Encryption Virus (Again!)


Note: To avoid the encryption virus, please don’t open attachments on emails that are generic or suspicious in anyway. Please back up all your files every week or so and then detach the backup drive. If you do get the virus, please turn off all your computers immediately and call us at Ducktoes. 403-219-3031.

Encryption Virus Strikes Again
Ducktoes has again helped a client (web design and SEO client, not IT client) recover their files encrypted by an encryption virus.  And again the client paid the ransom. They thought they could not successfully operate their business without de-crypting the files, since it would have been exorbitantly expensive or impossible to manually remake them all. They couldn’t even remember what all the files were, much less recall the content.

Try Not to Pay
If not absolutely necessary, I don’t recommend paying the ransom for decryption.  If no one ever paid the ransom, the cyber-criminals would stop creating and spreading the viruses. But in this case, I totally understand.

Employee upset after laptop gets the encryption virus.

It is a difficult decision whether or not to pay the ransom for the encryption virus.

How They Got the Virus

The clients got the virus through email. An employee opened an email attachment that purported to be an “invoice” but really contained one of the encryption viruses in the attachment.  Once opened, the encryption quickly virus spread to the client’s network and encrypted a hard drive containing all the scheduling and accounting information.

Emails floating through air as envelops. The encryption virus comes through email.

Encryption virus comes as an email attachment.

The Clients Call Ducktoes for Help
Not understanding what was going wrong with their computers, the clients called Ducktoes. They thought they were just missing a program and because of that the the files wouldn’t open.  Human dynamo and very personable manager Colin Forrest immediately went into action. He went into one of their computers remotely to check the situation out and saw the encrypted files. He recognized the encryption virus since we’ve dealt with it many times before.  The virus had changed all the Word and Excel files to the mp3 file format making them impossible to open. Colin told the clients to turn off their computers immediately.  His immediate remote call and quick thinking saved them many files.

At the time I was picking up parts at our wholesale parts supplier.  When Colin called me to tell me what was going on, I immediately drove to the clients’ office.

Emergency Onsite Call
Upon arrival, I turned off the router so the virus would not spread further and assessed the damage.  Two computers and the external hard drive were infected.  Two others had started to be infected but the files had not been encrypted yet.  I brought the computers to the shop and put them in quarantine and we were able to remove the infection.  Don’t remove the infection before you get the contact info of the cybercriminals so you can pay the ransom if you need to.  Whenever we remove viruses from an encrypted computer, we have to make sure the infected computers are in quarantine on their own separate network, because the virus spreads quickly.

Waves coffeehouse where there is a bitcoin exchange.

Where BitNational is located.

Paying the Ransom
To ransom the files I had to take cash to a bitcoin exchange office office called BitNATIONAL, located in a Waves Coffee House on 17th Ave SW and 9A St. SW.  I was a little nervous because it seemed I was dealing with the underworld.  I was.  Our long time onsite tech extraordinaire Raz Rydstrom, and one of the smartest people anywhere, met me there since he is familiar with the process. The ransom was $500 US plus the bitcoin office fee.  It totaled $770 Canadian. With labour costs, the clients had to pay around $1500 for decryption and virus removal.  It is a hefty price for opening an infected file.

A photo of Matt and bitcoin exchange office.

Here is the BitNational office.

BitNational Helps Us
BitNATIONAL has a specialized ATM called a BTM which put the digital currency on my smartphone. Two great and friendly guys Matthew Haddon owner and Jason Butler partner and employee were working that day. The other owner is Drew Glover. I found them very helpful and immediately felt less nervous.

About BitNational
There are many BTMs throughout Calgary and other Canadian cities. Find one near you.

 Jason and Matt standing by their BTM machine.

This is Jason and Matt standing by their BTM machine.

BitNational bought out another bitcoin exchange service called Bit Brains. Matt and Jason believe that bitcoin is a great investment and only starting to take off and will go up in value.

