Old Microsoft Syndication Site Hosts Redirect Malware
I have some earlier versions of mcbsys.com online more or less for fun and as historical archives. Today I discovered that when you visit one of them, it redirects to …
A Good Phish Is Bad to Find
Today, in my Microsoft-hosted email account, I received an email telling me that my Office 365 account needs validation and has been temporarily suspended. I know that’s baloney because I …
The Noisy Virus
Mom called. She had done an Internet search using Internet Explorer 11 and wound up with this in her browser:
Crypto Viruses: the Online Stickup
You may have heard of a resurgence of the CyptoLocker/CryptoWall ransmomware viruses. These make me nervous because they can actually encrypt the files on your drive, making them unreadable and …
PowerShell Script to Run a Program Once
I want to deploy CryptoPrevent Portable using the MaxFocus RMM tool. CryptoPrevent sets up software restriction policies to keep programs from running in certain locations. However, it doesn’t actually install …
MaxFocus Script to Check for CryptoWall Infection
The CryptoWall ransomware virus is getting a lot of attention lately but this is one angle I haven’t seen covered: how to get an alert in the MaxFocus (formerly GFI) …
Block User Folder Executables
One suggestion for blocking the Cryptolocker ransomware virus is to prevent execution of *.exe files in the %AppData% folder and its subfolders. I wanted to make the restriction a little …
Lenovo System Update UNCServer.exe
I had a moment of panic this morning when I discovered UNCServer.exe running on my Windows 7 workstation. I thought it was a VNC server, which could allow external control …
Phony AT&T Bill
Got a pretty realistic-looking AT&T billing notice this morning. So how to tell it’s phony? Well beside the fact that I’ve never had a $634 phone bill, all you have …
Getting through Malware Monday
A government-supported workaround to the 2007 DNSChanger virus will expire on Monday, July 9, 2012. To see if your computer is infected, visit www.dns-ok.us. If you are infected, run a …