizing state of the art infrastructures make Microsoft Dynamics the ERP leader.  This software giant invests enormous amounts of time and money on refining and perfecting its business solutions, and commits to delivering them on a frequent, 6-month basis. Consequently, Dynamics GP users are never far from the leading, cutting-edge functionality in ERP.  As with any Microsoft product, you can be assured of the financial stability of the company and the commitment to protect your investment.

With Microsoft Dynamics GP, managing your business is much easier when your calendar, email, and business management systems all work together—and are delivered from one trusted source. A business solution from Microsoft combines what you need to run your business (Microsoft Dynamics GP) with the tools you use to manage your day and collaborate with others (Office 365). With a consistent user experience you will be productive from day one.

The traditional workplace isn't so traditional anymore, and business doesn't stop because you're on the road or working from home. Monitor your business, collaborate on documents, enter and approve transactions—all from your phone, tablet, or desktop.

Dynamics GP gives you choices in 3 critical areas.  1. Where you want the data deployed, Customer site, a Hosting Partner such as Socius, or allow Microsoft to host the data.  2.  How do you want to access the data, Desktop Client and/or Web Client and 3.  How do you want to Buy and deploy GP?  Perpetual Licensing or Subscription Licensing.

For more info contact DFS-Socius

Advertisement

Windows 9, Google Chromebooks and DDOS attack takes down Sony Network and Chinese Operating System

Microsoft plans to launch Windows 9 on September 30.

Operating system choices, what to do.  Microsoft will reportedly announce Windows 9 on September 30th.  Presumably the Windows 9 launch will help lay rest to the Windows 8 launch and the references to Vista.  All this after Microsoft announced that OEMs will be allowed to continue to build and ship computers with Windows 7 Professional beyond October 2014.  However, OEMs will not be permitted to ship consumer versions of Windows 7.

Windows 8 really is not bad and represented a vision of 1 OS for all devices.  Young people love it, older users not so much and businesses dislike change.

The following piece by Ed Bott, The Ed Bott report best explains consumer vs business needs.

Sharpen the line between business and consumer Windows.

Remember back in 2001, when Microsoft unified the business and consumer versions of Windows in Windows XP?
That was a good idea at the time. In that pre-tablet, pre-smartphone era, there was effectively no difference between the hardware in a business PC and a consumer PC.
Today there are profound differences between business and consumer devices, and the tension between those two markets explains much of the turmoil that began with the release of Windows 8 nearly two years ago.
You can’t ignore the business market, but you can’t expect much innovation in this legacy business either. Many businesses are buying desktop PCs to serve as single-purpose devices (in call centers or on factory floors, for example). Most conventional business laptops are running Office and a browser and little else. When was the last time you saw a brand-new desktop program or a new class of peripherals for conventional PCs? All the innovation is happening on mobile devices, with software delivered as apps and web services.
And there’s the problem: Enterprise customers, who pay dearly for Windows licenses, want as little change as possible. Consumers, for whom Windows is an increasingly smaller part of the cost of a mobile device, want the newest features and apps without the headaches of managing a PC’s complexity.
I suspect that sometime in the next few years Microsoft is going to have to let these two branches of the Windows line drift apart again. That might be the only way to keep conservative IT pros happy while not slowing down the pace of innovation on consumer-focused mobile devices that happen to run Windows.

http://www.zdnet.com/windows-9-microsoft-faces-four-daunting-challenges-7000032902/

I think Microsoft could save themselves a lot of grief by following some of Ed's advice.  I have seen a lot of machines with Windows 7 and 8 that should never have been made.  They are extremely under-powered and that leads to a poor buyer experience.  The non-IT person is not capable of distinguishing a consumer device from a business device.  Chipsets, processors, ram and hard drives all add up to a screamer or a lemon.

The Windows 9 version is code named "Threshold" and is presumably to be a bridge from the desktop to the cloud.   The September 30th launch will allow the public to preview the new OS and the final product expected in the Fall of 2015 will likely be very different.

I've read where it will be a subscription model, $20/year.

http://www.zdnet.com/microsofts-windows-9-much-ado-about-little-given-cloud-shift-7000032858/?s_cid=e540&ttag=e540&ftag=TRE5369823

as the Shift to the Cloud continues,

Chromebooks, Google's OS based alternatives to PC or MACs continue to gain acceptance.  However without an internet connection their usefulness is limited.  That is supposedly being addressed by new Apps that are less Internet dependent and can add usability without the internet.

