Menu

Computer Scams

Fake Virus Warning

Tech Support Scams –How to spot them and handle them!

, , , , , , , , , ,

There are various ways that scammers can attempt to trick unsuspecting users into believing that they need to take action to resolve a matter that is not occurring. Being aware of the various scams that are in existence can help you prevent yourself from becoming a victim. The most common way tech support scams can occur is from a pop-up on your computer, links accessed from websites, social media, private messages, email, text messages, or unsolicited phone calls.

Pop-Up Scams

You can be on almost any website when suddenly your entire screen is taken over.  You may find yourself confronted with a blue screen and unexpected notice that there is a problem with your device. The fake error message displayed is what is considered a “tech support scam”. The false message is usually accompanied by blaring audio which attempts to convince users that there is an issue that requires them to contact “Microsoft” and to not restart your computer.

All these techniques are meant to persuade you to call the specified tech support number. In contrast, the real error messages in Windows never ask you to call a tech support number. If you do reach out to the phone number on your screen you will be reaching scammers (not Microsoft) who will instruct you to download software to your device so that they can remotely connect to you and control your device. This is VERY dangerous. Once they are connected to you, they may steal your personal information and passwords or make attempts to extort money from you. They may go so far as to lock you out of your own device until you pay their ransom.

WHAT TO DO:

Whatever you do, do NOT call the phone number on your screen. The scammer’s goal will be to gain access to your computer, your financial institution, or both. Instead, if you are on a Windows PC, you should first attempt to open your task manager to close your web browser. To do this hold down the CTRL (control)+ ALT keys found on the far-left side of your keyboard. While holding them down also press the ESC (escape) key. This will open Task Manager which will give you the ability to select your web browser (Chrome, Firefox, Edge, etc.) and then click on END TASK. Once this is done your browser will close and the false error will disappear. If this does not work, you may need to force restart your computer (hold down the power button until it shuts off). Once you re-open your web browser DO NOT CLICK RESTORE PAGES!

Phone Scams

In the classic cold-call scenario, users receive an unsolicited phone call from someone claiming to be from a company they are not. Frequently they will portray themselves to either be from Microsoft’s support team or Amazon. Sometimes users receive calls that are supposedly from the bank or credit card company. Typically, the callers will offer to help solve your computer “problems” or to alert you of fake fraudulent activity on your account.  To appear more trustworthy, scammers may use personal information obtained from public sources such as your name and address. Once they have you convinced, they may persuade you to allow them to connect to your device or to provide additional personal information.

If you receive an unsolicited call from someone claiming to be from Microsoft Support, hang up. Microsoft does not make these kinds of calls. Think about it this way, does the plumber call you to tell you your pipes are leaking? No, they don’t. They don’t know what is going on in your house and Microsoft won’t call you about what is going on in your computer either.

What to do:

If you are contacted on the phone regarding an unexpected charge to an account or card, do not give out any personal information. Should you ever receive an unsolicited phone call for computer support, you can simply disconnect from the call. When you continue a conversation with the scammers, they will make attempts to convince you that they are legitimate, when in fact they are not. Users who have already provided access to their devices to suspected scammers should consider having their computer cleaned up by a local professional they trust. If you are personally having a computer cleaned after being scammed, let the professionals who are helping you know that someone unauthorized had access to your device and ask them to remove any remote access software that may still be installed. Moving forward, you can avoid the situation by only dealing with professionals that you trust and avoid any unsolicited tech support phone calls. Victims may want to consider reporting the scam to local law enforcement. Be aware that while they can trace phone numbers often there is little that can be done since criminals often use disposable mobile phones and spoofed or stolen phone numbers.

TEXT/EMAIL Scams

Users should be wary of emails and text messages that are received, especially those that arrive unsolicited. If you receive a text message or email that includes a link outside of the email you should not use the link. Instead, if you suspect that the email or message is legitimate you should contact the sender directly by visiting their website or calling them on a phone number that is listed on your account statement. Often scam text messages or emails will send users to another website in an effort to steal personal information.  A common email scam involves fake antivirus renewals from well-known companies like Norton or McAfee. Users can tell that the emails are not legitimate by checking the sender’s full email address. The name may say “Norton” for example but would then list an email address that would not be associated with Norton such as a Yahoo or Gmail address.

