5 Reasons why PC's Crash

CryptoWall Virus

So i got the pleasure of meeting this wonderful virus today while at work. I would sat this is one that beat me, i was only able to reformat to remove. i can say i tried everything though, every application from www.Bleepingcomputer.com and most AV scans i could find.

So what is CryptoWall?

CryptoWall is a file-encrypting ransomware program that was released around the end of April 2014 that targets all versions of Windows including Windows XP, Windows Vista, Windows 7, and Windows 8. The media is commonly confusing CryptoWall with the CryptoLocker infection, when it is much more similar to the CryptoDefense ransomware. The most apparent similarity being that CryptoWall's Decryption Service is almost identical to the one for CryptoDefense. In October 2014, the malware developers released a new version of CryptoWall called CryptoWall 2.0.

When you are first infected with CryptoWall it will scan your computer for data files and "encrypt" them using RSA encryption so they are no longer able to be opened. Once the infection has encrypted the files on your computer drives it will open a Notepad window that contains instructions on how to access the CryptoWall Decryption Service where you can pay a ransom to purchase a decryption program. The ransom cost starts at $500 USD and after 7days goes up to $1,000. This ransom must be paid in Bitcoins and sent to a Bitcoin address that changes per infected user.

CryptoWall Ransom Note

CryptoWall is distributed via emails with ZIP attachments that contain executables that are disguised as PDF files. These PDF files pretend to be invoices, purchase orders, bills, complaints, or other business communications. When you double-click on the fake PDF, it will instead infect your computer with the CryptoWall infection and install malware files either in the %AppData% or %Temp% folders. Once infected the installer will start to scan your computer's drives for data files that it will encrypt. When the infection is scanning your computer it will scan all drive letters on your computer including removable drives, network shares, or even DropBox mappings. In summary, if there is a drive letter on your computer it will be scanned for data files by CryptoWall.

When CryptoWall detects a supported data file it will encrypt it and then add the full path to the file as a value under the HKEY_CURRENT_USER\Software\\CRYPTLIST Registry key. It will also create the DECRYPT_INSTRUCTION.TXT, DECRYPT_INSTRUCTION.URL or INSTALL_TOR.URL if infected with CryptoWall 2.0, and DECRYPT_INSTRUCTION.HTML files in each folder that files were encrypted and in the Windows desktop. The DECRYPT_INSTRUCTION.TXT and DECRYPT_INSTRUCTION.HTML file contain information about what happened to your data and the DECRYPT_INSTRUCTION.URL is a browser shortcut to your assigned decryption page on the infection's decryption service, which is discussed later in this guide.

When the infection has finished scanning your computer it will also delete all of the Shadow Volume Copies that are on the affected computer. It does this because you can potentially use shadow volume copies to restore your encrypted files. The command that is run to clear the Shadow Volumes is:

"C:\Windows\SYsWOW64\cmd.exe" /C "C:\Windows\Sysnative\vssadmin.exe" Delete Shadows /All /Quiet

Now that your computer's data has been fully encrypted, it will display the DECRYPT_INSTRUCTION.TXT and DECRYPT_INSTRUCTION.HTML files that was created on your Desktop. These files contain information about what has happened to your data and instructions on how to pay the ransom. In most cases, once CryptoWall launches this document it will remove the infection files from your computer as they are no longer necessary.


Information about CryptoWall 2.0

In October 2014 the malware developers released CryptoWall 2.0, which resolved some problems in the original version. These changes include developer run Web-to-TOR gateways, unique bitcoin addresses for each victim, and secure deletion of original unencrypted files. These changes are described below:

Unique bitcoin payment addresses - The original CryptoWall utilized the same bitcoin payment address for many of its victims. This allowed people to steal the payment transactions from other victim's payments and use them towards their own ransom payment. By utilizing unique payment addresses for each victim it is no longer possible to steal other people's ransom payments.

Developer run Web-to-TOR gateways - In the past, the CryptoWall developers were utilizing other organization's Web-to-TOR gateways so that victims could access their payment servers that are located on TOR. When these organizations discovered that CryptoWall was utilizing them, they blacklisted the CryptoWall payment servers so that could not be reached. To resolve this, the CryptoWall developers appear to have created their own gateways to TOR. These gateways are currently operating under the following domains: tor4pay.com, pay2tor.com, tor2pay.com, and pay4tor.com.

Secure deletion of original data files - When the CryptoWall originally encrypted a file it would simply delete the original version. This made it sometimes possible to use data recovery tools to restore the original unencrypted files. CryptoWall 2.0 now utilizes a secure deletion method that makes it no longer possible to recover your files via data recovery tools.


Sample of the txt file:

What happened to your files ?
All of your files were protected by a strong encryption with RSA-2048 using CryptoWall 2.0.
More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)

What does this mean ?
This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them,
it is the same thing as losing them forever, but with our help, you can restore them.

How did this happen ?
Especially for you, on our server was generated the secret key pair RSA-2048 - public and private.
All your files were encrypted with the public key, which has been transferred to your computer via the Internet.
Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server.

What do I do ?
Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed.
If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist.
For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below:
1.https://paytordmbdekmizq.torsona.com/1hoxegs
2.https://paytordmbdekmizq.poltornik.com/1hoxegs
3.https://paytordmbdekmizq.dogotor.com/1hoxegs
4.https://paytordmbdekmizq.torforlove.com/1hoxegs

If for some reasons the addresses are not available, follow these steps:
1.Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en
2.After a successful installation, run the browser and wait for initialization.
3.Type in the address bar: paytordmbdekmizq.onion/1hoxegs
4.Follow the instructions on the site.