I think I am going to purchase a Chromebook this Labor day weekend and find out for myself if I can live at least mobile without the traditional notebook.

Microsoft says not but in a column by Jamil Bryant who weaned himself from IOS he say Redmond is full of hot air.  However to be fair his article (see following link) rankled IOS users as much as Windows people.

http://www.androidheadlines.com/2014/08/microsoft-come-reasons-buy-windows-laptop-chromebook.html

the Cloud, "Pandora's Box???"  UPDATE 3-Sony says PlayStation network back online; user data safe

Over the weekend I was communicating with a private board of my fellow BJJ training partners.  One of my friends was lamenting that his internet had been down the entire weekend and he could not view or follow the UFC fights Saturday night.  His cable provider did not carry Fox Sports South and as explained, his internet connection was down.  Justin's does not use a traditional computer but a PS4 for gaming and surfing the internet.

http://www.reuters.com/article/2014/08/25/sony-network-idUSL3N0QV2LV20140825

On a side note, a client of mine had been under a DDOS attack on their phone computer the past two weeks.  The offending IP address was attempting to attach itself so frequently that the phone computers logs were filling up and causing the phones to to down.  The offending IP address source was located in France.  I configured a rule in their Sonicwall and blocked the IP range.  All was well for about a week, when the attacker shifted to a different IP range and knocked the phones offline again.  We have created another rule to block this range but the phone vendor says this is happening frequently to lots of companies.  The only reason we can think of for the attacks is disruption of commerce.

As applications, communications and reliance on the Internet increase we must remember of how vulnerable and exposed businesses are with the new standard of doing business.  With all the security issues and problems I'm not sure that the world is ready for this,

Source: China-Backed Operating System to Launch By October

http://www.pcmag.com/article2/0,2817,2464470,00.asp

Happy Labor Day!  Safe travels and computing.

Latest security breach

If you have not heard already, a U.S. security firm is reporting that Russian hackers have stolen 1.2 billion username and passwords and well over 500 million email addresses.

"The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems."

http://www.nytimes.com/2014/08/06/technology/russian-gang-said-to-amass-more-than-a-billion-stolen-internet-credentials.html?_r=0#

If you are still using simple non complex passwords to safeguard your financial and other important data you should consider changing and stepping up the complexity of your passwords.  It is not that hard to record your passwords in a paper notebook or a password protected document on your computer.

Keep an eye on reports to see when they publish the sites that were affected so you can change your password(s).

If proper password complexity and security with a multitude of websites is too much of a task, you might consider some of the new password security programs that can evaluate/generate passwords for you and keep them for when you need them.  I don't think I would consider allowing the browser to remember the password for you any longer.

http://www.pcmag.com/article2/0,2817,2407168,00.asp

or maybe consider...

http://www.channelpronetwork.com/slideshow/apps-turn-your-smartphone-wallet?utm_source=wtf08062014&utm_medium=email&utm_campaign=wtf

In other news affecting the security of your computer, Microsoft is going to block outdated Java version from being installed as add-in into Internet Explorer.

http://www.zdnet.com/microsoft-to-block-outdated-java-versions-in-internet-explorer-7000032395/?s_cid=e589&ttag=e589&ftag=TREc64629f

Often Java is required by websites to properly view their content.  Next week's Patch Tuesday updates will include a much-needed fix for Internet Explorer, blocking outdated versions of Java and preventing one of the most popular vectors for installing malware. 

Be careful about what you download and install in the browsers.  Coupon, shopping and emoticon toolbar providers often time install themselves and other PUPs (Potentially Unwanted Programs) in your browser with or without your knowledge.  These programs often use code that can be exploited by malicious programs and hackers to compromise your computer and information and don't think these companies monitor and update to keep your computer secured.

With this update installed, all supported versions of Internet Explorer (IE 8 through 11 on Windows 7, and Internet Explorer for the desktop on Windows 8) will check the server-side block list whenever they encounter an ActiveX control on a web page. If the version is listed as out of date, the ActiveX control will not run, and the user will be prompted to update to the current, presumably safe version.

According to Microsoft, the following Java versions will be on the block list initially:

• J2SE 1.4, everything below (but not including) update 43
• J2SE 5.0, everything below (but not including) update 71
• Java SE 6, everything below (but not including) update 81
• Java SE 7, everything below (but not including) update 65
• Java SE 8, everything below (but not including) update 11

Microsoft XP is being pushed harder into oblivion.