What to do:

Users who receive an email or text message that is suspected to not be legitimate can delete the message or email. The message or email can also be reported as spam through the email or messaging menus. There is little that you can do to avoid these situations. Receiving junk or spam messages or emails is a lot like receiving junk mail in your home mailbox, even if you change it to something else you will ultimately find yourself receiving some form of spam or junk mail. The best thing you can do is know how to properly handle it when it does arrive.

Technology Scams: How you can protect yourself.

Technology Scams: How you can protect yourself.

, , , , , ,

Scammers are aware that technology can be overwhelming and sometimes confusing to the average user. Unfortunately, they take full advantage of this and often pray on those who don’t use technology frequently enough to catch on to their sneaky tactics. Technology scams can happen in different ways but the most common are through emails, social media, and what I consider to be “bad advertisements” or bad links found on the internet. Knowledge is power! Continue reading to learn more about the different types of scams and how you can spot them so that you don’t fall victim.

Email Scams often come in the form of phishing or presenting information as if they are a company or organization when they are not. An example of this would be if you received an email receipt from “Amazon” for a product you know you didn’t purchase. The idea behind this type of email is to get you to click on a link somewhere in the email to “log in to your account” when really the link that you click on will be for a website that might LOOK like Amazon but isn’t. This happens most frequently for big-name companies that scammers know many users would actually do business with making the emails more believable. There are a few things that you can do to point out that these emails are not coming from who they say they are. First, check the actual email address, not the “name”, the address. Sometimes you will need to hover over the name for example, “Amazon customer service” to see the actual email address which should be from an amazon.com email address. If the email address revealed is from something else like a gmail.com address or anything else then it’s not legitimate and the email should be ignored and deleted.

Social Media Scams typically arise when you receive a message or friend request from someone that you are already Facebook Friends with. Scammers will sometimes concoct a story either asking for help in some way or telling you about some special government assistance or way to get financial support. You should avoid filling out any forms with your personal information from a social media link or message, often the goal is to gain and sell your personal information. Duplicate friend requests, especially if you are already Facebook friends with the person, could be from a scammer who has infiltrated the original Facebook account, duplicated it, and is now using a new account to impersonate the user for malicious purposes. If you receive a suspicious message or friend request, you should try to reach out to the person in some other way to ask them if they created the new account and to let them know that their account might be compromised. One way you can protect your social media account is to set up additional security such as two-step verification which will require an additional code each time you log in from a new device.

Bad Links which I like to call “bad advertisements” are the leading way in which people have their devices compromised.  I call them bad advertisements because often they come in from news articles or social media links. When you end up on a page with a bad link you might have your entire screen taken over demanding that you call Microsoft or another “support number” to have your device unlocked. The problem is this is not real and can be closed by accessing your task manager and forcing the application you are using to close. If you follow the directions on the screen or listen to what the voice is saying you will let a scammer into your computer who will either try to access your bank accounts, steal personal data or both. You should never believe a pop-up on your computer if it tells you not to shut it down or restart and to call a number instead, they are telling you that because if you do restart your computer it might get rid of their fake ad and resolve your problem. If you end up having an issue like this you can access task manager by pressing Control+Shift+Escape on the left side of your keyboard at the same time. From Task Manager you can find and click on the web browser you are using and then click on end task to close the browser. If you relaunch the browser, make sure you don’t click on “reload pages” or you will end up right back on the same screen. If you go back to the same website and the issue occurs again, the website you visited may be infected and you should avoid it until they have had a chance to clean and resolve their website issues.

Computer Tips for the Everyday User

, , , , , , , , , , , ,

By Aysë Stenabaugh

As an everyday user your knowledge of how computers work, and best practices may be limited. Not to mention that technology is ever changing and can be overwhelming. Having supporting information can help you build confidence when using your devices and can make computing more enjoyable. Here are a few tips that you can use while using your computer.

