Last Friday was an enjoyable day… (no, it wasn’t.)
I had yet another customer site get infected with a ransomware virus. When you have a virus infection that affects a few computers, it can disrupt business, particularly small business.
In this case, it was a single workstation that was infected with a variant of the Cryptowall virus. It appears that the user had clicked on an email or a website disguised as a sales order that contained a link to an executable which contained the virus. The virus package included a Tor client so that it could communicate with its perpetrators. It hid so that it could only be found with the workstation rebooted in “Safe” mode, and only then after hidden files…