Microsoft halted updates for XP beginning April 1, 2014.  A little over 3 months later I have found that you can no longer download the latest version of Adobe Flash player for XP because it does not support IE 8, the last version of Internet Explorer for XP.   As noted above, only the versions of Internet Explorer (including IE8) found on Windows 7 and Windows 8-8.1 will be updated.  As new exploits are being found and patched, XP users will have to continue to operate with the vulnerabilities that have been uncovered and are known by the hackers.  Be careful my friends.

DForce Intel 4th gen based Workstations

Microsoft Warns of Internet Explorer Zero-Day Bug, Dangers of XP

Microsoft Warns of Internet Explorer Zero-Day Bug, Dangers of XP

from PCMag.com:

Microsoft has released a security advisory that warns about remote code executions in various versions of Internet Explorer.
"This issue allows remote code execution if users visit a malicious website with an affected browser," Microsoft said. "This would typically occur by an attacker convincing someone to click a link in an email or instant message."

http://www.pcmag.com/article2/0,2817,2457206,00.asp

Government urges all users to switch to another Browser, Firefox or Chrome until IE Bug fixed

http://www.zdnet.com/governments-urge-internet-explorer-users-to-switch-browsers-until-fix-found-7000028869/?s_cid=e539&ttag=e539&ftag=TRE17cfd61



How Ditching Windows XP will make the Whole Internet Safer 

from link above, www.mashable.com

" — more than 27% of all computers worldwide still run the software — holdouts are inevitable.
That poses a growing danger not just to those PCs, but to any system coming into contact with them. With significant market share and no more official support, Windows XP will become a prime target for malware creators."

Alternate Browser links:

Firefox               http://www.mozilla.org/en-US/

Chrome             https://www.google.com/intl/en/chrome/browser/?hl=en&brand=CHMI

Safari                 http://support.apple.com/kb/DL1531

Types of Major Websites affected by Heartbleed bug; Michaels Stores confirms data breach, 3 million cards affected

In the aftermath of the Heartbleed bug, LWG Consulting has provided a chart that serves as a guide to what websites and passwords you should be concerned about.

This list is only a guide and may not apply to each and every financial institution or web entity.  Some websites may not fit exactly in the categories.  However, there are certain large companies on the list that everyone uses  Click on the link below.
.

http://www.lwgconsulting.com/news/sites_affected_by_heartbleed_bug.aspx​

For what it's worth, high NET or wealthy individuals, it is recommended to have a banking only computer. This computer is to be used for nothing but banking, no Facebook, EMail, surfing whatsoever.

There is a very good TV series on CNBC, "American Greed."  Two segments in the series dealt with online Cyber Fraud.

1.  The Fake PC-Optimizers/Fake anti-virus scams.  The overall take with this one operation exceeded $160 million.  I cannot find the CNBC segment now but here is a link about the story,

http://arstechnica.com/tech-policy/2012/10/ftc-gets-a-163-million-judgment-against-scareware-operation/

2.  The Zeus Trojan horse, allow hackers to access online bank accounts and steal millions virtually undetected. But there are ways to avoid being victimized

.

http://video.cnbc.com/gallery/?video=3000213289

Michaels Stores confirms data breach, 3 million cards affected

http://www.zdnet.com/michaels-stores-confirms-data-breach-3-million-cards-affected-7000028563/?s_cid=e539&ttag=e539&ftag=TRE17cfd61Michael's Stores Data Breach, 3 million customers

Important News about HeartBleed - UPDATE: 5 rules for using the Internet after 'Heartbleed'

click here for  HeartBleed Test
Open your Chrome Browser go to http://dforceatl.blogspot.com then click here for ChromeBleed Extension

http://www.marketwatch.com/story/5-rules-for-using-the-internet-after-heartbleed-2014-04-09?link=MW_latest_news

UPDATE: 5 rules for using the Internet after 'Heartbleed'

7:16a ET April 10, 2014 (MarketWatch) Print

By Priya Anand

You know the lock icon that pops up next to URLs to tell you a website will keep your information safe? It turns out it has actually left your private data unsecured for more than two years.

Websites encrypt your information, like emails, passwords and credit card numbers, so if anyone tries to snoop, they get a gibberish code and your data stays between you and the people you want to send it to. At least that's the way it's supposed to work. This week, researchers found a hole in OpenSSL, the lock that an estimated two-thirds of websites use. They're calling the bug "Heartbleed."

