Reflections on a previous post

A week or so ago I posted about a rogueware/ransomware problem (specifically Trojan Horse Cryptic.AM, aka av.exe etc), and since then I've recieved a lot a traffic to this blog from people going to that specific post. 

This makes me a little uneasy, for a couple of reasons.  The first is that this must be a fairly common problem people have, otherwise why the interest?  The second is that it could be people are striking out trying to find a solution, and I don't think that post really provides any repeatable type solution for this issue. 

While Patti Anne & I both have computer backgrounds, neither of us are (were, rather) computer security professionals.  Between us we have a fair amount of training, knowledge & experience in how systems work, but neither of us have Computer Science degrees.  (I have a degree in History - pretty cool, huh?)  I guess what I'm getting at, for anyone who may be searching for answers on how to solve a rogueware/ransomware problem, is we are not experts.   It is quite possible that we just got lucky on this one. 

My advice is to routinely back up any data files, pictures or anything else that is important to you.  Don't forget your favorites.  We have a little external drive we bought at Wal-Mart, and we back stuff up to that. It's a very simple thing to do.  Scan your drives every day (and don't forget to scan your back up drive, at least everytime you put something on it).  Also, be very careful about clicking links inside blog posts. 

And although it seems like common sense to me, it bears repeating - never, ever send money to these people. It will not solve your problem, and to make matters worse, you will give criminals your credit card info.  If it comes to it, it is better to reinstall the operating system and restore your back-ups.  I had to do that late last year - and as a side benefit I found the old PC runs a lot quicker than it used to.

Baltimore From the Inner Harbor, a few summers ago

My Thoughts on Flying

The really neat thing about flying is that when you get off the airplane, you're in someplace completely different. 

Other than that, I really don't like to fly.

Marley & Pickles - the Dogs

Marley the Dog came over for a visit with Pickles the Dog a couple of days ago, and they played like maniacs.  Well Pickles is a maniac, I think Marley would have been happy to sit around and chew on a rawhide bone. 

Marley is the tall dog in the foreground, and Pickles is the one partially hidden by a cushion of a partially torn-up couch.  Partially torn up by a couple of dogs chasing each other and bouncing off it. 

It is amazing how two fairly good sized animals can run such tight circles around chairs and coffee tables, then turn around and do it all backwards, without knocking too much stuff over.

A good time was had by all, and only a little bit of blood was spilled.  Pickles was quite tired for quite awhile afterwards and as every dog owner knows, a tired dog is a good dog.

Rogueware fixed (maybe) - Trojan Horse Cryptic.AM

Our very own Patti Anne managed to get things working yesterday evening.  We both have computer backgrounds, and we both know (yes, even me) that most problems can be solved.  This stuff doesn't happen out of thin air, it's not magic.  It came from somewhere, it exists somewhere, and it can be dealt with.  This can be a challenge however.  You have to have some skills, and frequently some good fortune.

So here's what happened:

- A pdf pops up out of nowhere
- Something called Windows XP Anti-Virus Pro starts running, warning me that I have all kinds of problems
- XP Anti-Virus Pro wants me to register their product (i.e. send them money)
***Don't ever send these people money. It will do no good. Personally, I'll remove my hard drive and smash it with a hammer before I send any money to someone who has hijacked my computer.
- My normal anti-virus software is disabled
- I am unable to download anything
- I am unable to do a system restore
- XP Anti-Virus Pro perfectly mimics Windows Security
- Everything it warns you about is bogus

If you search google, you can find out all sorts of info about this program, with instructions on how to remove it.  My problem is, they all involved downloads of anti-virus software at some point, and I could not download anything.  It effectively disables all your protections and makes it impossible to go online "safely".

Patti Anne took a different approach to the problem. On another computer she typed in "cannot run mbam.exe" (some additional anti-virus software we have), and "a virus has taken over my computer".  She got different information.

So here's what she did:

- she created an "Avira" rescue CD on an non-infected computer
- she put the rescue CD in the CD drive on the infected computer
- she booted up the infected computer in safe mode
*** I have to remember that "safe mode" is F8, not F-anything else.  Also, Patti Anne is not sure that the rescue CD actually did anything.  Just keep that in mind
- from safe mode, she was able to do a system restore to an earlier date
*** I know this worked, because my desktop wallpaper changed; also it's significant, because I could not do a system restore normally.
- at that point we could execute malwarebytes (full scan)
- also, my normal anti-virus software, which had been scheduled to run earlier but didn't, kicked off.

Malwarebytes came back clean - it didn't find anything.

