Cautionary Tale: Computer Hijacking, Extortion, and Sh*tware

Many of you have seen my requests for computer help. I got a lot of help, and I thank you guys for that very much.

Something interesting happened. Have you heard the stories where hackers with custom viruses and worms disable your computer and you have to pay them a ransom to get them to un-f**k your computer? That happened.

I gave up on Greasy-Fast Pig (hereinafter "GFP"), by the way, swapped drives and loaded the OS on the good drive. As soon as I connected to the internet, odd things started to happen. First, I couldn't connect to Norton. Every time I tried to go to Norton or Ad-Aware or Malwarebytes for security programs, my browser dropped me and said it couldn't connect--yet I could connect to Drudge, etc., basically anything not security related. I got a download from the helpful people at Norton on OVERKILL, another computer. But once on GFP, Norton couldn't connect for verification and said my system was unsupported. Absurd. It is supported. So I googled for Norton help, and got a whole Google page of Norton results. Most, if not all, said I could call any time. So I called. The guy searched my computer and said he found a worm, Koobface, and that he was not authorized to fix it. He also said Norton couldn't stop it. He said I'd have to talk to a certified Microsoft Windows technician, and, guess what... they just happened to have one right there in the office.

That made me suspicious, and by then I'd already given them access to my machines. Anyway, for another $250 dollars, he could fix GFP. They had two other pricing plans that were even more. They put the hard sell on me for about 30 minutes. It was obviously a scam.

They are a sophisticated bunch. It turns out that entire page of Googled Norton search results I saw was fake.

Apparently the worm or virus is in my network. So I'm re-formatting and overwriting the drive on GFP. By the way, I told him that would kill any virus there. He said it wouldn't. I guess they get a lot of dumb people on the phone.

So here's what I'm doing: If it's in OVERKILL (and not really affecting it at all. btw), I have to do my work on GFP with OVERKILL off--and after resetting my router. Then, I can connect with GFP and avoid the redirects, etc., get my Norton up and running, and load the other security programs I want.

Here's the kicker. At one point I used a 15gb thumb drive to load Norton, Malwarebytes, and Ad-Aware. That worked, although I couldn't finalize and verify with Norton, as I've said. I've reformatted that thumb drive a dozen times. It takes about 4 seconds. This time I when I hit the button to remove the thumbdrive, I kept getting a warning I needed to reformat before pulling the drive out of GFP. That was odd. But I did. The "reformat" went on and on and on.... In other words, it seemed more like it was loading a program than it was reformatting.

So. I believe I have a copy of their shitware. I've contacted Norton. One would think some security firm would to be interested in that thumb drive.

What's the lesson? It's hard to say, because many of the programs I downloaded to fix GFP were from geek sites, and they were fantastic. Some apparently were not. On one of these downloads, I didn't read the fine print and downloaded something called AVP Secure Search (or something), a search thing you can use in place of Google and the others. But I started looking at what was downloaded. It was hellware. It was an Enormous amount of garbage that had nothing to do with browser searching. I plucked that stuff out by the roots in my registry, but I'm pretty sure I missed a .dll file or two.

Anyway. If you go looking for boot fix programs and the like, talk to someone and find out who is reputable. That's it. This Trojan rode in on one of these fixit programs, and now I have nothing but headaches. And it's exhausting trying to fix this stuff.

My last worry: I hope their worm doesn't have a way to load itself into some chip or something I can't clean with reformatting and overwriting.

Related: Never pay the ransom. Also, call the FBI. It says they're interested in cyber/computer crimes.

Posted by: rdbrewer at 06:47 PM

Comments

(Jump to bottom of comments)

1 Bring back our Ace.

Posted by: rebel flounder at July 27, 2015 06:46 PM (Vf5rR)

2 Thanks COBs for filling in BTW.

Posted by: rebel flounder at July 27, 2015 06:46 PM (Vf5rR)

3 Last week was the 30th anniversary of the Amiga. I'd desperately like to dig out my 1000 and set it up again...Truly an awesome computer.

Posted by: Pappy O'Daniel at July 27, 2015 06:48 PM (oVJmc)

4 Yeah, thanks COBs. We are an ungrateful bunch.

Posted by: JohnnyBoy at July 27, 2015 06:48 PM (l2Gqi)

5 This is why my wife and daughters are not allowed to download anything. Ever.

Posted by: smaulz at July 27, 2015 06:49 PM (g+jFF)

6 Very interesting. Thanks!

Posted by: Ann K at July 27, 2015 06:50 PM (bV/7i)

7 I don't think calling the FBI is a good idea. I'll just pay the ransom.

Posted by: Harry Reid at July 27, 2015 06:50 PM (/51qR)

8 And you plugged you computer in and turned it on and everything?

That's all I got.

Posted by: eleven at July 27, 2015 06:53 PM (MDgS8)

9 I know some people find it tiring to have "Linux" repeatedly invoked, so I'm not going to do that.

Posted by: torquewrench at July 27, 2015 06:55 PM (noWW6)

10 God that sounds miserable.

Posted by: mynewhandle at July 27, 2015 06:55 PM (AkOaV)

11
I hear you should visit pron sites alot, they never have viruses.

Posted by: Guy Mohawk at July 27, 2015 06:55 PM (ODxAs)

12 Geees, my post window disappeared. must be the FBI.

Posted by: Badda Bing 'now with Badda Boom' at July 27, 2015 06:55 PM (BjKDP)

13 One lesson is if you find yourself in this situation and you go about fixing stuff yourself, you are probably better off not trying to fix it in windows. There are many linux live discs and thumbdrive utilities that can help.

I have used this extensively.

http://www.pendrivelinux.com/yumi-multiboot-usb-creator/

Posted by: rebel flounder at July 27, 2015 06:55 PM (Vf5rR)

14
"by then I'd already given them access to my machines"

We really, really, REALLY need to have an AoS poker night.

Posted by: Laurie David's Cervix at July 27, 2015 06:55 PM (kdS6q)

15 At the moment I'd take the ubuntu flash drive you were using, boot the computer in question using it, boot to a terminal, install a program called clamav

(sudo apt-get install clamav, plus some other stuff like fresh definitions)

and use that to scan the hard drive.

I'd also look at using Microsoft Windows' security program, which I have heard is pretty good, but do that after you've run the scan from ubuntu.

Posted by: Thing From Snowy Mountain at July 27, 2015 06:55 PM (sxa/c)

16 And you plugged you computer in and turned it on and everything?

That's all I got.

Do y'all have a fire over there? I have smoke coming out of the back of my pc.

Posted by: rickb223 at July 27, 2015 06:56 PM (vxBxx)

17 I don't understand a word rdbrewer wrote. I am an Official Certified Numnutz when it comes to this stuff.

About five years ago, I got hit with a particularly pernicious piece of malware, which proceeded to (apparently) eat everything on my hard disk. I tried one guy who managed to get the machine to limp along, then tried a well-known chain of 'puter-fixers (think black-and-white VW Beetles) who claimed they made it all good for a pretty hefty sum. Within minutes after I fired it up, everything was going sour again. Finally, a local geek unaffiliated with anyone came to the house and did his thing. Fixed it, no ill effects, only a modest bill.

To this day, I haven't the foggiest notion what any of them did. It still works, my info was saved, and Malwarebytes and an AV program seem to keep it clean. Is all I need to know.

Posted by: MrScribbler at July 27, 2015 06:56 PM (rCmeG)

18 This is exactly what happened to my emails.

Posted by: Ready For Hillary!!11!! at July 27, 2015 06:56 PM (Dwehj)

19 NEEERRRDDDSS!!

Posted by: that guy who yells NEEERRRDDDSS!! at July 27, 2015 06:57 PM (LQuO+)

20 BTW, the reason I consider linux to be particularly useful at times like this is that I suspect it's harder for the malicious coders to come up with a virus that's good for both systems.

Posted by: Thing From Snowy Mountain at July 27, 2015 06:57 PM (sxa/c)

21 Best of luck to you -- I'd have been lost long before you figured it out. I would have either dropped dead from a ragestroke, or ended up getting a new PC.