What's more, any attacks let in due to the bug can't be traced, experts say. This is a gaping security hole with "epic repercussions," director of security firm AlienVault Labs Jaime Blasco says, even if you're starting to become numb to all the data breaches of late.

Here are 5 rules for using the Internet after Heartbleed.

1. Trust no one

Run the websites you have accounts with through tools like the Heartbleed test to see if they're vulnerable or if the security gap has been patched before logging on. The page is fielding about 4,000 searches a minute, Milan-based freelance developer Filippo Valsorda said. Download the Chrome browser extension, Chromebleed, to receive notifications when you land at a website that hasn't fixed the problem yet. "In computer security, you never know when there's going to be a vulnerability," says Joost Bijl, marketing manager at the security firm Fox-IT.

2. Change your passwords and use two-step verification

"Change your password" is a mantra consumers have heard for years. It sounds simple and experts say it's still the first step users should take to protect themselves in case their communications were intercepted due to Heartbleed over the last two years. The safest move would be to change all your passwords, given the dominance of OpenSSL, the technology associated with the bug. Many companies, including Google (GOOG) , Facebook (FB) , Twitter and PayPal offer two-step authentication, asking users a security question or sending a code via text message when someone tries to log in from a new machine. "If someone lifts your password, then they still can't log in," Bijl says.

3. Be wary of public Wi-Fi networks

Turn off the setting that autoconnects your smartphone to public Wi-Fi networks, which can be exploited by malicious hackers. Airport and hotel Wi-Fi connections are convenient, but experts say these unsecured connections leave you open to attacks. When you do use them, set up a virtual private network to secure your Internet traffic. There are some free VPN services, though many charge monthly rates.

4. Monitor recent account activity

Some companies, like Google, offer email activity reports that show where and when an account was accessed. On Gmail, click on the small "details" button at the bottom of your inbox for a report complete with timestamps, maps and IP addresses. If a timestamp doesn't match up with your usage, change your password (and remember rule No. 2, two-step verification).

5. Install all the annoying security updates and read the alerts

Everyone's guilty of snoozing the prompts to install a security update and reboot, or ignoring an alert message to get to a Web page. These updates guard your computer from malware and other threats, and also fix any security gaps that might have gone undetected when you first downloaded software. If a security alert pops up on a familiar website, users sometimes ignore the notice and hit accept to move on, but can get caught in what are known as "man in the middle" attacks where a hacker eavesdrops on communications. "Users really don't care and usually they don't read those messages," Blasco says. "Please read the messages and try to understand what you're doing before you really make a mistake and your data can be compromised."

Also see:

http://blogs.wsj.com/cio/2014/04/08/google-microsoft-race-to-assess-heartbleed-vulnerability/

'Heartbleed' bug warning: 'Time to change passwords everywhere'
-Priya Anand; 415-439-6400; AskNewswires@dowjones.com

Windows XP Support ends April 08, 2014

Beginning April 08, 2014 Microsoft will stop supporting all versions of Windows XP.  Your computer will still work but Microsoft will no longer provide technical support, software update and no more security patches.  In the short term all will be fine, but as time passes you face the following risks:

• Exposure of confidential information due to new security vulnerabilities
• Degradation of performance due to unresolved software issues
• Inability to support new hardware due to lack of driver support
• Destruction of critical business information by malware

You are left with two choices, either in-place migration to a new version of Windows on your existing hardware, or perform a forklift upgrade to a new version of windows on new hardware.

In either case you must know that you cannot upgrade from Windows XP to Windows 7 or 8 directly.  You must perform a new install and then re-install all programs, devices and import your data and settings.

The following links from Microsoft describes the upgrade process for XP to Windows 7.  However beware that if you follow this process you will in all likelihood end up with a 32 bit version of Windows 7 or 8.  You don't want this.  Literally 99 percent of Windows XP installations are 32 bit.  A 32 bit OS limits your computer to 3 to 4 GB of addressable RAM (memory).  For this reason alone users should want to upgrade  from XP since this limitation affects both performance and capabilities of your machine.

http://windows.microsoft.com/en-us/windows/end-support-help

http://windows.microsoft.com/en-us/windows7/help/upgrading-from-windows-xp-to-windows-7#T1=tab01

A better explanation on the steps that should be considered before upgrading is found at the link below.  This article addresses the first obstacle in performing an upgrade and that is whether your existing machine is capable of running Windows 7 or 8.  It also discusses hacks and options you can employ to enhance your computer's performance and user experience.

http://lifehacker.com/how-to-move-on-after-windows-xp-without-giving-up-your-1556573928

Warning FBI Cryptolocker virus and Fake Funeral Notice. The depths Malware Authors will sink to in order to Infect your Computer.