BitNATIONAL owner Jeff shows how bitcoin will take off but wearing an orange Nasa suit.

Here’s Jason in a NASA suit demonstrating how bitcoin is going to take off. They don’t have the helmet yet.

BitNational only does the currency exchange to and from bitcoin.  They are a legitimate business and not involved in any way with the cyber-criminals.  They are entrepreneurs in a pioneer sector.  BitNational-logo

A Nervous Moment
Back at the shop, we paid the ransom and then discovered that the websites to communicate with and pay the encryption virus creators had disappeared.  This caused a  panic moment for me. I had already paid the money and worried I might not be able to retrieve the decryption code since the cybercriminal’s websites had vanished. Yet one of my techs, Garett Belkie, was able to install a Tor browser and retrieve the code that way.  Then he decrypted all the encrypted files on the computers and hard drive. Our hero. (Another awesome senior tech, our data recovery and virus removal specialist.  He can get data off a stone and remove viruses in a twinkle of an eye.)

Here’s another blog post about how I personally saved a law office from a encryption virus in 2014 before most computer IT support companies even knew what encryption viruses were.  It is a very exciting story.  Lol. I was my own hero.

Returning the Computers
Once the files were decrypted, we removed the encryption virus and returned the computers and reinstalled everything to the network.  Tech Rey Berse and I did this together. He’s a brilliant soft spoken senior laptop tech (he specializes in hardware and circuitry, soldering and electronic circuits etc. and software, a total computer genius) and an incredible onsite tech with our onsite IT support too).

Photo of a laptop with chain and padlock symbolizing laptop virus.

Ducktoes can help your unlock your files.

Sometimes We Don’t Need the Ransom
Using guidance learned from Bleeping Computer, we have actually decrypted certain strains of the encryption virus ourselves without paying the ransom.

The Ducktoes Team is More than One Tech
You get more than the skills and knowledge of your one IT support tech at Ducktoes. You may only see one tech, but you are getting much more.  You are a getting an entire group of techs at your back that are constantly learning and upgrading our computer repair and virus removal skills.  We work together as a team to solve and prevent computer problems, so when you hire us, you are getting an entire team of problem solvers and computer experts all educated at SAIT. We are constantly researching computer issues and learning new skills, the encryption virus prevention and removal being one of them. The pool of our combined knowledge and skill makes us a formidable force against viruses and computer problems.  Among us we know hardware including difficult laptop hardware including soldering motherboards and capacitors, fixing laptop screens, jacks and video and wifi hardware, server issues, networking, virus removal, crisis prevention, backup, data recovery, and anything you throw at us.

Two techs work on computers at Ducktoes.

You get a team of computer experts at Ducktoes.

Smiles and Laughter
It was really rewarding and fun to return the computers and data all fixed and working well so our clients could return to business as usual.  Now that they are IT clients we have them backed up to the cloud with Dropbox so this will never happen again. There was a lot of smiles and laughter while we worked and finished up with them.

Encryption Virus Experts
Ducktoes Computer Services has become an expert on the encryption virus. We’re experts on removing it, de-crypting it, and preventing it. If you need help with the encryption viruses, or any virus, we’re the best choice in Calgary since we’ve specialized in virus removal and prevention for years.

If You Need Us
If you need Onsite IT support or virus removal or any computer repair or support at all, call our team at Ducktoes.  We’ll bring smiles and laughter back to your office or home.

facebooktwittergoogle_plusredditpinterestlinkedinmailfacebooktwittergoogle_plusredditpinterestlinkedinmailby feather

An Awesome Tech at Ducktoes

I feel so lucky and pleased that Ducktoes has partnered with the Spectrum Advantage of Autism Calgary. We were even filmed for a special news story on CBC. We’ve hired awesome computer repair techs through them who are absolutely wonderful in fixing laptop and desktop computers and soldering motherboards, retrieving data, and many other tasks. We enjoy working with them very much.

