Re: Cannot work with my own files after system change (XP Pro SP3)

Article View: microsoft.public.security.homeusers

Article #4

Back to microsoft.public.security.homeusers Previous Next

From: David H. Lipman
Date: Tue, 23 Mar 2010 22:52

41 lines
4015 bytes

From: "FromTheRafters" <erratic@nomail.afraid.org>

| "fixfox" <mluisebay@googlemail.com> wrote in message
| news:d1d77f21-d018-499d-a7e6-dab1f60d32c0@r1g2000yqj.googlegroups.com...


| ...nowhere I read that it did damage on files, specially by encrypting
| them (In this case, it would be called a virus).

| ***
| It would be called a virus if it replicated via infection. If it was a
| virus, and also encrypted your files, it would be an instance of
| cryptovirology *and* ransomware if it wanted payment for the decryption
| key.
| ***

| [...]

| The wicked system
| did not tell me that I would have to store my certificate or else I
| would surely have done it. I am a security fan.

| ***
| IIRC W2K's EFS, by default, assigns the administrator as a recovery
| agent (sort of like a backup key). but gives no warning to the user
| about the importance of key backup. Vista and beyond do *not* assign a
| recovery agent by default, but do advise the user about key backup.
| ***

| [...]


Trojans employong cryptovirology have yet to use EFS to encrypt users data 
for ransom.  They use their own encryption engine.

Example:  GPCode

-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

Technical Details

Message-ID: <8f-dnY-FtIu82zTWnZ2dnUVZ_gmdnZ2d@giganews.com>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail

References:

#gXwpndyKHA.5940@TK2MSFTNGP02.phx.gbl <22ad9909-e13b-402b-806c-26be69e7bfb7@t23g2000yqt.googlegroups.com> <872da17c-0318-4491-a582-fc014b216cbf@t20g2000yqe.googlegroups.com> <Mradna5iLeUpUzrWnZ2dnUVZ7vqdnZ2d@bt.com> <7ceb2815-fb36-42d8-a9b2-539025485084@q15g2000yqj.googlegroups.com> <B4SdnbwdW588lzXWnZ2dnUVZ8umdnZ2d@bt.com> <ho92kh023q6@news3.newsguy.com> <D42dncm1268wjjXWnZ2dnUVZ8hBi4p2d@bt.com> <237m77-5r6.ln1@fully.qualified.domain.name> <17udnewtQvuM5DXWnZ2dnUVZ8nmdnZ2d@bt.com> <n8bm77-1d7.ln1@fully.qualified.domain.name> <183b9642-3d46-4059-8d49-a279cdb8dfc9@z35g2000yqd.googlegroups.com> <ZMydnXc0_sSGAjXWnZ2dnUVZ8qKdnZ2d@bt.com> <d1d77f21-d018-499d-a7e6-dab1f60d32c0@r1g2000yqj.googlegroups.com> <hob7fb$hte$1@news.eternal-september.org>

Show Full Headers

Complete Article Headers

X-Google-Thread: 216722,eb1841bc6909b741
X-Google-NewGroupId: yes
X-Google-Thread: faa3c,fc8a51b333c04ed9
X-Google-NewGroupId: yes
X-Google-Attributes: gid75a5d47e0,gid4e777fa27a,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news2.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!news.giganews.com.POSTED!not-for-mail
NNTP-Posting-Date: Tue, 23 Mar 2010 17:52:17 -0500
From: "David H. Lipman" <DLipman~nospam~@Verizon.Net>
Newsgroups: microsoft.public.security.homeusers,24hoursupport.helpdesk
References: #gXwpndyKHA.5940@TK2MSFTNGP02.phx.gbl <22ad9909-e13b-402b-806c-26be69e7bfb7@t23g2000yqt.googlegroups.com> <872da17c-0318-4491-a582-fc014b216cbf@t20g2000yqe.googlegroups.com> <Mradna5iLeUpUzrWnZ2dnUVZ7vqdnZ2d@bt.com> <7ceb2815-fb36-42d8-a9b2-539025485084@q15g2000yqj.googlegroups.com> <B4SdnbwdW588lzXWnZ2dnUVZ8umdnZ2d@bt.com> <ho92kh023q6@news3.newsguy.com> <D42dncm1268wjjXWnZ2dnUVZ8hBi4p2d@bt.com> <237m77-5r6.ln1@fully.qualified.domain.name> <17udnewtQvuM5DXWnZ2dnUVZ8nmdnZ2d@bt.com> <n8bm77-1d7.ln1@fully.qualified.domain.name> <183b9642-3d46-4059-8d49-a279cdb8dfc9@z35g2000yqd.googlegroups.com> <ZMydnXc0_sSGAjXWnZ2dnUVZ8qKdnZ2d@bt.com> <d1d77f21-d018-499d-a7e6-dab1f60d32c0@r1g2000yqj.googlegroups.com> <hob7fb$hte$1@news.eternal-september.org>
In-Reply-To: <hob7fb$hte$1@news.eternal-september.org>
Subject: Re: Cannot work with my own files after system change (XP Pro SP3)
Date: Tue, 23 Mar 2010 18:52:16 -0400
Organization: DHL
MIME-Version: 1.0
Content-Type: text/plain;
 format=flowed;
 charset="iso-8859-1";
 reply-type=response
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Windows Mail 6.0.6002.18005
X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6002.18005
X-Comment-To: FromTheRafters
X-Debug: On
X-Face: #!*YlHW<3BNQH,W(*HlLHp!!3C^o,W53`lH?w!P/BI9U&X#l41]a]{(_lFi9uvKIhejF;N7"3{((o^}#4TsAASuyib+4gO;T`p'iU-gC?0Lj'1MyYrhAWCVxHKD~0Jqt9=du~_{E+uqoYt4O$L?M:a>s4@)NMgJjld$%3QOzA[8
FL-Build: Fidolook 2007 (HV) 6.0.6000.97 - 22/5/2009 19:59:07
Message-ID: <8f-dnY-FtIu82zTWnZ2dnUVZ_gmdnZ2d@giganews.com>
Lines: 42
X-Usenet-Provider: http://www.giganews.com
X-Trace: sv3-I5x7ugggQNts1ZKTOpg6EN3Xixjwx6xHf34M1yxq/2fgLb/u/f5i9v1d0NuaNkaKmImQQ4xlsvTiguU!Ae8pcBkjmjxMLTwczVKpZ9fwrLBMzmp4sO7YnKyZ+4kiWaP4rkxLK8a/q8qoPp+dJi22KN+1oy4S
X-Complaints-To: abuse@giganews.com
X-DMCA-Notifications: http://www.giganews.com/info/dmca.html
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40

Reply to Parent Message