  • Keep your computer software up to date to ensure that you are receiving the latest security updates and bug performance fixes possible. As scary as it may be to take a chance that things will change with an update, the risk of your software running into unresolvable problems without the latest updates are increased when your software is out of date. Most software is unsupported after 10 years or less, its best to check with the software developer or an IT professional if the software you use and the data used within that software is important to you. So that you can continue to access it without interruptions.
  • Heat and Dirt building up inside your computer can cause damage to the physical components of your machine. It’s important to make sure your device has good ventilation especially for laptops where airflow is very limited. When possible, occasionally use canned air to blow out the inside of your device or at least where the air vents are located. DO NOT use a vacuum cleaner as it creates static electricity and can harm sensitive components.
  • Be aware of scammers who are trying to take advantage of unsuspecting users. Scammers can use all kinds of methos to attempt to reach you such as phone, email, text message, social media, and traditional mail. One of the best ways you can protect yourself is to avoid anything that doesn’t make sense, if you get an email from “Amazon” stating that you purchased a $3,000 tv that you know you didn’t purchase you should immediately consider that this could be a scam. Avoid clicking on any direct links in suspected spam messages, instead in this scenario for example a user can visit the Amazon website to check order history to confirm that the order doesn’t exist. Another common scam occurs when visiting a website that is infected. Many users will experience full-screen pop-up that seemingly cannot be closed. The warning which often includes obnoxious audio claims that the device has been infected and to call “Microsoft”. The phone number provided will direct users to none other than the scammers themselves who will use scare tactics to trick users into believing their computer is infected.
  • Use two-step verification to protect your online accounts. Two-step verification is an extra layer of security that is available and sometimes required for most online accounts. When you setup two step verification you will have a password that you use to login as usual. With Two-Step verification enabled, any time you login with your account from a new device you will be prompted to retrieve a second verification code which is usually sent via email, phone call or text message. It’s extremely important when setting up two step verification that you ensure that you add the correct contact information and keep it up to date so you can continue to access your accounts. Having multiple verification methods is ideal.
  • Backup all important data on your device to a second storage location. It doesn’t matter if you use cloud storage or a physical storage device such as a flash drive or CD. If you are utilizing cloud storage make sure that all data stored on your computer is syncing to the cloud and that you have access to the account to retrieve the data later. If you are using an external storage device like an external backup or flash drive, replace the backup device if it fails to ensure that no data is lost.
  • Restart your device regularly or anytime you are experiencing a lingering issue. Many problems are resolved after a restart because programs that are causing an issue may not have closed properly when you exited them. Restarting your devices also gives them an opportunity to install the latest updates. Since the components inside a computer are sensitive to fluctuations in temperature its best to keep your desktop computers on to keep them running at a constant temperature. Users should shut down their devices if there is a potential for power outages or when they will not be used for extended periods of time. Laptops on the other hand should be turned off when not in use since they have limited airflow and cooling abilities. It is recommended that laptop users consider shutting off the device when not in use rather than choosing sleep mode which can cause the computer to go into a “limbo” power state where the device is on but will not turn on or display properly until fully powered off.

We like to think that technology works all on its own, but the fact of the matter is that as users we must give the devices the commands required to function the way that we want them to. As an everyday user you must know that you aren’t expected to have all the technology answers, take your time, and think logically as you attempt to resolve your technical problems.

Staying Secure on the Internet

Staying Secure on the Internet

, , , , , , , , , , , , , ,

By Aysë Stenabaugh

Staying secure on the internet is a lot more complicated than just having good antivirus. Good virus protection software is a good start but there are many other areas aspects of security that may go overlooked. Having good overall network security, keeping your software and account information up to date, and using a good quality search engine can have an impact as well.

No antivirus is ever going to be 100%. Why? Because the malware and viruses that they are preventing are written by cybercriminals. It takes time to determine and catch a virus and to write code that prevents it from causing damage. That doesn’t mean you should stop using your antivirus, chances are it has stopped many threats without you ever being aware that it was doing its job. Think about it as if you’re the passenger in a car. Most people will put their seatbelt on, not because they are EXPECTING to get into an accident but to help prevent injury or damage if it occurs. Antivirus works in a similar way acting as a preventative against potential damages.

