Jump to content

Rich-M

Member
  • Posts

    165
  • Joined

  • Last visited

  • Days Won

    8

Everything posted by Rich-M

  1. That's the easy way! Unfortunately I wish it was predictable or even explainable.
  2. Have a read: https://social.technet.microsoft.com/Forums/en-US/8988575b-32fb-46fb-bd8e-dd9aaafa9903/windows-10-anniversary-update-error-code-0xc1900107?forum=win10itprogeneral
  3. Usually there is a resume or Update icon left on your desktop when you are interrupted but if you start the update again it should pick up what you have already downloaded.
  4. Well of course everything is one word answers, they text everything and anything. No one talks anymore. If there were another way to text all the wireless phone companies would go out of business.
  5. I forgot to mention I normally would take the drive out and copy the files and data before doing this but that was not necessary as the user had two backup hard drives.
  6. Had one of the most badly infected computers I have ever had. Client wasn't sure where this came from but could have been an attachment to an email from someone he knew who he found out later didn't send it. System was Intel 6700K with 500 gb Ssd drive and 16 gb 2133 Ddr3 ram moving like a snail. Most of the desktop items would not open to right or left click. Classic Shell start menu gone and Win 10 start menu would flash quickly then go away if open too long. I tried to run Hitman Pro Kickstart from usb but would not run. I could boot to it but would show up failed with any choice. I fought hard and finally managed to open a score of rkill programs and picked back some speed and was able to run some scans. Rogue Killer removed 7 Trojans but system began to slow down. Hitman Pro found next to nothing, Malwarebytes MBar rootkit scan found nothing as did Malwarebytes which was also onboard as pro version along with WD as only defenses. Adw Cleaner pulled a few as did JRT but nothing much. Zemana found nothing and of course Combofix will not run in Windows 10. I kept having to rerun rkill versions when system would begin to slow again. Each time I would access my flash disk I had to go in another way because the last way in was blocked next time. So I decided it was a losing battle and manged to get into System Reset which beautifully restored Win 10 to day 1 with the files and data in tact I simply had to reinstall programs. PC Setup, Recovery and Update,Recovery, Reset Pc and you can choose with or without current files. It took about 1 hour to complete. I forgot to mention System Restore had only 1 restore point which was of no use and I noted System Restore defaulted to 250 Meg which is really stupid. I never knew what was in there but whatever it was I have never seen such a powerful virus basically that nothing could touch and I have been doing this 15 + years.
  7. Nice reference: http://www.howtogeek.com/163452/everything-you-need-to-know-about-the-blue-screen-of-death/
  8. You will be able to as it will remember, install this tool: https://www.microsoft.com/en-us/software-download/windows10/
  9. OK so it is now up to Windows 10? I am so confused.
  10. Using a Windows dvd cannot give you the updates you were trying to do, it probably just returned you to prior to the updates then.
  11. 2 points for that one Ace!
  12. Somehow we always wind up one up but who knows what the future will bring.
  13. He really does look incredible for his age....
  14. If you add the two together it still does not equal the real price on Sept 2015 in many cases and after all what is the appeal.What was announced was $5000-10000 initial payment and then value of car as of Sept 2015. I have a 2015 and what I show offered is 3475 + 20,000 buy back price. So where is $5000-10,000 initial add both and you get the price Sept 2015. My daughter has a 2012 Diesel Passat and same story....under $4000 cash which can be applied to having the repair done to their hoax software for about that price or $4000 +$12000 and her vehicle was worth $16,000 Sept 2015. Total screw job by gov't and VW.If you don't like the deal there is no one to appeal to. Great Job VW for themselves....crime can pay!
  15. In addition to that Gary also suggests this that makes sense to me: For a computer running Windows 8 or later, another powerful command line utility users can run is the Deployment Image Servicing and Management tool that is used to service a Windows installation. Similar to the System File Checker utility, you can use DISM to correct corrupted system files and determine the status of the system. Press Windows key + X Click Command Prompt (Admin) Type each command at the prompt then hit enter after each scan is complete) Dism /Online /Cleanup-Image /CheckHealth Dism /Online /Cleanup-Image /ScanHealth Dism /Online /Cleanup-Image /RestoreHealth