I HATE the computer industry these days. I remember the C64 (honestly that PC and the games I played on it comprise some of my fondest computer memories) and the IBM clones I could upgrade and reformat at will. Now, with registries and apps and Windows 8.1, I am in over my puggie head

Posted by: acethepug at July 27, 2015 06:58 PM (WK825)

22 Have a different computer for the pr0n

Posted by: navybrat at July 27, 2015 06:58 PM (JgC5a)

23 I was told ages ago, and it still seems to hold true, that Virus writers purposefully write to get around Norton first, and most, so its popularity makes it virtually useless. Especially on day one virii etc.

Also, to clean the reg after pulling out programs like that. Use CCleaner, and its pretty good at that.

glad to see you got it goin, and try Duck Duck Go for searches. They had obviously spoofed a google result, and I doubt they could do that to DDG. (They also don't save your search history etc, for use libertarian types)

Posted by: JarvisW at July 27, 2015 06:58 PM (3+E+K)

24 A few years ago I got that redirect worm. It stops you from googling the problem and screws up browsers. I switched to firefox and then it went nuts, too. What I did to get rid of it was use the free superantispyware program stpred on a thumb drive. They tell you when you download it to change the extension if you dont use it right away b/c the virus attacks all executable files. But anyway, it cleared it up twice, actually, three times since I got it a year ago, too. It's a real pain in the ass b/c it eats away your time.

Posted by: Bruce With a Wang! at July 27, 2015 06:59 PM (iQIUe)

25 Sometimes I just want to 'terminate' my computer. Then I remember all you friends caught in the matrix and I just can't quit.

Posted by: Eromero at July 27, 2015 06:59 PM (go5uR)

26 20
BTW, the reason I consider linux to be particularly useful at times like
this is that I suspect it's harder for the malicious coders to come up
with a virus that's good for both systems.

Posted by: Thing From Snowy Mountain at July 27, 2015 06:57 PM (sxa/c)

Yep, and booting a compromised machine from a compromised OS, you have no idea WTH is going to happen. Better to scan it as a non-active drive from a live OS. And once you have it on the PC, you should be disconnecting it from the network, if you need to work in the compromised PC with its native OS.

Posted by: rebel flounder at July 27, 2015 07:00 PM (Vf5rR)

27 9
I know some people find it tiring to have "Linux" repeatedly invoked, so I'm not going to do that.

My entire family has used Ubuntu for over 7 years for school , work and play. Not even one virus , malware or trojan.

Even my tech-hopeless wife uses it.

If we need Windows we run a copy on Virtual Box.

I bought my parents a new 'puter the nifty new "Microsoft Surface".

Long story short: It ships from the FACTORY with spyware preloaded.

Seriously, for your family's safety , consider some LInux flavor as an alternative.

Posted by: some random meathead at July 27, 2015 07:00 PM (QuNQQ)

28 Anyway, what's the name of the virus that ate Ace?

Posted by: Bruce With a Wang! at July 27, 2015 07:01 PM (iQIUe)

29 Since this post will bring nerds out of the woodwork, probably, some nerdy vids to lighten your afternoon:

I'm such a nerd
https://www.youtube.com/watch?v=dxx6BupgRmI

Settlers of Brooklyn
https://www.youtube.com/watch?v=D-thbQlaMIc

Posted by: LizLem at July 27, 2015 07:02 PM (hvf9s)

30 Have you turned your computer off then back on again?

---Every IT Department Employee

Posted by: DangerGirl and her 1.21 gigawatt Sanity Prod at July 27, 2015 07:02 PM (q20+R)

31 I hear you should visit pron sites alot, they never have viruses.

What doesn't crash your machine only makes it stronger, I figure.

Posted by: Cicero (@cicero) at July 27, 2015 07:02 PM (8ZskC)

32 I experienced the same scam on my new lenovo as well. It was a headache as well. I killed it by downloading a fix on my work computer and thumbsticked to my lenovo. I called them when I was trying to figure out what the heck was going on too. Yeah, it's was an obvious scam once I started talking to them.

Posted by: Draki at July 27, 2015 07:02 PM (udx6h)

33
Don't forget that your network devices like your wireless router can have exploits on them as well. This doesn't necessarily have to do with your PC.

Posted by: dan-O at July 27, 2015 07:03 PM (rnB5q)

34 I've had few problems myself as i guess almost everyone has. I would love to climb on one of these assholes roofs and tear every other shingle off so they could call someone to come fix it.

Posted by: Skip at July 27, 2015 07:03 PM (CFAPf)

35
rdbrewer, there is a chance that your router or dsl/cable modem has been hacked.
There were some scripts going around a few months ago that would run on your computer, then use a password dictionary to login to your router and change the DNS settings. Then you get taken to a fake google, and to fake banking sites, and either to a fake norton or to nowhere.

Posted by: Shelley at July 27, 2015 07:04 PM (P9kAG)

36 Keep a LiveCD of your favorite Linux OS in your toolbox. Very handy for scrubbing bad files without loading the OS, and a finalized CD can't spread the infection like a USB stick might.

Posted by: Pappy O'Daniel at July 27, 2015 07:04 PM (oVJmc)

37 White and Nerdy

www.youtube.com/watch?v=N9qYF9DZPdw

Posted by: rebel flounder at July 27, 2015 07:04 PM (Vf5rR)

38 Ace could be dead...DEAD!!! and you people dont care.

Posted by: Bruce With a Wang! at July 27, 2015 07:04 PM (iQIUe)

39 Even my tech-hopeless wife uses it.

Posted by: some random meathead
____________

So I first read that line as "my topless wife . . ."

Does this mean my computer has a virus?

Posted by: Furious George at July 27, 2015 07:04 PM (UlJ3l)

40 I got a new lap top for my birthday. But it came with 8.1. I can't wait till the 29th when 10 comes out. Anything is better than this abortion of an OS..

Posted by: Tinfoilbaby at July 27, 2015 07:05 PM (Ii765)

41 Don't forget that your network devices like your
wireless router can have exploits on them as well. This doesn't
necessarily have to do with your PC.

You can try replacing your router firmware with Easy Tomato or similar.

Most malware is designed for Windows and also cutting edge sparkly new shit.

Posted by: some random meathead at July 27, 2015 07:06 PM (QuNQQ)

42 Computers are cheap and disposable. I ain't wasting my time if I have to gut a hard drive to restore a factory version of a shitty operating system. Backup your personal info religiously and never trust the security of or rely on a system connected to the interwebz.

Posted by: Fritz at July 27, 2015 07:06 PM (o/UmK)

43 Related: Never pay ransome.

H8ter. My books are pretty good!

Posted by: Arthur Ransome at July 27, 2015 07:06 PM (LQuO+)

44 If you Google for "Norton help" or "Norton support", the first few search results will not be Symantec (the company that owns Norton) links. They will be links to off-shore tech support shops that claim to be "authorized" Norton support, but they're not.

It is a common problem that Symantec knows about but can't fix because those outfits spring up like toadstools and the wheels of the legal system grind very slowly.

Posted by: OregonMuse at July 27, 2015 07:06 PM (/LM8/)

45 Should've called me.

I have highly trained IT specialists standing by that would have been more than willing to help you... for a small fee to the Clinton Foundation... or a small share of uranium mining rights for my brother.

Posted by: Cankles.com at July 27, 2015 07:07 PM (qNvak)

46 >>> I got a new lap top for my birthday. But it came with 8.1. I can't wait till the 29th when 10 comes out. Anything is better than this abortion of an OS..

We'll gladly take that off your hands...

*rubs hands together and twiddles mustache*

Posted by: Planned Parenthood, white meat or dark? at July 27, 2015 07:07 PM (hvf9s)

47 So I first read that line as "my topless wife . . ."

Does this mean my computer has a virus?

Does a burka qualify as 'topless'?