Network security is important because without good security vulnerabilities on your network could leave personal data exposed or easy to access. Last year Apple released an iOS update that started alerting users who were using wireless networks with WPA/WPA2 TKIP security. The message was a bit confusing as it was meant to let users know that they were not meeting Apple’s recommended Wi-Fi security standards, instead many users thought that the notice meant their devices were unsecured which was not the case. Although the execution wasn’t great, Apple’s intentions were good. If you receive this message on an Apple device, have a Wi-Fi network that is “open” (no password required), or want to ensure that your wireless security is up to date, you will either need to access your device’s software to update security if an update is available, older wireless routers may need to be replaced to comply with new security protocols. Unbeknown to many users, like computers, routers often have firmware updates that resolve both performance and security flaws.

Keeping your account information up to date is crucial for several reasons. Your account information includes your name, date of birth, email address, and phone number. The primary reasons are to help users regain access to their accounts. This can be because you forgot a password or because someone else has gained access to your account. Not having accurate information can prevent the services you are using from verifying your identity. Facebook for example is a common target for criminals. We have seen users have their entire accounts taken over by criminals including their business page and even when you provide proof of your identity it may not be enough. So, what else can you do? Users should consider setting up two-step verification. Two-step verification requires users to both their password and a code generated either by an app or sent via text message or email. This prevents unauthorized users from accessing your account without also having access to your devices. If you do find that your account has been compromised and you are able to regain control of it, we highly recommend enabling this feature immediately.

Search engines are often a starting point for surfing the web. Not all search engines are created equal. Some search engines will allow paid advertising for content that so it’s important to choose a good search engine with good quality results. We often find that users end up with garbage on their computer related to attempting to install a device like a printer. To provide an example we searched for HP drivers on both Ask.com and Google search engines. The results from Ask.com first included 3 Advertisements for websites trying to sell a product followed by “results from the ask media group network and finally ended with web results which led me to HP’s website. The first results on Google’s search engine took me directly to HP’s website, no advertisements were listed. We are not saying that Google’s search engine is the best or is perfect, but it is far better with results than the likes of Ask.com which can easily lead users to websites that are of poor quality.

Technology is constantly changing, staying up to date with security and features can be tough. If you find yourself wanting to increase security on your computer or home network or require computer support Jester’s Computers can help! For over 20 years our family-owned, and operated business has been providing repairs and technical support services for home and business users. Find us on the web on Facebook or at www.jesterscomputers.com. We are located at 5135 Fairfield Road in Fairfield Pennsylvania and can be reached by phone call or text at 717-642-6611.

 

how to identify scammers and protect yourself

Email Phishing /Remote Support Scams

, , , , , , , , , , , , , , , , ,

IMPORTANT NOTICE:

Never provide remote access to your device to someone over the phone that you don’t personally know and trust! Scammers will often direct unsuspecting users to visit a website and will typically either ask the user for a code or will provide one for you to enter on your device. Microsoft or any other company will never directly contact you by phone or email to provide you with unsolicited support.

We have received many phone calls and service requests due to the increasing rise of email and phone scams occurring. We encourage all users to read over the following information to know what to look for to spot scams and avoid being taken advantage of.

Email Scams

Most email scams occur by the scammer emailing an unsuspecting user impersonating a legitimate company or one of your email contacts.

Never respond directly to emails claiming you placed an order you don’t recognize or that you owe money or are owed a refund. This has been the most common scam recently, many users report receiving emails that appear to be from an antivirus supplied such as Norton or Mcafee claiming that automatic renewal for their products is enabled and that you will be billed. Other times users receive emails for an order that they did not place showing delivery for an address that is unfamiliar. Users that respond to the email, click on any links, or call the number listed are often asked to provide sensitive information and/or remote access to your device. Scammers have gone so far as to make it appear that they have accidentally deposited funds into your bank account and at times will even attempt to guilt the user into believing their “mistake” will cost them their job. At this point in their scheme, they will instruct the users to reimburse them for their mistake, typically by purchasing prepaid gift cards which are untraceable once cashed.  In reality, no money has actually been deposited into the user’s account as they are providing false images that are misleading the unsuspecting user.

Click here to read what Norton has to say about phishing emails involving Norton.