IMPORTANT INFORMATION:
Your personal page: https://paytordmbdekmizq.torsona.com/1hoxegs
Your personal page (using TOR): paytordmbdekmizq.onion/1hoxegs
Your personal identification number (if you open the site (or TOR 's) directly): 1hoxegs

Remove Fake Antivirus

One of my favorite tools, works usually well, as well as one could hope. you run this, then scan your pc with AV and boom, Virus Gone!

What is Wysebrowser.exe and How To Fix It?

working guide remove fff5ee.com

I got the fun time of playing with this for 9 hours today, what a big pain in the neck. Really was not a happy day. Also, when you look up how to remove you get to page to use SPYHUNTER. Let me say this SPYHUNTER is total junk, you cannot remove anything without paying, even then you will still not be able to remove the infections. After all that, as if it wasn't bad already, removing requires you to use REVOunistaller because the uninstalled provided nor windows will remove it. JUNK!

shellshock attacks mail server

Rant: SEO's Biggest waste of money, time and resources a company could spend

I am going to add an article i found below, but I personally wanted to add my distaste for these companies. If you are going to enlist the services of  a SEO you might just go ahead and wipe your ass with that cash. There is nothing that a SEO can do that no semi-tech smart person can do, and if you can search on Google you can defiantly find out how to.

SEO is a complete waste of time
http://performinsider.com/2013/05/seo-is-a-complete-waste-of-time
Written by Pace Lattin
May 9, 2013 # 10:16 am # Marketing Insights, Specials # 42 Comments

There is so much out there about Search Engine Optimization (SEO), including complete publications that just focus on how to optimize, strategize and theorize about SEO.  Entire companies make millions on convincing people that their entire plan should be about SEO so much that they need to hire “experts” to optimize their pages to such a degree that they need to spend more money than they could ever make in return. From reading the publications and expert blogs about SEO, you’d that if you are not thinking about SEO all the time, you are going to completely fail at anything you do online.

Here’s the truth that no one wants to tell you: SEO is complete waste of time.

Many people are going to read what I wrote and proclaim immediately that I am nothing but a total jackass and they are the real expert in SEO and know exactly what is going on.

On a weekly basis I have some “expert” with a blog sending me an email, telling me what I am doing wrong about SEO, and how my publication is completely fucked up from an SEO standpoint, that I am not getting any traffic whatsoever from search engines and they are happy to tell me how I should be running my business.

Here’s a few facts:

1) PerformInsider.com gets almost 1-2k people a day from search engines, mainly google. I have spent almost no time thinking about SEO. We are not even two years old.
2) We get traffic from keywords about SEO, including SEO Tip type articles, and we are not a SEO centric publication
3) Performance Marketing Insider makes more money than almost any publication in the industry based on our traffic and content. We are so successful that are several websites that are completely dedicated to making fun of us this publication.

Here’s probably what you also don’t know about me:
1) I have owned three publications about online advertising in the last 10 years, two of them existing before the word “blog” was even used, and have always been on the top of many search engines without knowing about SEO.
2) I have owned an advertising network that did $100M in revenue in one year. We were in the top 20 comscore networks for several years. We received a great deal of business from search.
3) I have never taken a single SEO class, read a single book about SEO or even gone to a SEO conference. I just have always made good content, done great promotions and focused on business. Yes, I read SEO articles sometimes.

Still, you are probably going to say, “But you need to still be concerned about SEO somewhat, right?” Yes, of course.

I’m not the biggest fan of Jeremy Schoemaker (and I hear he’s not exactly hanging posters of me on his wall) but he knows what he is talking about:

Shoemoney, Jeremy Schoemaker, SEO Sucks

Do basic things to ensure your site is optimized the best, consider the layout, and probably get some good plugins that have great reviews. Still, the focus should be on making great content that drives visitors and makes you money. If you are focusing on SEO from the start instead of creating a real site with real quality content, then you are going to have a sustainable business or site.

The other thing you need to consider is that SEO rules keep on changing. What will show up in search seems to change every day, and those who are making sites specifically for SEO are finding their business models often thrown out the door. However, every business I have made that is content based has survived and made a lot of money no matter what, because what I am doing is focused on content, not on a quick buck.

Even if the rules weren’t changing, what the experts say will work seems to be completely contradictory.

Yes, there are various design things you need to consider, how you link pages – but there are tons of plugins that will do that for you. Even the experts find themselves often being screwed when it comes to SEO because they are..umm.. over-optimizing for SEO. They are so concerned about SEO and how to optimize that they create a site that is only made for SEO and google bitch-slaps them really hard in return.

If you want to know what you really, really need to know about SEO, we actually have an article written by one of the experts. Uh-huh, he has his own publication about search engine marketing and optimization, but without having to hire an expert, read an entire book or attend a webinar, you are going to learn pretty much all you need to know from this one article called 5 SEO Tips You Should Know to Survive in 2013. Really.

Now, go make money, build content and ignore what most the experts are telling you, especially if they want you to buy something, rent something, attend something. Buh-bye.

Take care, and if you disagree, feel free to comment and tell me why.

And by the way, Penn Jillette is one my neighbors and has the craziest-ass house I’ve ever seen.

—-
Get Free Mobile Optimization of your offer

Written by Pace Lattin

Pace Lattin is one of the top experts in interactive advertising, affiliate marketing. Pace Lattin is known for his dedication to ethics in marketing, and focus on compliance and fraud in the industry, and has written numerous articles for publications from MediaPost, ClickZ, ADOTAS and his own blogs.