Posted by: some random meathead at July 27, 2015 07:08 PM (QuNQQ)

48 42
Computers are cheap and disposable. I ain't wasting my time if I have
to gut a hard drive to restore a factory version of a shitty operating
system. Backup your personal info religiously and never trust the
security of or rely on a system connected to the interwebz.

Posted by: Fritz at July 27, 2015 07:06 PM (o/UmK)

Another good tool is Clonezilla. You get that shiny new laptop setup with all your stuff? Immediately clone the drive, so that instances like this are as easy as rewriting the drive partition. And backups.

Posted by: rebel flounder at July 27, 2015 07:09 PM (Vf5rR)

49 The guy searched my computer and said he found a worm, Koobface, and that he was not authorized to fix it. He also said Norton couldn't stop it. He said I'd have to talk to a certified Microsoft Windows technician, and, guess what... they just happened to have one right there in the office.

Right, and that's part of the scam. He would have told you you had a virus even if your system was completely clean and working properly. He would have tried to charge you $399 or $299 or $199 or whatever he could get to "fix" your computer.

Posted by: OregonMuse at July 27, 2015 07:10 PM (/LM8/)

50 Anyway, what's the name of the virus that ate Ace?
Tertiary syphilis?

Posted by: mister wu at July 27, 2015 07:11 PM (kivUY)

51 White and Nerdy

www.youtube.com/watch?v=N9qYF9DZPdw

All About the Pentiums

https://www.youtube.com/watch?v=qpMvS1Q1sos

Posted by: alt.total.loser at July 27, 2015 07:11 PM (LQuO+)

52 I'm so old...... The first computers I worked on in the Army used punch tape to load programs and run diagnostic's. The "new" computers we got used a vhs tape to do the same thing.

Posted by: Tinfoilbaby at July 27, 2015 07:11 PM (Ii765)

53 Oops. Off, 'cocksucka' sock.

Posted by: andycanuck at July 27, 2015 07:11 PM (kivUY)

54 I hear you should visit pron sites alot, they never have viruses.

What doesn't crash your machine only makes it stronger, I figure.
Posted by: Cicero (@cicero) at July 27, 2015 07:02 PM (8ZskC)

Be careful, sometimes those blokes will load up kiddie pron onto your machine. When you're doing research.

Yeah, research.

Posted by: P. Townsend at July 27, 2015 07:12 PM (Dj0WE)

55 Once I stopped trusting Norton and McAfee to protect my systems, that was the first step toward nearly trouble-free computing.

Posted by: Burn the Witch at July 27, 2015 07:12 PM (xSCb6)

56 Tertiary syphilis?

Hepatitis C?

Posted by: OregonMuse at July 27, 2015 07:12 PM (/LM8/)

57 Since Ace is gone, maybe you could get his computer. Just sayin'.

Posted by: Weasel at July 27, 2015 07:12 PM (e3bId)

58 Ace could be dead...DEAD!!! and you people dont care.
Posted by: Bruce With a Wang! at July 27, 2015 07:04 PM (iQIUe)

Did anyone ask Rick Wilson? I bet Rick knows.

Posted by: BurtTC at July 27, 2015 07:13 PM (Dj0WE)

59 Some of the new stuff will get into the firmware of various devices - especially hard drives. You think you deleted all the partitions, zeroed out the sectors, etc - but it's actually in the drive it's self.

I used to be a specialist at removing this sort of stuff - that was 10 years ago and while some of the principles still apply, some of the root kits and the way some of this stuff hides now just scares the hell out of me.

I try not to keep anything on my PC except video games and cat pictures...

Posted by: reformered techie at July 27, 2015 07:13 PM (00nj4)

60 Be careful, sometimes those blokes will load up kiddie pron onto your machine. When you're doing research.

Yeah, research.
Posted by: P. Townsend

And sometimes they put bodies of missing cub scouts in your crawlspace. Bastards.

Posted by: Harry Reid at July 27, 2015 07:13 PM (/51qR)

61 I think the bottom line here is that most folks will be quite lucky if they don't experience some kind of exploit during the lifespan of their computer. Let's face it - there are countless miscreants out there that are getting paid big bucks to develop new and more virulent forms of malware. It's just going to get worse, unfortunately.

Posted by: Uncle Busyhands at July 27, 2015 07:13 PM (Dwehj)

62 Ace could be dead...DEAD!!! and you people dont care.

Hell is eternity on AOS with nothing but Malor posts.

Posted by: some random meathead at July 27, 2015 07:14 PM (QuNQQ)

63 55 concur.

Posted by: Weasel at July 27, 2015 07:14 PM (e3bId)

64 Yeah, I got hit by one of those lock-and-pay viruses last October. Just bought a new desktop, since the infected one was over 5 years old anywise and had been running on fumes as it was. Still ended up losing a bunch of my documents and family pictures, however.

Posted by: Titus Quinctius Cincinnatus at July 27, 2015 07:14 PM (Maary)

65 Be careful, sometimes those blokes will load up kiddie pron onto your machine. When you're doing research.

Yeah, research.
Posted by: P. Townsend

And sometimes they put bodies of missing cub scouts in your crawlspace. Bastards.
Posted by: Harry Reid at July 27, 2015 07:13 PM (/51qR)

Rough boys... can't be trusted around exercise equipment, amirite?

Posted by: P. Townsend at July 27, 2015 07:15 PM (Dj0WE)

66 Once I stopped trusting Norton and McAfee to protect my systems, that was the first step toward nearly trouble-free computing.

Not only that, they seem to be real resource hogs.

Posted by: Pappy O'Daniel at July 27, 2015 07:15 PM (oVJmc)

67 Nowadays you can't connect a system to the internet until it's patched up. They usually make changes to your hosts for all the security websites to the wrong addresses usually in your c:\windows\system32\drivers\etc or something like that.
If you connect to the internet don't do surfing until you run your updates.

Posted by: MarkyMark at July 27, 2015 07:15 PM (POa7B)

68 This is why we use Blackberry's.

Dopes.

Posted by: Reggie and Love Man at July 27, 2015 07:16 PM (48QDY)

69 BTW, Rdbrewer, kudos to you. (People need to know about these things.)

It takes courage to come on here and admit you were a noob pwned by a tech support scam.

I looked at your logs, but did not have a lot of time to digest the whole story, so did not want to give half-baked advice.

Posted by: rebel flounder at July 27, 2015 07:16 PM (Vf5rR)

70 Not only that, they seem to be real resource hogs.
And crap to 'improve' your system.

Posted by: andycanuck at July 27, 2015 07:16 PM (kivUY)

71 Thumbdrive (flash drives) are nice but still writeable. IOW, they are prone to having their MBR rewritten. So a repair drive is useful for quick and dirty fixes but still vulnerable.

If you can, make a recovery or diagnostic/repair DVD periodically and ensure it is Read-Only. Then test your system and make sure you can boot from it. Also, learn about accessing and modifying your motherboard's BIOS. These are pretty much mandatory in preserving your system should things turn south. The odds of malware modifying your BIOS are exceedingly small, but the MBR (Master Boot Record) is vulnerable. Forcing your system to boot to RO-DVD and using it to scan or recover your system is a lifesaver. Learn how before catastrophe hits.

Posted by: AnonymousDrivel at July 27, 2015 07:17 PM (1CroS)

72 The first computer i worked on was a 229lb piece of junk that a 2$ calculator today could blow away. And the display was nixie tubes.

Posted by: Tinfoilbaby at July 27, 2015 07:18 PM (Ii765)

73 Yup....viruses be nasty things. Almost as nasty as the porn sites I catch mine from....anyone have a condom for the PC?

Now Trojan Horses....those I like. Not.

Posted by: Hairyback Guy at July 27, 2015 07:18 PM (JG47A)

74 55 Once I stopped trusting Norton and McAfee to protect my systems, that was the first step toward nearly trouble-free computing.
Posted by: Burn the Witch at July 27, 2015 07:12 PM (xSCb6)

windows defender, malware bytes, and not downloading anything sketchy seems to work for me.

But I also reformat fairly regularly and don't really keep much on my computer anyways.

What I do have is 'in the cloud'.