Check the sender’s actual email address not just the name displayed. Often scammers use email addresses that are similar to the actual email address but not exact. For example, an email from Amazon would always come from an @amazon.com email address not something slightly misspelled like @amacom.com. If you get an email from someone that you normally correspond with via email but they aren’t speaking in a manner that is consistent with their normal behavior, are making spelling errors, or are asking for “favors” it is possible that the sender’s email account has been compromised. We have also seen scammers create new email addresses (most commonly outlook.com accounts) that are identical in spelling except for the @outlook.com portion. If you suspect you’re receiving emails from someone other than the actual sender do not respond instead reach out to the sender in another manner and let them know. If you believe your email has been compromised you should change your password immediately. If you suddenly stop receiving emails that could also be a sign that your own account has been compromised and that emails are being redirected to the scammer’s email address.

Phone Scams

A plumber would never call you to tell you that your pipes are leaking, Microsoft or any other tech support company is not going to call you to tell you that your computer is infected or that you have a virus. (The only exception to that is if you personally signed up for a service that involved your device being monitored. Many of these services offered are scams and we only recommend subscribing to these types of services with local companies that you know and trust in person.) Remember a scammer will do WHATEVER IT TAKES to convince you that something is wrong and that if you don’t follow their instructions that either you or they will be in some sort of trouble.

Pop-Up Scams

If you are on the internet and suddenly find yourself unable to do anything except to seemingly call a phone number for support you are likely visiting a malicious website or one that has been compromised. While you are on your computer if you are receiving notices in the corner of your screen that something is wrong, you have a virus, or need to renew your antivirus you should be aware that many of these notifications are providing false information. Even if you are unable to get rid of the notifications or pop-ups on your own, you should never click on any links or call any phone numbers associated with these notices. Instead, you can reach out to your local computer repair shop (us included!) to have your computer cleaned up and to have any remote software removed.

Text / Instant Messenger Scams

Anyone who has your phone number or email address (or randomly selects your number or generates your email address as a sender) can attempt to reach you. While you can block a specific email address or phone number it doesn’t stop these things from occurring in the first place. It’s important to never believe any messages or notices you receive that sound too good to be true. For example, a popular scam on social media websites occurs when users are led to believe they are going to get something free or that they are requesting some kind of information often for things that are too good to be true. Scammers often take advantage of unfortunate situations such as the rental market shortage or those looking for work at home opportunities.

If you find yourself falling victim to a scam involving your computer, you should immediately disconnect from the internet until you have confirmed that your device is free of remote software that could leave you even more vulnerable. At Jester’s, we offer our clean-up/maintenance service for a flat rate of $99, contact us for support or more information.

stop

SCAM ALERT: Protecting yourself from rising Amazon & Comcast email scams

, , , , , , , , , , , , , , , , ,

By Aysë Stenabaugh

Unfortunately, scammers are finding new and clever ways to trick unsuspecting users into providing access to sensitive personal information. The most common methods continue to be via emails, phone calls, and sometimes text messages. It can sometimes be difficult to determine which ones to take seriously and which ones to ignore. At Jester’s Computer Services we hear of just about every new scam that comes along. Read on to learn a few tips to help you spot a few common scams, how to protect yourself and what to do if you do find yourself involved with one.

Amazon has become a frequent target – scammers know how many people use the retail giant and they’re using it to their advantage. The most common Amazon scams typically involve an emailed purchase confirmation for an item that you clearly did not purchase which will also be addressed to a physical delivery address that is not yours. This is an example of phishing and emails like these, as well as similar emails from Amazon (and other businesses and online retailers) that warn you of “fraudulent activity” or other account concerns should be investigated but with caution.

If you receive a notice for a purchase that you don’t recognize or if you are ever asked to click a link including to verify your account security, pause and be on alert for the following indicators of a scammer. First, check the email address that the email is From, not just the name itself. Be sure to check on the full @xyz.com address and pay extra CLOSE attention to subtle misspellings. An email from Amazon or any other big organization is not going to be coming from a public domain like Gmail or Yahoo, they should come from amazon.com for example. Second, if the email contains an attachment, you can almost bet it’s a scam, definitely don’t open any attachments! Third, you can check the “reply-to” email address and ensure that it matches the from address. If all three check out you can still visit the website in question directly rather than via any links within the email. If the notification is legitimate, you should be able to locate the notice from within your account on their website.