My other software did find something - "Trojan Horse Cryptic.AM", and removed it.   I looked in the history and found that this software had kicked off as scheduled hours earlier, but ended abnormally, with an error message saying its log file was corrupted. Further searching showed that the software had actually found this trojan the first time it had started, in a different location, and had also removed it.  The scan still ended abnormally, and my computer was still infected.

I can't begin to describe how uneasy I feel about all this.  I do not feel secure at all.  Neither of us are a 100% sure that this particular issue is solved. We don't know if this "Cryptic.AM" was the culprit or not, though it seems a likely suspect.   But we've got an online business going, so we need to keep on trudging along.  At the moment, everything appears normal.

This stuff is apparently quite well known, so neither of us understands how it gets past firewalls and our anti-virus software. (I use anti-virus to mean everything, trojans, spyware, adware, etc., just so you know)

Any comments or ideas about this will be very welcome.

Here we go again - more Rogueware & Ransomware

I don't know what it is about me and viruses.  Or perhaps it's trojans, worms, malware, whatever.  I don't know what it is.  Once again my computer is unusable.

I wasn't doing anything weird.  Well, I was for me - for some reason I decided to check out the Drudge Report.   I don't really like the Drudge Report, not for any reasons that are important, but for completely superficial reasons.  I don't like the font it uses.  It irritates me.  But, there it was on my favorites so I decided to check it out.

I don't think I even clicked a link on the site.  I was just staring at it wondering why I was there, when a PDF file began loading.  I remember thinking, "why is a pdf file loading?"  That was the wrong thing to do. The right thing to do would have been to pull the plug.  Not push the button, but pull the plug, immediately switch off the power, no matter how unadvised that normally is.

A few seconds later I recieved warnings that my firewall was turned off, and a scan from something called "Windows XP Anti-Virus Pro" begin running, finding of course, a million evil things, which for the most part, I'm sure don't exist.  It perfectly mimics windows security, except it wants me to register the product.  I didn't do that, because then it's going to ask for money, and there is no way I'll send money to whoever I'd be sending it to.

As seems to be common with these things, it disables the normal anti-virus type software I run, and I don't seem to be able to do anything about it.  It also doesn't allow downloads, system restores, etc etc etc etc etc. This makes it very dangerous to spend any amount of time online.

This little post is coming to you via my laptop, the one which the system thinks has counterfit software on it.  It doesn't.  When I switched security software awhile back, that message popped up, and I cannot find the key used when the software was orginally loaded.  So screw it.

Anyway this little PC seems to come in very handy as a back up. 

So I guess I'll have to run down to Ron the Computer Guy down on Main Street, 'cause I can't figure out how to fix it on my own.  This is the 2nd time in the last 2 or 3 months, so this can't continue to happen. 

But I don't know what to do - it is extremely frustrating.  I don't know how to keep this from happening or how to fix it when it does.  The security software is apparently useless against this.

Alcohol Sales in Valdese - Election Update

Well, I am surprised.

The online version of the Morganton News Herald is reporting that voters passed all the initiatives for alcohol sales in Valdese.  The results are unofficial, but here are the numbers.

The vote for beer sales passed 1,054 to 514.
The vote for wine sales passed 1,051 to 512.
The vote for an ABC store passed 998 to 560.
The vote for liquor by the drink passed 1,034 to 533.

Turnout was just over 50% - not bad for a dinky little election in an established democracy.

The reason I'm surprised is based on everything I saw, I didn't think it stood a chance.   It was not only the amount of signs around against the measure greatly out numbered the signs supporting the measure.  We received a phone call from a group wanting to ask "survey" questions about it - they just happened to be from the East Valdese Baptist Church.  And we (and I assume everybody else in town) received a flier pointing out the evils of alcohol just before election day.  This did not have a return address on it, but it doesn't  take much brain power to figure out where it came from.  My impression, and it may have been inaccurate, was that the people opposed were much more organized, felt much more strongly about it, and had a lot more money than the people who supported it.

North Carolina went for Barack Obama in the last presidential election, and now the citizens of Valdese have voted to allow alcohol sales.   If this isn't proof that the end of time is near, I don't know what is.  (SARCASM - I know sarcasm doesn't always come over well in emails and blogs, so I wanted to make sure everybody understood.  This is me being sarcastic.  Real proof of the end of time is this cold weather we've been having).

This will probably bring new business to town, and I guess allow a couple of restaurants to serve beer or wine if they want.  It will be interesting to see how that plays out.   It's not going to be the apocolypse that those who were opposed predicted - after all you can take a short drive to Morganton or Hickory and buy all the alcohol you want, by the case or by the drink.   But there will be some changes in town. 

Meanwhile, I am surprised. 

I did go and vote today - IN THE SNOW!!  Then I went to Food Lion, the scariest grocery store on earth, but that's a whole other issue.