Posted by: mynewhandle at July 27, 2015 07:18 PM (AkOaV)

75 72
The first computer i worked on was a 229lb piece of junk that a 2$
calculator today could blow away. And the display was nixie tubes.

And we were GRATEFUL for it!!

Get outta my yard!

Posted by: some random meathead at July 27, 2015 07:19 PM (QuNQQ)

76 74 55 Once I stopped trusting Norton and McAfee to protect my systems, that was the first step toward nearly trouble-free computing.
Posted by: Burn the Witch at July 27, 2015 07:12 PM (xSCb6)

windows defender, malware bytes, and not downloading anything sketchy seems to work for me.

Posted by: mynewhandle at July 27, 2015 07:18 PM (AkOaV)

And update often so you can run in safe mode. Might not have helped rd in this case sounds like.

Posted by: Golfman at July 27, 2015 07:21 PM (48QDY)

77 And we had the cold-call guys claiming to be Microsoft who had detected a virus on your computer calls once too.

My IT guy said the freeware versions are good enough with him putting Malwarebytes and Avira on my 8.1 p.c. and CCleaner someone recommended above.

And when I have been hit the once with a virus/malware I couldn't fix myself and on my dad's p.c. a couple of times, I/we phoned the $50/hour IT guy and didn't eff around with it ourselves.

Posted by: andycanuck at July 27, 2015 07:21 PM (kivUY)

78 I once dropped a box of sorted punch cards on the way to the reader. Catastrophe ensued.

Posted by: Uncle Busyhands at July 27, 2015 07:21 PM (Dwehj)

79 Been there before.

FYI - don't try to connect to/download from the internet on an infected computer. Get it offline right away.

If one of my personal computers gets a bug I 1) disconnect from network, and 2) reload. Never know where those little bastards might be hiding out.

I make backups, so reloads only take about 30 minutes. I check the router and other machines on the network while restoring.

If you MUST try to remove the virus, use a separate computer to download any tools and xfer via USB. Bleepingcomputer.com is my go-to resource.

Posted by: TSGSJeremy at July 27, 2015 07:21 PM (ef0Pq)

80 You should be allowed to put a real worm in these a'holes. Or put them in prison and let all of their new friends put their worms in their a'holes.

Posted by: Dirks Strewn at July 27, 2015 07:22 PM (QdAXQ)

81 I don't keep anything of value on my laptop. Everything important is backed up on an offline source. If they hit me, fuck 'em it's cheaper to buy a new laptop than pay their ransom.

Posted by: HUCK / AKIN 2016 at July 27, 2015 07:22 PM (0LHZx)

82 ... call us once...

Posted by: andycanuck at July 27, 2015 07:22 PM (kivUY)

83 I keep my AVG and nortons generally off. I have to keep em to placate the Mrs.....

Posted by: Draki at July 27, 2015 07:23 PM (udx6h)

84
I had the same shit - it came as an attachment to an email that looked like it came from my bank. I went a month and got my internet bill - I greatly exceeded my data limit, even though I wasn't using the computer.

I screwed around a few days and realized this was waaaay beyond me. So I took it to an actual computer shop and had them root it out. Took them 2 tries, and $150 bucks, but all seems to be well now.

Don't let ANYONE gain remote access to you computer - take it to a physical (reputable) shop for a fix.

Advice from the tech guys? Only use firefox, never chrome or windows explorer.

Posted by: Geroge Orwell's ghost at July 27, 2015 07:23 PM (HuVX+)

85 If they hit me, fuck 'em it's cheaper to buy a new laptop than pay their ransom.

#itstoughbeingabillionaire

Posted by: some random meathead at July 27, 2015 07:23 PM (QuNQQ)

86 I use linux.
I just upgraded. I can finally use my two year old wireless keyboard.
Now if only I can get skype to work again....

Posted by: Gentlemen, this is democracy manifest at July 27, 2015 07:23 PM (LWu6U)

87 85 If they hit me, fuck 'em it's cheaper to buy a new laptop than pay their ransom.

#itstoughbeingabillionaire
Posted by: some random meathead at July 27, 2015 07:23 PM (QuNQQ)

___________

You do realize an average laptop is $500, yes?

Posted by: HUCK / AKIN 2016 at July 27, 2015 07:24 PM (0LHZx)

88 And there's Hijack This that my IT guy had on my XP Pro but I see it's not on my newish 8.1

Posted by: andycanuck at July 27, 2015 07:25 PM (kivUY)

89 85 If they hit me, fuck 'em it's cheaper to buy a new laptop than pay their ransom.

#itstoughbeingabillionaire
Posted by: some random meathead at July 27, 2015 07:23 PM (QuNQQ)

Nah, that's true.

Laptops are a commodity now. You can get a Chromebook for $199 and it includes anti virus from google.

Not worth paying someone $100 an hour or whatever to try to fix it if anything goes wrong.

Just toss it and buy a new one.

Posted by: mynewhandle at July 27, 2015 07:25 PM (AkOaV)

90 I wanted to stop the Win 10 download that I had previously OKed, so I did a search on Bing on how to stop it. It involved getting rid of a certain Win 7 update. So I got rid of it. Hope I haven't screwed myself.

Posted by: Ronster at July 27, 2015 07:25 PM (47wTX)

91 Lol I love the satirical edginess of this site. I look forward to more "Murica #1" posts and the irony they portray.

Posted by: Jimmy's Wang at July 27, 2015 07:26 PM (Z8yvj)

92 I buy laptops by the truckload. I use them once and then throw them from the parapet of my castle.

Posted by: Mr. Foo Foo at July 27, 2015 07:26 PM (Dwehj)

93 Just toss it and buy a new one.

I was referring to the troll's continuous bullshit drivel about how rich he is.

Posted by: some random meathead at July 27, 2015 07:26 PM (QuNQQ)

94 You do realize an average laptop is $500, yes?
Posted by: HUCK / AKIN 2016 at July 27, 2015 07:24 PM (0LHZx)

You can find much cheaper laptops.

And I do.

I used to buy more expensive stuff, then I realized I'd rather spend $200-$300, get a few years out of it, then upgrade to the latest and greatest anyways.

Posted by: mynewhandle at July 27, 2015 07:26 PM (AkOaV)

95 Posted by: mynewhandle at July 27, 2015 07:25 PM (AkOaV)

So "Pronbook" in other words.

Posted by: Golfman at July 27, 2015 07:27 PM (48QDY)

96 Forgot to add, when xfering via USB only go in ONE direction: Clean computer to infected computer. By that I mean, you can connect the drive back and forth multiple times without having to wipe it, but only copy files FROM clean computer to USB and from USB TO infected computer.

Firmware viruses are very rare so this procedure is fairly safe as long as you don't have auto-run enabled.

Posted by: TSGSJeremy at July 27, 2015 07:27 PM (ef0Pq)

97 I was referring to the troll's continuous bullshit drivel about how rich he is.
Posted by: some random meathead at July 27, 2015 07:26 PM (QuNQQ)

yeah I know, but it's still not a bad point.

Posted by: mynewhandle at July 27, 2015 07:27 PM (AkOaV)

98 All this talk about anti-malware programs and backup programs is all well and good, but it's only treating a symptom. Publicly hang a few malware creators and all this shit will become unnecessary overnight.

Posted by: Prince Ludwig the Indestructible at July 27, 2015 07:28 PM (/51qR)

99 "You do realize an average laptop is $500, yes?"

It's not the cost of the hardware though there's that. It's the loss of data files and the time lost re-installing and resetting all of your software and OS settings. That in itself is a costly endeavor (as a time sink) if you actually use your computer for work.

Posted by: AnonymousDrivel at July 27, 2015 07:28 PM (1CroS)

100 This comment is being made from the 405th laptop I've used today, you stupid proles.

Posted by: MUCK/RAKIN 2016 at July 27, 2015 07:28 PM (LQuO+)

101 Upgrade to Kaspersky.

Posted by: Roger Bournival at July 27, 2015 07:28 PM (4Soy+)

102 So "Pronbook" in other words.
Posted by: Golfman at July 27, 2015 07:27 PM (48QDY)

ha, no, actually I use it for work.

