Skip to main content
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link
  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Set up Teamviewer Two Factor Authentication, which uses the TOTP protocol (time based one time passwords); RFC6238RFC6238.

  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Set up Teamviewer Two Factor Authentication, which uses the TOTP protocol (time based one time passwords); RFC6238.

  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Set up Teamviewer Two Factor Authentication, which uses the TOTP protocol (time based one time passwords); RFC6238.

added two factor teamviewer per mk444
Source Link
  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Set up Teamviewer Two Factor Authentication, which uses the TOTP protocol (time based one time passwords); RFC6238.

  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Set up Teamviewer Two Factor Authentication, which uses the TOTP protocol (time based one time passwords); RFC6238.

added pw change and keepass link
Source Link
  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

  • Unplug your router from the Internet in addition to your PC:

  • Buy a new one

  • Or give it a hard reset, and use a non-compromised machine on another network to download any firmware updates for it. If there aren't any because it's old... see "Buy a new one"

    • If they were able to use a computer inside your LAN, they were able to try and, or successfully, log into your router

    • Also check to see if your router has one of many vulnerabilities; if so, see "Buy a new one"

    • Consider a serious router/firewall, like running pfSense free software on an old machine with 2 NICs, or their own devices, or a fitlet tiny fanless PC, or whatever.

      • Then install the Snort or Suricata package - those are IDS/IPS packages which have a chance of noticing attacks in progress and optionally blocking IPs for a period of time - in your case, I'd say block for a few days and watch your logs very carefully for them to try and get back in.
    • Or at least a Ubiquiti Edgerouter Lite - much cheaper, but very limited in the GUI (all the really advanced stuff is in the command line, and it's definitely not for running an IDS/IPS).

  • Change all your passwords everywhere

  • Use something like KeePass to generate long random ones for each service.

  • Don't forget to go to Database Settings, Security, hit the "1 second delay" link or button, and then increase it - taking 3 or 4 or 7 seconds to open KeePass is a small price to pay for making attackers have to work incredibly much harder than the defaults.

  • Keep your computer off (in case of ransomware, possibly on a time) and unplugged while you:

  • Buy a new hard drive

  • Plug in power but NOT networking (and especially not Wifi; physically remove/turn off all wifi)

  • Install Windows from scratch

  • Install your AV package with an offline installer downloaded on a noncompromised computer and network

  • Run Windows patches offline possibly by using WSUS Offline Update from that noncompromised computer and network

  • Purchase a sledgehammer, a box of gallon Ziplock bags, and a small kitchen towel.

    • Wrap the compromised hard drive in the small kitchen towel

    • Put the wrapped HD in at least 6 Ziplock bags, each sealed

    • Smash the drive with the sledgehammer until glass shards are leaking through the towel

    • Restore your valuable data from existing backups

  • Or, much riskier if you don't replaced the compromised HD: run several different offline, bootable/live/livecd/rescue antivirus/antimalware/antirootkit products

    - Regardless, do these offline scans for all other machines on your network!
    
    - Use several because no one product covers everything, but by using several different products, you reduce the uncovered space significantly.  I'd recommend:
    
    - at least one of AVG and Avira (or both)
    
    - at least one of Dr. Web and Kapersky (preferably both), to get some Russian involvement.
    
    - Comodo Rescue Disk (it advertises rootkit scanning, too)
    
    - Pick another couple of your favorites.
    
    • PCSupport.about.com has a pretty good top 15 list as of Feb 2016

    • If you're truly worried, do this on every machine on the network.

      • It won't really take much more time - you can put AVG in one, Avira in another, Kapersky in a third, Dr.Web in a fourth, and then simply move them to the machine on the right when they're done in round-robin fashion.
    • They're almost certainly going to find tracking cookies - that's normal, and nothing to be concerned about, though I'd always delete them.

Source Link
Loading