Notepad documents were fine. Now scrambled????

Blit said:
Hi
To answer the question about virus hiding in system RAM. While a machine is running, yes. But once shut down, no. You do have nightmares like root kits, virus hiding outside allocated disk space, CMOS, BIOS and other exotic stuff. Some more imagined than real (and some very, very real). Some malware likes to hide on USB sticks. Some hide inside pictures or video! Remember a picture is just code, and within that code can be malware.

After an infection observe the machine carefully and check out its operation. Look carefully for any suspicious behavior. For complicated malware run any programs you can get your hands on against it. You will be surprised that the third time you run the fifth program you have tried, BINGO, it will find some more malware. this is one reason that it takes time to find and kill this stuff. Pros have better intuition and maybe have seen it before. Pros can work faster with better results. But it is the same for everyone. Look for symptoms and then cures.
Click to expand...

Thank you again to everyone. Lots of smart. helpful people on this site.
I am getting ready to physically swap out my c: drive after many scans to an older backup. Since my media drives have photos and video that weren't encrypted I am still concerned (after clean scans) about something hiding there.
 
Hi

Not sure I exactly get what you are saying above - sorry. But here is a general hint. If you have "might still be clean drives" and are going to expose them to a just cleaned, "maybe not so clean drive", then the hint is to unplug the "might still be clean drives" and install the "maybe not so clean drive" and watch it for a bit. If nothing horrible happens then you can plug your "might still be clean drives" in one at a time.

Or maybe you are replacing your C: drive with an older one? Then you are afraid of the remaining drives infecting it? (Reminder if programs aren't on the C: drive they will have to be reinstalled). Usually infections stay on the primary (C:) drive but I could see an encryption malware being coded to spread to other drives. It would make sense in an evil way. If you have an old clean C: drive you could clone it and then install the clone keeping a clean original.

A couple of really basic general hints. Make sure your system is fully patched. Operating system, Programs, and browser plug-ins. Especially FLASH... Malware can't exploit a vulnerability that has been closed.

Go into Programs and features and sort programs by install date and see what weird recently installed stuff is sitting in plain sight. Like "I_Am_A _ Horrible_Virus.exe"...

Usually malware and other bad stuff will act up sooner rather than later. Unless you have been co-opted into a zombie army for denial of service attacks. But that doesn't sound like your machine. So if it looks okay and acts okay for a bit when you push all the buttons and watch, then it may very well be okay.

BEST LUCK.
 
combatentropy said:
2. Normally run as a Standard User, not an Administrator. In other words, you need two user accounts: one for normal use, named like firehawk, which is a Standard User; and one named like Admin which is an Administrator user account. Log in as Admin only to install something. Log in as firehawk to edit videos, surf the web, check email, etc. Viruses run as the logged-in user. If the user doesn't have the right to install something, the virus can't install itself. This simple rule is a central part of industrial-strength operating systems like Unix, Linux, and BSD. Some daring and I guess very smart computer guys use only this technique. They have no antivirus software installed, not even on their Windows computers, and they have never caught a virus.
Click to expand...

I have a question on this. If I create a Standard User account, it still has access to the shared folders -- "Shared Documents", "Shared Videos", "Shared Pictures", etc. -- from my Administrator account. Would this still allow this hostageware stuff to hop across to my Admin account?
 
Hi

I am not an admin... But I think you can find the answer to your question here ->

http://www.howtogeek.com/school/windows-network-sharing/lesson1/2/

You may need to read further lessons to get your answer.

So the answer, as so often is the case, is it depends. It depends where your folders are and what permissions they have. You have Sharing Wizard, Advanced Sharing, and corporate networked Windows machines use a much more powerful authorization and authentication program called Active Directory. Figure out which one you are on and then where the folders are stored and then what permissions they have, and then you have your answer.

Standard User can be good advice. The downside is how often you need Admin privileges. It can be a pain. Another security trick is to not share anything. I isolate (no sharing) my development machine this way. Other machines can't get in easily and poke around. So I don't have to worry so much about everyone and every machine on the network, just mine.

Hope this helps. I also want to say your advice has helped me many times. THANKS.
 
Thanks again everyone!
My C:> drive has been replaced and updated with missing software. I checked the program install dates and it all is working great so I pulled the internet cable.
Turns out that even though I hadn't had time to do a full backup recently before the attack, my somewhat redundant behavior had resulted in many files on various external drives and flash drives so I ended up losing fewer files than originally thought. Now I am going to figure out how to get the rest of my software (mostly Adobe) to show up on my new Standard user account.
 
(1) Chrome, (2) Standard User, (3) some kind of antivirus*, and one other thing: (4) the MVPS Hosts file --- a little tricky to install, but it makes me happy every day.

I believe a few simple steps should be enough for almost everybody. I know we're talking your security, but I believe it should be something that even a non-geek should be able to hold in their head. Otherwise, if it's too complicated, they won't do it.

---

* Antivirus. Windows 7, you can download Microsoft Security Essentials. Windows 8 and 10 (coming out in a couple of months) rolled it up into Defender and preinstall it. Hopefully that's all you need. You can install others. But (1) no antivirus software is 100% effective, no matter how many you install and (2) there's a funny thing about antivirus software: some of them slow down your computer so bad it's almost as bad as having a virus (Symantec, at least a few years ago). Plus the yearly subscription renewal and various pop-ups get annoying. I guess getting a virus would be even more annoying, but I'm for keeping it simple. Remove Java, Flash, Adobe Reader, other needless software.

Cutting the cord between the editing machine and the internet is, I guess, taking my strategy of simplification to the next level. But that's taking it to an extreme that's hard to maintain. Most software updates are over the internet. Sometimes you need to share a file with somebody for work. It gets to be a real pain. No security is 100% absolute. It's always a balance of security and convenience. Absolute computer security would be turning the thing off and never using it ;)
 
Last edited:
Hi
Really nice post above from combatentropy. couple of comments. Yes have a browser without any add-ons for most browsing. One with add-ons for when you must (yes, Chrome is a nice one). Standard user, and Admin when you must if you don't mind having to switch back and forth. His comment about some anti programs really slowing down your machine is very true. With Windows 7 64 bit (which you say you are running) I recommend Microsoft Security Essentials for anti virus and Malwarebytes (free version) for anti malware. You will not notice any slowdown of your machine.

Windows 8 and 10 are mentioned. For video editing it is not always best to upgrade your operating system. Carefull research is warranted to see what software might not be compatible. Windows 7 64 bit is really good and I might wait till a new machine before doing a clean install of a new operating system. Usually a clean install is the way to go instead of an upgrade, but that also should be researched. Audio and video software is especially complex and works with traditionally delicate (GPU I am looking at you...) parts of the machine. So changing operating systems can be especially problematic. Audio and video software often lags behind in being compatible with newer operating systems, sometimes even against what it says on the box (that is it works, but is buggy).

Cutting the internet cord is pretty extreme as mentioned above but lots of editors do do it (Most don't). You can plug it in when you must.

All in all I am glad your problem worked out to not be so bad for you. In general some great posts above that can help many people. Some choices to be made but I feel that the choices have been well explained. Nice to have several obviously very experienced IT types respond.

Best luck to you
 
You must log in or register to reply here.
Back
Top