Posted by: mynewhandle at July 27, 2015 07:28 PM (AkOaV)

103 WHEN, OH WHEN, WILL THEY INVENT A CHEETO-PROOF KEYBOARD???

Posted by: Michael Moore at July 27, 2015 07:28 PM (oVJmc)

104 the problem is that you don't know if the scammers trashed to drive, or if they loaded a virus on a site for people downloading software trying to fix a trashed drive.

The latter would be smarter, so that is probably what happened. You have a smaller group of people so it's easier to avoid the anti virus routines, and you have a market of people highly motivated to get their data back.

surely enough drives shit the bed every day to keep a couple russian scammers busy and well stocked in vodka and pickles.

Posted by: Gentlemen, this is democracy manifest at July 27, 2015 07:29 PM (LWu6U)

105 It's nick is Huck/ Akin 2016 because it operates under the assumption that the social conservatives here would vote for Huck/Akin .

See?

See how funny that is?

So. So.

Funny.

Posted by: some random meathead at July 27, 2015 07:29 PM (QuNQQ)

106 It's not the cost of the hardware though there's that. It's the loss of data files and the time lost re-installing and resetting all of your software and OS settings. That in itself is a costly endeavor (as a time sink) if you actually use your computer for work.
Posted by: AnonymousDrivel at July 27, 2015 07:28 PM (1CroS)

Get all the data you can off your computer.

physical back up or cloud back up.

Then it's much easier to start with a new computer and/or do a clean install on an old one.

Posted by: mynewhandle at July 27, 2015 07:29 PM (AkOaV)

107 Nah, that's true.

Laptops are a commodity now. You can get a Chromebook for $199 and it includes anti virus from google.

Not worth paying someone $100 an hour or whatever to try to fix it if anything goes wrong.

Just toss it and buy a new one.
Posted by: mynewhandle at July 27, 2015 07:25 PM (AkOaV)

Yeah, I don't want to sound like our resident insufferable mega-capitalists, but I go through on average a machine ever couple years. I don't buy expensive ones.

Every picture I have from every camera/phone is on an external hard drive. I have been burned more than once. Never ever ever have files on a laptop/desktop that you can't live without.

Posted by: BurtTC at July 27, 2015 07:29 PM (Dj0WE)

108 i run "NoScript" all the time, with a default setting of "block everything"...

i was checking out training films on a web site, and got this big orange screen that said they had taken over my computer, and that i'd have to pay ransom...

i laughed and closed the page, because their script never launched.

Posted by: redc1c4 at July 27, 2015 07:29 PM (pZtrP)

109 And most importantly, only patronize reputable porn sites.

Posted by: Weasel at July 27, 2015 07:30 PM (e3bId)

110 Upgrade to Kaspersky.
Posted by: Roger Bournival at July 27, 2015 07:28 PM (4Soy+)

Yeah, no. Russians.

Posted by: BurtTC at July 27, 2015 07:31 PM (Dj0WE)

111 I use old hardware and swap hard drives. Haven't had a need to use Windows for personal use for years.

Also Lastpass FTW.

Posted by: some random meathead at July 27, 2015 07:31 PM (QuNQQ)

112 Was having issues with my kindle and went online looking for kindle support and found one of these companies that looked legit.
Called up and the guy said I needed to download software to transfer to my kindl so I gave the guy remote access to my laptop and he went into my dos. He said I was a victim of a hacker and what displays on my dos screen but the word HACKERZ (sic).
I'm a computer dumbass too, but fortunately Norton would not let him load whatever crap he was trying to install.
When he tried to get me to turn off Norton I figured it was all shady so I hung up on him and unplugged my cable modem
for the rest of the day.
Dodged a bullet there I did.

Posted by: Chipster at July 27, 2015 07:31 PM (MV+uS)

113 Get all the data you can off your computer.

physical back up or cloud back up.

Then it's much easier to start with a new computer and/or do a clean install on an old one.

Posted by: mynewhandle at July 27, 2015 07:29 PM (AkOaV)

Yep. Storage is insanely cheap, and trivial to use, even if it is just a couple of USB drives in backup rotation.

Posted by: rebel flounder at July 27, 2015 07:33 PM (Vf5rR)

114 All this talk about anti-malware programs and backup programs is all well and good, but it's only treating a symptom.

Publicly hang a few malware creators and all this shit will become unnecessary overnight.

This x1000

Posted by: rickb223 at July 27, 2015 07:33 PM (vxBxx)

115 Here's some friendly advice:

Get a Mac.

Windows is one of the biggest frauds perpetuated upon the world.

This will help a giant majority of people that don't know much about computers.

Posted by: Michael Eastman at July 27, 2015 07:34 PM (aHz7f)

116 BOSTON OUT! BOSTON OUT!

I hope this doesnt mean LA is now it? Oh, well, by the time it happens maybe I'll be dead.

Posted by: Bruce With a Wang! at July 27, 2015 07:35 PM (iQIUe)

117 It had to happen sooner or later.

Posted by: rebel flounder at July 27, 2015 07:35 PM (Vf5rR)

118

Posted by: rebel flounder at July 27, 2015 07:35 PM (Vf5rR)

119 When one of my Crays gets infected I don't bother getting it fixed, I just have one of my minions replace it and throw the old one in the volcano at my hidden lair.

Posted by: Mr. Mook Mook at July 27, 2015 07:35 PM (qNvak)

120 I have found that diamond-encrusted motherboards help ward off teh viruses.

Posted by: Mr. Foo Foo at July 27, 2015 07:35 PM (Dwehj)

121 Posted by: Michael Eastman at July 27, 2015 07:34 PM

Not trolling AT ALL. lol

Posted by: TSGSJeremy at July 27, 2015 07:35 PM (ef0Pq)

122 Posted by: Mr. Foo Foo at July 27, 2015 07:35 PM (Dwehj)

Posted by: Mr. Mook Mook at July 27, 2015 07:35 PM (qNvak)

Mr Poo Poo makes it so easy.

Posted by: Golfman at July 27, 2015 07:37 PM (48QDY)

123 Update on the Planned Parenthood Hack story, that I'm very suspicious of.

Posted by: Pappy O'Daniel at July 27, 2015 07:37 PM (oVJmc)

124 mynewhandle: "Get all the data you can off your computer.

physical back up or cloud back up.

Then it's much easier to start with a new computer and/or do a clean install on an old one."

Once a virus/worm is on your system, the data is untrustworthy. Unless checksummed, you always have to consider it suspect. It's best to maintain a periodic backup and just dump everything between the last "good" backup and the current, infected system.

As to cloud, I'm not trusting my system/data to the cloud. Local copy or bust. It's a security and privacy concern I don't want out of my hands.

Reinstalling a fresh, pure OS or moving to a new computer is a major PITA. Again, settings, updates, preferences are a huge time sink when starting anew.

Posted by: AnonymousDrivel at July 27, 2015 07:39 PM (1CroS)

125
Why are they having celebrity tributes to Bobbi Kristina Brown? Her sole accomplishment in life was to do a lot of drugs, make her neighbor's and landlords lives miserable, and o.d.

Posted by: Bruce With a Wang! at July 27, 2015 07:40 PM (iQIUe)

126 Once this internet fad dies down, viruses won't be a problem.

Posted by: Weasel at July 27, 2015 07:41 PM (e3bId)

127 >>>Here's some friendly advice:
Get a Mac.<<<

Yeh, the iHal 9000 is proving itself to be 99% more hassle free and 100% less gay.

Posted by: Fritz at July 27, 2015 07:41 PM (o/UmK)

128 > What I do have is 'in the cloud'.

Oooh, that'll keep it safe.
Heeeehee. chuckle. cough. hAAAA. Haaaaaaaaa!