FTC, FBI Warn Consumers About ‘Cryptolocker,’ A New Breed of Computer Malware

I previously warned you about the FBI Cryptolocker virus in the November 14, 2013 post.  I have had a couple of clients who dodged any problems by shutting off their computer as soon as they saw the warning and contacting me.  We were able to successfully remove the virus before it was able to do it's damage.  It's payload if left alone is to encrypt your Word, Excel, Photos, PowerPoint, videos and PDFs files.  The intent of the virus is not to so much spread but require the infected user to pay a ransom (about $300)  for a key to unlock your files.  The following info is from the FTC.gov website

Cryptolocker is spread mostly through email and “drive-by” downloads. The email might look like a routine message from a legitimate company, like a tracking notice from a shipping company. If you click on the hyperlink in the email, Cryptolocker encrypts everything on your hard drive and in your shared folders. When the job is done, you get a “ransom note” demanding payment via Bitcoin or some other anonymous payment method. The criminals behind this malware say they’ll give you the encryption key if you pay, but they’re hardly trustworthy. And there’s no other way to unlock your files.

http://www.ftc.gov/news-events/press-releases/2014/02/ftc-fbi-warn-consumers-about-cryptolocker-new-breed-computer

Recently I received a 7 a.m. call from a branch office of an Atlanta client who had been infected.  I instructed the client on how to update and scan using Malwarebytes and they were able to successfully remove the malicious code.  However the damage was done.  I received a call later indicating that the user could not open any Excel or Word documents.  I remote accessed the infected computer and found that the infection had occurred around Midnight and in the 7 ensuing hours the virus had time to work it's destructive payload and encrypt all of her files.  I removed over 800 text files related to the virus and a message file from the Start up folders of the Office products.  The text file contained the following instructions,

"All files including videos, photos and documents on your computer are encrypted."

"Encryption was produced using a unique public key generated for this computer. To decrypt files, you need to obtain the private key."

"The single copy of the private key, which will allow you to decrypt the files, located on a secret server on the Internet; the server will destroy the key after a time specified in this window. After that, nobody and never will be able to restore files."

"In order to decrypt the files, open site 4sfxctgp53imlvzk.onion.to/index.php and follow the instructions."

"If 4sfxctgp53imlvzk.onion.to/index.php is not opening, please follow the steps below: "

1. You must download and install this browser http://www.torproject.org/projects/torbrowser.html.en
"2. After installation, run the browser and enter the address: 4sfxctgp53imlvzk.onion/index.php"
"3. Follow the instructions on the web-site. We remind you that the sooner you do, the more chances are left to recover the files."

IMPORTANT INFORMATION:

Your Personal CODE: 00000001-E87E0C01

The client had Carbonite backup installed so I opened the program but found that the Carbonite was set to sync new and changed files and since all of her important files had been encrypted and changed Carbonite was backing up the encrypted files.  I froze the backup to stop the service.  Fortunately Carbonite keeps historical backups but this requires you to contact Carbonite for assistance which was free since she had the pay for service. However it took over 30 hours to restore her files to a date prior to the infection via internet download.  Also, any changes or new documents/files that occurred after this backup were lost.

The bottom line is this, if you are not backing up your data you need to find a plan.  Sync programs work well but you need to have historical backups as well.  If the client had only the latest backup of her data she would have been stuck with a backup of files in a non-usable format.

http://www.consumer.ftc.gov/blog/back-back-back-it

Fake funeral notice can be deadly — for your computer

How Low will Criminals and Malcontents (ne'er do wells) go to Infect your Computer?

Get this, yesterday I received the following email containing a link:

Suspicious I performed a simple Google search and found out this is a relatively new attempt to infect your computers.  This too is on the FTC.gov website.

http://www.consumer.ftc.gov/blog/fake-funeral-notice-can-be-deadly-your-computer

Be careful people.  Take the necessary steps to protect your data and remember when you are on the internet it's just like strolling down the street, criminals are behind every corner.

DForce Performance Workstations