  16. Fabiansomware: when hackers lose it In Security Knowledge by Haylee on September 2, 2016 | Русский, Italiano, Français, English, Deutsch Cybercrime has existed for as long as the internet has. However, 2016 has well and truly been the year of ransomware. New ransomware families are popping up weekly and the Emsisoft Malware Lab battles them daily on the frontline. As a result, our lab is often at the receiving end of hate from authors of such ransomware. This was the case a few months ago when we were able to break the amateurish code that makes up a ransomware family known as Apocalypse. Recently, the hate has become more personal and directly focussed at Fabian, our CTO and head of Emsisoft’s Malware Research Lab. Abusive comments have been embedded directly into Apocalypse’s malware. They recently even named their most recent strain ‘Fabiansomware’ in his honour. So, why are we being targeted? Online, Fabian is a comical malware hunter who shares decryption tools and online security advice. At Emsisoft, he is the head of our malware lab. He and his team investigate new threats, develop new -and adapt existing- protection technologies and makes sure our users are protected from current and future malware threats. Why it’s getting so personal In June 2016, we published an article after the lab broke three variants of Apocalypse and shared a free decrypter to all Apocalypse victims. Since then, the lab has broken six new variants. Currently, the malware authors are changing their malware to try to stay a step ahead of our lab and other malware hunters online. Currently, it takes us only an hour or two to break the new variant. And the insults continue. The abuse has become so offensive we won’t share it here but it can be seen on Fabian’s twitter account. Apocalypse’s crush on the head of our lab has become so out of control that in their newest variant, the contact email has been listed as fabianwosar@mail.ru Essentially, their idea is to try to blame him for the most recent strain. It has been working to some degree as can be seen in this sprightly conversation between Fabian and a very unhappy victim. So looks like the Apocalypse degenerates decided to rename their project to Fabiansomware. They fell hard for me. pic.twitter.com/pYkXp1vEap — Fabian Wosar (@fwosar) August 29, 2016 A bit about Apocalypse The Apocalypse ransomware was first seen on the 9th May 2016. The main attack vector is weak passwords on insecurely configured Windows servers running the remote desktop service. This allows an attacker to use brute force to gain access and means they can easily interact with the system as if they had access in person. Abusing remote desktop has become increasingly common over the last few months, especially for running ransomware like Apocalypse. The earliest variants install themselves to %appdata%\windowsupdate.exe and create a run key called windows update to both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. This variant uses the .encrypted extension. A ransom note is created for every file in the form of *filename*.How_To_Decrypt.txt. The dr.compress@us1.l.a/dr.compress@bk.ru/dr.jimbo@bk.ru/dr.decrypter@bk.ru email addresses are used in the ransom note. On June 9th, another version of the Apocalypse was discovered. This variant uses a different location, run key name and email address. The ransomware installs itself to %ProgramFiles%\windowsupdate.exe, and creates a run key called windows update svc. The email address used in this variant is decryptionservice@mail.ru. On June 22nd, the newest variant was discovered, which changed a lot more. Instead of using windowsupdate, it uses firefox as a name instead. The newest version installs itself to %ProgramFiles%\firefox.exe, and creates a run key called firefox update checker. The new extension is “.SecureCrypted” and new name for ransom note *filename*.Contact_Here_To_Recover_Your_Files.txt. The email address used is recoveryhelp@bk.ru. Our lab continues to find and crack new strains. What you can do The most important line of defense is a proper password policy that is enforced for all user accounts with remote access to the system. This applies to rarely used accounts created for testing purposes or by applications as well. Apocalypse and many other families spread via Remote Desktop Protocol (RDP). If you are a small business owner or even a large company, make sure your RDP and remote control ports are closed. Even better would be to disable Remote Desktop or Terminal Services completely if not required or at least to use IP address based restrictions to allow the access to these services from trusted networks only. http://blog.emsisoft.com/2016/09/02/fabiansomware-when-hackers-lose-it/
  17. Gary suggested I suggest Running sfc /scannow from an elevated cmd prompt. Search for ".cmd" and then right click the answer and choose "run as administrator" and then type in "sfc /scannow" and hit "enter" on keyboard.
  18. Gary sent me this and I haven't had a chance to look at it and of course he cannot post his own thread here: https://www.tekrevue.com/tip/disable-charms-bar-windows-8/ as a way to disable Charms Bar....I am excited to dig into that!
  19. I am not suggesting you do this but in a similar case I just shut down and restarted to discover the update was complete but it wasn't showing on screen. Definitely wait 24 hours before trying that.
  20. Well we always do even if we start disliking it....The one thing I have yet to figure out is how to totally disable the "Charms Bar". Anyone know how?
  21. I have actually started liking Windows 8 as well, though it doesn't look much different when I get done altering it.
×
×
  • Create New...