CBC News at Ducktoes Computer Repair Shop

One of these techs, I’ll call him Steve, did a fantastic, even miraculous job with a ssd, i.e, a solid state drive. A client brought in the broken drive that unfortunately contained three years of baby photos on it.  They were not backed up anywhere else.  So the client had lost all her baby’s photos and was devastated.

Before coming to Ducktoes, she had taken the drive to a couple of other data recovery labs including a clean room, with no luck.  Our senior data recovery expert, who usually can get data off of anything, also couldn’t retrieve the data.

We recovered data from a solid state drive.

Here is a solid state drive. We do data recovery everyday.

Steve asked me if he could take the drive home and work on it. I agreed, thinking it couldn’t possibly make the situation worse. The next morning when Steve came to work he said, “Cathie, I’m sorry but I’m going to be a little tired today. I stayed up all night working on the ssd but I got those baby photos.” I  was so surprise and happy I hugged him. He said he’d soldered the circuitry and got it to work again.

A baby in baby recliner, a photo we recovered in our computer repair lab.

When the client found out, she also wanted to hug him. He said no.  He did accept a well earned tip from her.  Steve has also retrieved data off a client’s iphone, with a year’s worth photos from the client’s trip to Europe, when no one else could.

One afternoon, the son of a family friend brought in a Macbook to the shop. He said his girlfriend was crying. At first I thought he was asking me for relationship advice (I’ve known him all his life). But he laughed and said no, his girlfriend spilled coffee inside the keyboard and had an assignment due on Monday.  This was Friday. The laptop wouldn’t even turn on. (By the way, never try to turn on a laptop after a liquid spill until it dries out.) He showed me how you could still hear the coffee sloshing around inside it. He’d also taken it the Mac store and another computer repair shop but they said that nothing could be done. He needed to replace the Macbook.  I assured him that laptop hardware techs could at least get the data off the hard drive, including her assignment, and we’d try to fix the Macbook as well.

Well, Steve took the Macbook and 45 minutes later, not only did he have the assignment, the whole Macbook was working again. I don’t even know how he took the screws out and replaced them in 45 minutes (there are a ton of tiny screws in a Macbook) but he did. Again, everyone was overjoyed and impressed.

Steve is an awesome tech and a wonderful guy to have around the shop, warm, funny, and hard working. Really you couldn’t find a better tech. He also contributes to the warm, supportive, hard working but fun atmosphere we have built at the shop. We have awesome techs and staff, and he is no exception.

If you’d like to bring in your computer or device to our Calgary computer repair shop, we’d love to help you too.

facebooktwittergoogle_plusredditpinterestlinkedinmailfacebooktwittergoogle_plusredditpinterestlinkedinmailby feather

Third Website Design for Derek Brown’s Academy of Driving

One of our oldest and dearest clients, Derek Brown’s Academy of Driving, recently requested a redesign of their website.  They wanted an upgrade to a new generation website that filled the screen and would be more interactive. They also wanted contact forms.  

We at Ducktoes Webdesign were excited by this challenge.  We were happy since we wanted to make the site more personalized with real photos of Derek’s Brown’s company in action and also create some eye-catching visual movement that would create interest and keep users on the page longer. We needed to make it more mobile responsive as sites need to be now since users are using smart phones and tablets more as well as laptops and desktops.

I created their first website in 2009 when I was solo and very new in my computer services business and the only one working for my company.   It looked like this (this is a screenshot from the WaybackMachine):

1stdrivingschool

Then a previous Ducktoes web designer named Jody Gristwood designed this webdesign in 2013:

2nddrivingschool

Now here is our newest web design just launched this week:
bestcalgarydrivingschool.com

Here it is as a mobile site:

If you’d like a web design like this from Ducktoes, call 403-483-0105 or visit our Calgary Web Design page.

facebooktwittergoogle_plusredditpinterestlinkedinmailfacebooktwittergoogle_plusredditpinterestlinkedinmailby feather