Posted by: GoogleDoesNoEvil at July 27, 2015 07:41 PM (hNkj+)

129 If you MUST try to remove the virus, use a separate computer to download any tools and xfer via USB

----------------------

No, don't trust USB sticks. The hackers are now overwriting the code in the USB controller chip itself. You can completely reformat the USB and the Trojan is still there, flashed right into the controller ROM.

Instead burn a DVD and finalize it (preventing further writes).

Posted by: HuuskerDu at July 27, 2015 07:42 PM (gYAkw)

130 Why are they having celebrity tributes to Bobbi Kristina Brown? Her sole accomplishment in life was to do a lot of drugs, make her neighbor's and landlords lives miserable, and o.d.

Winning!

Posted by: rickb223 at July 27, 2015 07:42 PM (vxBxx)

131 Also Lastpass FTW.

Posted by: some random meathead

About that:

Lifehacker, 6/15/15
"Bad news first, folks. LastPass, our favorite password manager (and yours) has been hacked. It's time to change your master password. The good news is, the passwords you have saved for other sites should be safe."

Posted by: weft cut-loop at July 27, 2015 07:42 PM (VY8H5)

132 @108 - "i was checking out training films on a web site, and got this big orange screen that said they had taken over my computer, and that i'd have to pay ransom..."

"Training films." Is that what they're calling those these days?

Posted by: Titus Quinctius Cincinnatus at July 27, 2015 07:42 PM (Maary)

133 Had a virus a few years ago that wouldn't let me connect to get anti-virus software to clean it. It blocked me when I used IE or Firefox, but I was able to use Opera.

Posted by: OCBill at July 27, 2015 07:43 PM (F7PsT)

134
Rules

1. Never only have one computer. Have another comp available to help you troubleshoot or fix the first one. Even a web capable phone in a pinch.

2. Run as virginal a browser as you can. Minimal add-ons, Adblock and perhaps No Script. No flash.

3. Anti-virus of your choice. And scan scan scan.

4. Set your file manager to show all extensions and never ever open a file unless you know who and where it came from.

5. C: is for OS and programs for easy flatten and re-install from back-up. Data files belong on other drives, your network or cloud.

6. Never let rdbrewer near your computer.

Posted by: Laurie David's Cervix at July 27, 2015 07:44 PM (kdS6q)

135 6. Never let rdbrewer near your computer.
Posted by: Laurie David's Cervix

7. Never follow maddog links.

Posted by: rickb223 at July 27, 2015 07:47 PM (vxBxx)

136
Never trust anyone - especially when it involves computers.

Punishment by public "cheese grating".

Posted by: GBruno at July 27, 2015 07:47 PM (u49WF)

137 Unfortunately, most computer security is a joke.

Modern viruses continuously load additional threats, and once you have one computer compromised on your network, the next thing loaded is going to be a program for it to start attacking everything else on your network. If you're on gigabit ethernet, this can be happening at amazing speeds.

I've been at this myself for two months, and I'm still learning tools and developing protocols to nail stuff down. Along the way, I'm finding out a lot of stuff that is simply amazing.....like a hardware firewall appliance that ships with insecure defaults -- or that Ubuntu ships with a very nice firewall program.....that isn't turned on until you go into command line and turn it on. Or that there is a secure DNS service -- but websites (like this one) don't use it.

Anyway -- as far as recommendations: (1) First sign of trouble, UNPLUG EVERYTHING, from both the network and the wall. (2) Pull all drives on the network and set aside for recovery. (3) Take the CMOS backup batteries out of the motherboards for about 2 days. (4) Get new factory-sealed HDs and gradually restart systems.

Once you have some systems running, you can reassess your security situation -- I, for instance, got aforementioned firewall appliance and replaced everything back to the drop. Upgrade all your routers to the latest firmware. Make sure that your routers are using appropriate security policies. It's only when you have a reasonably secure environment to recover into that you should attempt to recover data from the pulled drives.

Posted by: cthulhu at July 27, 2015 07:50 PM (EzgxV)

138 It really is a shame more people don't use Ubuntu, it's just as easy to use as Windows and these days is just as compatible with hardware as Windows, and if your router is compatible slap tomato or ddwrt on it and you'll have yourself a rockin' setup.

Posted by: All teh meh at July 27, 2015 07:51 PM (kUJnr)

139 While visiting my sister for christmas I noticed that her and her husband were a little tense. They are both drug and alcohol counselors. Seems he had the thought that she was addicted to her I-Phone and might want to apply some of their advice for addiction for her. It came up at dinner one nightt and when she asked me what I thought, I told her that yes indeed I could see the difference from the year before when her phone never left her hand. She asked what I thought and I told her the truth as far as I know. Computers are the Devil. I'm good like that.

Posted by: Tinfoilbaby at July 27, 2015 07:52 PM (Ii765)

140 Lifehacker, 6/15/15
"Bad news first, folks. LastPass, our favorite
password manager (and yours) has been hacked. It's time to change your
master password. The good news is, the passwords you have saved for
other sites should be safe."

I remember Lifehacker wanking over this story. He is a flaming lib and a self-promoting critic with a track record of 'exaggerating' his claims.

Lastpass protected most of the data.With the exception of some email information and some other items, all passwords were kept safe.

Always cracks me up when people who will order off of Amazon and use Paypal will act like Lastpass is the 'real' security problem.

Posted by: some random meathead at July 27, 2015 07:52 PM (QuNQQ)

141 USB firmware and HDD firmware attacks are increasing. You can completely reformat down to the sector level and still not get rid of it.

And then there are new attacks like rowhammer that are basically unfixable on the current generation of desktop PCs and mobile devices.

Posted by: HuuskerDu at July 27, 2015 07:53 PM (gYAkw)

142 Had similler issues with my brothers machine last week. And got the scammers on the phone for "tech help." Needless to say it was pressure to buy to and they were given control also. Well my brother blows up (not unusual every service he has from Direct TV to the water company has notes on their files about him) But me I'm more amused. So I let Apoo go on and on and I string him along until I tell him the guy with the credit card has "left the building." He didn't like that, no sir ree. Any way immediately dropped off line removed his access program, dumped files in a sweep. Answer is; drive to the computer store and buy a disk, don't download any thing. Don't go back on line until you have cleaned, swept everything and the new firewall installed. That is all.

Posted by: jrcobbstr at July 27, 2015 07:54 PM (J8Kv7)

143 137
Unfortunately, most computer security is a joke.

True.

Kind of like airport security used to be.

I prefer to keep boarding up my shit with virtual two by fours than to have a "TSA" solution forced on all of us.

Posted by: some random meathead at July 27, 2015 07:56 PM (QuNQQ)

144 No. The lesson is "Friends don't let friends use Norton Antivurs."

End of story. Get something else. Anything else.

Posted by: Computer Guy at July 27, 2015 07:59 PM (+f7nz)

145 55 Once I stopped trusting Norton and McAfee to protect my systems, that was the first step toward nearly trouble-free computing.

Posted by: Burn the Witch at July 27, 2015 07:12 PM (xSCb6)

And this. Any malware that can be detected by those two programs gets binned pretty quickly. Malwarebytes and Viper are better choices, but each will only find about 50% of the stuff potentially on your system.

Posted by: cthulhu at July 27, 2015 07:59 PM (EzgxV)

146 It's also a good idea to keep a copy of ye olde dban around instead of shelling out for a new drive dban.org

Posted by: All teh meh at July 27, 2015 08:09 PM (kUJnr)

147 A couple of weeks ago, I got a pop-up message stating my computer had been infected with malware and instructed me to call an 800 number to unfuck my computer. The pop-up had a misspelled word, so I knew it was phony. My web browser was frozen. I called Apple Computer. The tech person was able, after trying a few things, to unfuck my computer and everything returned to normal. She told me it is a scam. The scammers who introduced the malware want you to pay them to remove their malware.

Posted by: Al Sharpton at July 27, 2015 08:09 PM (oFe4Y)

148 1.Never use a Windows machine to get email.
2.If you do go to porn sites use a Linux live disk to do your browsing. Won't get infected - doesn't leave a browser history.
3. Use a router and change the frigging password on it.