The same concept applies if you were to receive a phone call from “Amazon” or any other individual who calls that wishes for you to provide personal information including but not limited to; your address, date of birth, social security number, or a code obtained from a website or software in order to provide remote access to your device. Instead, hang up the phone, do not provide the caller with any information, or engage in conversation with them. If you are concerned that the call is potentially legitimate the caller should understand if you tell them that you will call them back at a more convenient time. Do not call the number back that called you or any phone number that the caller may have provided. Instead, find a verified phone number to reach the company by using a billing statement, by using a quality search engine such as Google or, by finding the contact information on their website. Even if a caller comes up with a legitimate Name and OR phone number, they could be a scammer.

Comcast users have been a huge target for scammers as of late. Their latest trick once they gain access to your email account via a compromised password is to forward all of your emails to a new email address with the same username but a different domain, usually outlook.com. For example, if your email address was abc@comcast.net the email address the scammer would create to forward your emails to would be abc@outlook.com. In addition to doing this, the scammers are creating a filter rule which redirects any new emails to your correct email address into the inbox and is deleted. As a user, you may notice that you stop receiving emails all together or you might notice that only your usual contacts aren’t responding to your emails at all. What the scammers are actually doing is emailing your contacts in an attempt to extort them for money. They don’t do so in an obvious way. They might for example, request that the email recipient send a gift card to them as a favor since you’re out of town and need to get a birthday gift for a family member. If you notice this happening to you change your email password right away and notify your contacts NOT to respond to the email. If they have already, ask them to change their password and inform them that they too should notify their contacts.

To be clear none of the above indicate that any security breach to your device has occurred unless you have given someone access to your device, clicked on a link or if you opened a malicious attachment. Anyone can access your email account from anywhere if they have the email address and password as is the case in the Comcast scam mentioned above. Comcast users should also note that any emails received from a comcast.net email account are NEVER correspondence from Comcast themselves. All emails from Comcast the company will come from a comcast.com email address.

If you have been the victim of a scam, Jesters Computers can help; whether you require a Cleanup of your device, advice, or one-on-one support. Contact Jester’s Computers located in Fairfield by calling or texting 717-642-6611, emailing customerservice@jesterscomputers.com, or by visiting us on the web on Facebook or www.jesterscomputers.com

 

 

 

Beware the phone scams!

,

If you get a call out of the blue from someone saying that they have detected your computer has a problem and/or infection, hang up the phone. Microsoft or any computer manufacturer would not and will not ever call you to speak with you about an individual problem. Furthermore, they will never ask for your credit card or personal information so don’t be foolish and give it out regardless of how convinced you are that they are trying to remedy a problem with your computer system.

Tech-support phone scams are designed to trick you into downloading malicious software, take control of your computer remotely and adjust settings to leave your computer vulnerable or request credit card information and bill you for any services or commit identity theft. These phone-based scams have been around since 2008 and the scammers are using more sophisticated social engineering tactics to make them appear to be legitimate.

Here are some of the ways that they are currently trying to trick people:

Your caller ID may say “home security” or something to that effect and includes what appears to be a valid number. In the past if you were to ask them for a phone number and name so you could call them back, they would hang up. Today, they will gladly give you their direct extension and name in an effort to get you to let your guard down. If you try to call the number to verify it will generally ring busy.

If they can convince you to stay on the line, they quickly try to convince you that your computer has been compromised by having you run some diagnostics yourself as proof. If you follow their instructions they can easily trick the non-technical victim into believing that their computer is infected and allow them into their computer to remotely fix it. They are so convincing that people were paying $250 or more when the supposed service has been completed, when all along, they just use common files and tools to make it look like you had major problems.

For example; If the plumber in your neighborhood called you on the phone and said that they had to make an emergency service call because they have detected that your upstairs bathroom toilet is leaking, would you believe them? Would you then ask yourself how could they possibly know that? That is no different from someone calling you and telling you that you have a problem with your computer.

A good rule of thumb is if you did not initiate contact to have services performed then it is most likely a scam to help you part with your hard-earned money. If you have fallen victim, call your credit card company and dispute the charges. Your money should be returned to you. You should also take your computer to a professional to have the remote software and/or any malicious software removed from your system.