This will handle the vast majority of virus problems.

Posted by: An Observation at July 27, 2015 08:12 PM (4+Zhf)

149 147
The pop-up had a misspelled word, so I knew it was phony.

Posted by: Al Sharpton at July 27, 2015 08:09 PM (oFe4Y)

Yeah, it's amazing how much spam I get with attachments that have misspelled words or questionable grammar.

Posted by: rickl at July 27, 2015 08:13 PM (sdi6R)

150 Run regular image backups of your pc, and run folder backups of the things you use most often. Keep at least three copies of everything because if its backed up once, its not backed up.

If you get creamed by a virus, restore to the image backup and then restore your most recent copy of your folders (depending on how old your image backup is). Problem solved.

Posted by: Mega at July 27, 2015 08:25 PM (9Du4t)

151 Just don't download things - especially if they promise to help you. And NEVER give ANYONE access to your computer unless you know them personally, and they are sitting at your computer, and you are armed.

You end up hiring people like me to clean it up. And, we'd really rather not - what most of you can afford to pay really isn't worth the hassle. (I'm NOT one of those who says "erase everything and reload your entire system - I end up giving directions that aren't followed because they are too much trouble, etc. Sigh.)

Sorry for the rant. I hope you are all clean now. And, yes, the FBI is an excellent place to check with -BEFORE you download anything.

And, if you get anything in snail-mail telling you you've won xx,xxx.xx dollars, please DO check with the FBI before sending them a few thousand dollars for "taxes".

Posted by: Kathy Kinsley at July 27, 2015 08:25 PM (P1Mfe)

152 I highly recommend Dr Web - it is free, and it installs with a random executable name (like hdgdbmn.exe) so the worms don't know to block it. Saved my bacon a couple times.

Posted by: Professor_Chaos at July 27, 2015 08:30 PM (VABLS)

153 I'm sorry to hear about this, RD.

Posted by: Michael the Hobbit at July 27, 2015 08:33 PM (0RdKg)

154 i miss the good old days of discovering a virus that stupidly had the IP available for me to find of their scam site and main servers they used to collect info from your machine.

I heard that you could , cough, get certain software and blast them with a DNS attack of your own. Not that I would ever do that.

I also heard that you could find certain, erm, sites and software that would robo-call their "800" number relentlessly. I hear that costs them a bit of change. cough.

Just things I heard. Not that I would ever be vindictive against these corksuckers or anything like that.

Posted by: exsanguine at July 27, 2015 08:38 PM (KcAgx)

155 Malwarebytes Anti-Exploit seems very cool

Posted by: nordishe amerindian at July 27, 2015 08:40 PM (6IyaD)

156 Malwarebytes has a root kit remover - just for future reference.

I have a routine. I use Windows Defender as my day to day anti-virus. Just because it is the most non-intrusive one out there.

On Sundays I go to Powell's Books so I start a malwarebytes scan before I leave, takes about 20 minutes so it is done by the time I get home.

Once a month I download the ESET standalone scanner and run it. It has a different scanning engine so anything that got past the first two should get caught.

I also patch religiously, which most security experts will tell you is the number one preventive measure.

I haven't had a problem in years and I visit some sketchy sites.

Also if you are really concerned about a site visit it in a vm and scan immediately afterwords (I have a laptop running Virtual Box that I can just throw away especially for those types of site) but I don't need that often.

(I know this may seem like overkill but I engage in high risk behavior online at times so I try to minimize the damage. )

Posted by: chad at July 27, 2015 08:43 PM (gYowz)

157 As someone who has needed to format numerous times in the past for viruses please let me give you what I have learned over several trouble free years.

First Norton and Mccrappy are just that..crap. I have had very good luck using AVG free for the last few years. I also use Spybot (which has an immunization function for browsers). And Malware bytes.

Next up use a boot drive full time. and a much larger second drive for files. I use an SSD for boot and its not only very fast. But with basically just the operating system on it. If I have to reinstall I have lost nothing. You may need to make some tweaks (like having media center store its files on a platter drive). But overall it simplifies things.\

And lastly use Firefox. I know about the political issues. But overall it has the best tools to deal with issues. Run Ghostery, and all the ad-block suites. I also use Web Of Trust. Which while also being overtaken by the SJW crowd at least gives you a head up of potential problems. And lastly I run FlagFox also. As most hackers dont bother with trying to fake it out. So if it shows your traffic is being routed to Nigeria. You know there may be a scam going on

Posted by: mythx at July 27, 2015 08:56 PM (uBSn/)

158 For AV, I use eSet NOD32. Works like a BAMF. Norton and MacAfee are shite. There are a couple sites...bleepingcomputer.com and majorgeeks.com that have some unbelievably knowledgeable people who can help get nearly anything off a machine. I've read through numerous threads and they do a damn fine job for free. I've used the info to clean my parents computer of root kits, Trojans, viruses, and all manor of scareware/rogueware.

I also second the motion on the VM. Here's what you should do. If you have a VM, you can make an image of it before going online. Then, if anything bad happens, just restore the VM from the previous image. Problem solved. Keep the VM patched and always create an image backup after you install anything and before going online. It sounds like a pain but you're only a restore away from problem solved.

Posted by: Jon in TX at July 27, 2015 09:00 PM (UBmyU)

159 You are using Norton, so expect viruses. I still use windows 7 with essentials. You do need Malware bites. I was going to use the free Norton with my new system. Long story short, wipe drive, reinstall. Never again.

Posted by: Spock at July 27, 2015 09:00 PM (OIRPe)

160 If you have a USB port but no optical drive, a preferred alternative to a flash drive is an SD card reader. SD cards have a write protect switch to prevent malware from making changes to the card's contents.

If you do have an optical drive available, an essential tool is an offline scanner. The best is the MRI, which is the inhouse tool for Best Buy's Geek Squad but it can be obtained from various 'places.' Make sure the version you download has been tested and verified by commenters to be clean. Preferably, use torrent that is at least a month old.

What makes it so good is that it has multiple malware detection engines. Running a thorough scan can take hours, though.

Alternately, Microsoft has an offline version of MSE for free. Make sure you get the latest ISO.
http://windows.microsoft.com/en-us/windows/what-is-windows-defender-offline

Posted by: Epobirs at July 27, 2015 09:20 PM (IdCqF)

161 MRI - http :// www.reddit.com/r/techsupport/comments/2hlj0x/tool_what_do_you_guys_think_of_geek_squads/

Posted by: chad at July 27, 2015 09:23 PM (gYowz)

162 We never allow windows to touch raw metal/silicon. Always virtualized. Snapshotted. We can always roll back.

No boot sector viri can ever take hold on a system without a boot sector.

I know you are tired of hearing Linux. Well, there's a reason why you should consider that and Mac.

This said, backups are your best friend, ever. You should make them on a schedule. Restore should always be painless.

Posted by: Bender Rodriguez at July 27, 2015 09:30 PM (80GjT)

163 The worst thing going around these days are the Crypto malwares that encrypt your drives and demand a ransom for the key to unencrypt them. The newer versions will seek out any mapped network volume the infected system can see and encrypt those as well. This is why you need a backup strategy that keeps your data in a location that cannot be directly accessed by the system when not running a backup.

I haven't heard any reports of it yet but I'm betting these nasties will soon learn to attack cloud storage. I strongly recommend to businesses and anybody who really has something to lose to get a Blu-ray burner (BD-R) drive and use that for backup at least on a quarterly basis. These hold a bit over 21 GB (they call it 25 GB but you lose a fair chunk to formatting info) on a single layer. For vital records you should make multiple copies and store some off-site, in a safe deposit box or at a trusted friend's site.

Posted by: Epobirs at July 27, 2015 09:35 PM (IdCqF)

164 Thinking of setting up a RAID 1 array.

Posted by: Rdbrewer at July 27, 2015 09:41 PM (Iyg03)

165 Could we possibly get a regular techie-type post for such things?

It's sexy as hell when all y'all lurkers and regulars talk like this, but I have no clue what it means, and I bet I'm not the only one.