If you are in need of PC computer repair or services please visit Jester’s Computer Services located at 5135 Fairfield Road, Fairfield, PA. You can also reach Jester’s Computer Services by phone at (717) 642-6611 or send an email to: customerservice@jesterscomputers.com

For help with learning how to use a PC computer, mobile technology, web design, or graphic design contact Jester’s Computer Tutor for help! You can also visit our website at www.thecomputertutor.info or like us on Facebook to receive free tips and tricks! You can contact the tutor via email at help@thecomputertutor.info or by phone at (717) HELP-4-ME or (717) 435-7463

By Bob Jester

Protect your data now

, , , , ,

In the last few weeks we have received a half a dozen computers that were infected with a type of ransom ware that attacks your Word documents and Excel files. One of the computers also had the picture files infected. If you get infected with this ransom ware you will lose all access to your files. The infection will have to be removed but the damage to your data is irreversible. If you do not have a backup of your data to restore, your files are lost.

CryptoWall is a file-encrypting ransom ware program that was released around the end of April 2014 that targets all versions of Windows including Windows XP, Windows Vista, Windows 7, and Windows 8.

When you are first infected with CryptoWall it will scan your computer for data files and “encrypt” them using RSA encryption so they can no longer be opened. Once the infection has encrypted the files on your computer drives, it will open a Notepad window that contains instructions on how to access the CryptoWall Decryption Service where you can pay a ransom to purchase a decryption program. The ransom cost starts at $500 USD and after 7days goes up to $1,000. This ransom must be paid in Bitcoins and sent to a Bitcoin address that changes per infected user.

CryptoWall is distributed via emails with ZIP attachments that contain executables that are disguised as PDF files. These PDF files pretend to be invoices, purchase orders, bills, complaints, or other business communications. When you double-click on the fake PDF, it will instead infect your computer with the CryptoWall infection and install malware files either in the “AppData“ or “Temp“ folders. Once infected, the installer will start to scan your computer’s drives for data files that it will encrypt. When the infection is scanning your computer, it will scan all drive letters on your computer including removable drives, network shares, or even Drop Box mappings. In summary, if there is a drive letter on your computer CryptoWall will scan it for data files.

When the infection has finished scanning your computer, it will also delete all of the Shadow Volume Copies that are on the affected computer. It does this because you can potentially use shadow volume copies to restore your encrypted files.

Now that your computer’s data has been fully encrypted, it will display the DECRYPT_INSTRUCTION.TXT and DECRYPT_INSTRUCTION.HTML files that were created on your Desktop. These files contain information about what has happened to your data and instructions on how to pay the ransom. In most cases, once CryptoWall launches this document it will remove the infection files from your computer, as they are no longer necessary.

Unfortunately, at this time there is no way to retrieve the private key that can be used to decrypt your files without paying the ransom on the CryptoWall Decryption Service. Brute forcing the decryption key is not realistic due to the length of time required to break an RSA encryption key. In addition, any decryption tools that have been released by various companies will not work with this infection. The only methods you have of restoring your files is from a backup, file recovery tools, or if you are lucky from Shadow Volume Copies.

In summary, even if you have a backup drive those backup files will be encrypted also. We would suggest that you only attach your backup drive during the backup and then remove it. DVD’s are a good choice to back-up your data on as they cannot be altered. System images are also a good choice because individual files cannot be accessed.

Unfortunately, their antivirus did not protect the infected machines that we serviced. Norton, McAfee, Microsoft Security Essentials (not a very effective antivirus) and Avast were ineffective. AVG (which we use and recommend) has so far not been tested. So you must protect your data now or take a chance on losing it. Good luck.

If you are in need of PC computer repair or services please visit Jester’s Computer Services located at 5135 Fairfield Road, Fairfield, PA. You can also reach Jester’s Computer Services by phone at (717) 642-6611 or send an email to: customerservice@jesterscomputers.com

For help with learning how to use a PC computer, mobile technology, web design, or graphic design contact Jester’s Computer Tutor for help! You can also visit our website at www.thecomputertutor.info or like us on Facebook to receive free tips and tricks! You can contact the tutor via email at help@thecomputertutor.info or by phone at (717) HELP-4-ME or (717) 435-7463

By Bob Jester