VM? LiveBox? Mirror? Boot sector? Boot drive?

Rhetorical, no need to answer, just displaying my ignorance to plead my case for a regular techie post!

Posted by: Tammy al-Thor at July 27, 2015 09:50 PM (DI417)

166 The worst thing going around these days are the Crypto malwares that encrypt your drives and demand a ransom for the key to unencrypt them. The newer versions will seek out any mapped network volume the infected system can see and encrypt those as well. This is why you need a backup strategy that keeps your data in a location that cannot be directly accessed by the system when not running a backup.

Posted by: Epobirs at July 27, 2015 09:35 PM (IdCqF)

I recently did a consulting gig for a college where that bit them in the ass. They were backing up everything daily to a large online SAN, and then rolling the SAN to tape.

Yeah, the hackers encrypted the SAN and then the tapes backed up the encrypted data... ugh.

Posted by: HuuskerDu at July 27, 2015 10:10 PM (gYAkw)

167 As far as I know this is still valid

How to Avoid CryptoLocker Ransomware

http :// krebsonsecurity.com/2013/11/how-to-avoid-cryptolocker-ransomware/

Posted by: chad at July 27, 2015 10:12 PM (gYowz)

168 My experience is all based on the effort I've had to expend getting rid of this crap on my parents machine. My machine, although not running a VM, has been pretty hardy. I've only got cursory experience running VM ESX on top of Linux, and for most people, it would be near impossible. Linux, for all it's tech savvy, isn't casual user savvy. My guess though, is that you could do something nearly the same with a Windows Host running a Windows VM, so long as you stay off the internet on the Host. Maybe it's not 100% but it's probably as bullet proof as you can get in a pure Windows world.

So long as you snapshot each day, you've lost nothing more than a day's data should anything catastrophic happen.

I've always felt the best thing MS could do would be to make a virtual browser, meaning just the browser would run in a VM without direct access to the OS. In the absence of that, running all of Windows in a VM is the next best bet.

Posted by: Jon in TX at July 27, 2015 10:21 PM (UBmyU)

169 Modern browsers are sandboxed in much the same manner as VMs, however that is not a foolproof solution - even VM sandboxes can be compromised.

Posted by: chad at July 27, 2015 10:38 PM (gYowz)

170 I am a daily visitor, seldom commenter here, and I noticed something on your site a few days ago. A small symbol would be on some text within an article that looked like a "close ad" button. Shortly after seeing the second one on this site, my anti-virus did a backflip and said something about the page being block due to malware. I went to another site and returned, and all was well. Whatever you got in your machine definitely tried to get into mine. Just sayin'.

Posted by: txnixk77 at July 27, 2015 10:40 PM (38Nd0)

171 Minimum 2.5 Backups:

1 One full backup with at least weekly incrementals - start a new one every few months.

2 Minimum backup all data files to the cloud, if you have to wipe and type, at least your data is someplace safe. Plus if the martians need your machine you have an offsite copy.

2.5 Critical stuff on Google Drive / One Drive / I cloud - just do it.

In the event you get one of these ransomwares, at least you can ignore and restore.

And when I tell my clients not to open zipfile attachments, and they do, my mortgage gets paid that month too.

Posted by: Running in Ring Zero at July 27, 2015 10:52 PM (RSBhX)

172 First of all, pay the ransomware 'fee' if you want your data unlocked, don't if you want to loose it all. As perverse as it sounds, they'll honor the payment and unlock your data (which is also why the 'fee' is in the 'reasonable' range). Its a business model, it works, and if they don't unlock after payment then they go out of business because everyone would know its just another Nigerian-email- level scam. But its not a scam, its extortion: you're out $150 or so and you get your data back. All of it. quickly back up that important data to a CD, low level format the bitch - unless you've got a solid state drive - and reinstall from the original factory discs.

(an aside - all of the major pr0n sites have awesome security and are some of the cleanest sites on the net. Its pure business bro - think about it - if they were chocked full of malware they wouldn't get any business. major pr0n sites have been in business for YEARS. they ain't going to sacrifice their golden goose just for some script kiddie's shits-n-giggles. The *content* might be filthy but their back-end is legitimately top notch. But if you're trolling random pr0n sites on the dark side of the web, well then you get what you got coming to you.)

Realize that there is NOTHING that you can do to crack the encryption they've got on your system (which you technically allowed in the first place): either to pay them or let the time expire and your drives get bricked are the only two options. ransomware is nasty and its the biggest threat right now in corporate IT security; there is no 'cure' for it. Pay it, retrive the data, write off the console and the fee, fire the Administrative Assistant who got ransomewared, get bonus for being a shit hot SecAdmin.

"First, I couldn't connect to Norton." your proxy server was hax0red on your router, your Hosts table was altered on your pc, or something similar along those lines. Separate deal from the ransomware. As you mentioned, you most likely picked that up from trojanware you acquired in your futile attempts to disable the ransomeware. You basically got your dick slammed between a rock and a hard place, then blew your foot off trying to help yourself out of the mess you got yourself in in the first place.

All in all shitcan your pc, spend $300 for a refurbed quad core, plug the monitor back in and hope you learned your lesson. You've been whining about this for how many days? misery chalk one up on Lessons Learned and stay away from the w4rez from now on.

Posted by: blogRot at July 27, 2015 11:50 PM (S0+P/)

173 Yes, call the FBI, so they can show up, take you into a room, shoot you, take your computer, piss on your rug, and then cut off your JOHNSON.

Posted by: S at July 28, 2015 12:21 AM (HCXGq)

174 Also I'd like Ace to admit that ever since the Paolo story he's been using the servers to browse for cuckold porn and it's okay and we won't judge his sick perversions.

Posted by: S at July 28, 2015 12:24 AM (HCXGq)

175 Regular basis I get "your computer is sending us error messages and we can fix it." It seems to come and go. They may have given up on me but I wonder what % of (older) people (like me) fall for it. Pretty obvious it is a scam, but scams exist cause they work with some of us.

Posted by: Th3o More at July 28, 2015 12:29 AM (286Cd)

176 I have Kaspersky antivirus (current) and run Malwarebytes ad hoc.

So here is the Weird Thing. Lately, a black window has POPPED into view, never bigger than about 4 inches across, and disappearing just as fast. It looks for all the world like a DOS command prompt screen: black with white type. Appears too briefly to get a screencap.

What the hell is going on? -- anyone else seen this?

Posted by: Beverly at July 28, 2015 02:08 AM (Yx4km)

177 Oh, and RD, remember, when someone calls and says they're Scotland Yard, ALWAYS call them back, honey.

Posted by: Beverly at July 28, 2015 02:09 AM (Yx4km)

178 @176 it is probably a service or process being called via command line. If you are really interested you can download process explorer and see what opens or a program called AutoRuns

Posted by: chad at July 28, 2015 02:57 AM (gYowz)

179
510-909-0498
Anybody know who's number this is?

Hint: It is some one here, Give him a call!

O.K. Its an asshole, does that change anything?

Ask for Ms. Osama, or Mr. Beaker. W.T.D.

Call Records FTW!

Posted by: Innocent man at July 28, 2015 03:54 AM (5x+Ft)

180
My computer got infected by ransom ware, twice. I just loaded my Trend Micro Internet Security disc, after a quickphysical disconnect from the internet,and it stopped the malware anderased it.

Posted by: Speller at July 28, 2015 04:08 AM (hHs1b)

181
downloaded something called AVP Secure Search

If you don't want to feed the google monster, give duckduckgo.com a try. They have browser add-ons as well. Additionally, Kaspersky has a bootable CD/USB image that you can reboot your machine from and let it scan for problems. Good for find rootkits and boot sector malevolence.

Search for Kaspersky Rescue Disk 10

Posted by: I R A Darth Aggie at July 28, 2015 09:22 AM (1hM1d)

Processing 0.03, elapsed 0.0291 seconds.
15 queries taking 0.0112 seconds, 190 records returned.
Page size 115 kb.
Powered by Minx 0.8 beta.