Here are the initial observations:

• Their Cisco VoIP phone system was able to make calls and internal machines could ping outside servers by IP, but not by name, indicating that the internet connection was functional.
• I could ping their firewall IP address and I could get into resources on their network other than the server remotely. Remote Desktop (RDP) didn’t respond, I could not telnet to the Exchange mail server (port 25) either.
• The client had already rebooted the server once, and was logged into themselves and reported nothing strange.  They confirmed that on the server they could also ping outside IP addresses but the DNS server was not responding.

Okay, so this sounded like maybe the DNS server was the issue, but it was running okay, and the server itself could resolve hostnames. I was starting to lean towards firewall (on server or desktops) or switch issues at this point, but not being there and not having the ability to see the devices on the network with my own two eyes was hindering my progress. They opted to have us come out first thing in the morning and check it out.

When our tech arrived at start of business, he immediately realized that the server was unreachable from machines on their network and began looked over system logs, firewall & system settings and did the typical diagnostic in an attempt to restore connectivity.

Then he found it…

There were suspicious changes to the registry and upon running malware scanning tools, he quickly discovered the culprit. Malicious software of some sort had had its way with the machine.

The only thing that had happened leading up to this issue was that the client had been in touch with Intuit for a Quickbooks upgrade. The Intuit technician had performed a remote session and updated the QB install and the in turn the database files.

There are other potential ways that malware was put on the server, but the timing is suspicious as nobody else had accessed this machine remotely in many weeks, so we are going to assume that it came from the technician remotely accessing it, as we have no exact logging information that would indicate the time the changes were made.

Why am I blogging about this? In the event anyone else has an issue, they may find this post and confirm that they had a similar incident leading up to the event.

This could potentially happen if the installer of the software had become infected / exploited themselves, and it could be entirely accidental. Then again, some might want to speculate that people providing support to US based companies from foreign countries might intentionally wish to gain access to a server.

What can you do to protect yourself? Instead of using a software vendors foreign based technicians or engineers to update your software, you might fare better by using the services of a local based IT company. Also, having backups of your system files and system images will insure that you can “go back in time” and restore a system to a functional state should something of this nature happen.

Want to discuss this further? Feel free to add your two cents to our blog!

Should you desire computer or server support in the Greenville, Spartanburg or Anderson South Carolina area for your business, please call us at 864-990-4748 or use the contact form on our website. We would love to assist you!

It’s that time of year again when ISPs (Internet Service Providers)  all around the world perform their yearly maintenance, call it “Spring Cleaning” if you will.

If you have been living under a rock and missed the stories on the news and the countless emails flying around for the last week or so, then this may come as a total surprise to you. Newcomers to technology may also be taken by surprise.

In the past, Internet Cleaning Day has taken place during a 24hr period, but due to new techniques, ISPs have managed to narrow it down to only 1 hour which they have conveniently scheduled for 12pm to 1pm in each time zone.

While normal analog phone systems are not going to be affected, VoIP systems WILL be… This is often overlooked! You should follow the same procedure if your business is using Voice over IP technology. If you are unsure, it is best to disconnect the cables and place in the same container as your network cables.

This never happens….  Welllll, I can’t say “never” after I post this…

One of our favorite vendors is having a sale and we are passing the savings on to you. Nexlink is offering 25 dollars off their prebuilt business computers, and if you order today (Wednesday March 27, 2013) through Friday the 29th, we can knock 25 dollars off the already great price, AND bump that warranty up to FIVE YEARS at absolutely no additional charge. (That’s actually 74 dollars saving over our normal price!)

Here’s what is available at this great pricing:

Nexlink Express 1125 i3 w8d – Intel Core i3-3220 3.30Ghz, 4GB RAM, 500GB hard drive w/Windows 7 Pro downgrade and FIVE YEAR manufacturer warranty – 676.oo

Nexlink Express 1125 i5 w8d – Intel Core i5-3330 3.0Ghz, 4GB RAM, 1TB hard drive w/ Windows 7 Pro downgrade and FIVE YEAR manufacturer warranty – 750.oo

Nexlink Express 1125 PENTW8D – Intel Pentium G645 2.9Ghz, 4GB RAM, 500GB hard drive, w/ Windows 7 Pro downgrade and FIVE YEAR manufacturer warranty – 614.oo

Please note, these are BUSINESS computers! They don’t come loaded down with junk, they incredible warranties, and they are made with better components, such as genuine Intel motherboards, than you would find on off-the-shelf systems.

We have 100% customer satisfaction on these!

If you need one, or one thousand, we can help you or your business out, so please give us a call at 864-990-4748 or use our contact form on the website. Please note, we are closed for Good Friday, but if you contact us via email, or call on that day, I will insure you get this special.   We accept Visa and MC, and if you are ordering multiples, we may be able to arrange financing for you.

We also offer full computer service and computer support – we can install and migrate your data and configure these computers for your network!

Once you get past that totally different interface, and the login if you are on a domain, one annoying trait that may tweak your shorts is the forced automatic restart after updates are applied. You would notice that where Windows keeps saying that your machine is going to reboot and actually starts to count down. How annoying, right?

Even though this behavior is annoying, it has a purpose! When “Patch Tuesday” comes around, and these updates are pushed to your computer and installed, it needs to reboot in order to close out the vulnerable components and patch them so you are protected from nasty exploits.

Failure to apply and activate updates can (and does) lead to machines which are in a vulnerable state, and visiting malicious websites, or opening malicious documents, even though the updates have been installed, but the machine is not rebooted, may result in viruses, trojans, worms and other malware being installed.

I think that was redundant, but I really want you to understand just how important these updates are!

That being said… Should you get too annoyed by the forced reboots, there’s a potential way around this by using the Group Policy Editor.   That setting is found under Local Computer Policy, Computer Configuration, Administrative Templates, Windows Components, Windows Update…    Just set “No auto-restart with logged on users for scheduled automatic updates installation” to “Enabled”.

But don’t do it, unless you have another means for maintaining your patch management.  Really, don’t do it.

If you would like to talk with someone about patch management, windows security, network security or anything computer support related for you or your business in the Upstate SC area, please call us at 864-990-4748 or use our contact form on our website.

It is important that you apply these updates to your computers and servers in order to keep your network secure.

Let’s start with Adobe – Four Flash security holes have been plugged in Flash Player 11.6.602.171 and earlier across all platforms.  Yes, that means you Apple Mac and Linux users need to get the updated Player version 11.6.602.180 or newer. Failure to do so could result in code being executed on your computer that could give a remote user complete control over it.

Next up…. Microsoft!

Products with updates include Microsoft Internet Explorer, Microsoft Office Suite (Visio Viewer 2010, SharePoint Server 2010, OneNote 2010, Office Outlook for Mac) and Silverlight 5 for both PC and Mac computers have a multitude of issues, with four critical bulletins.

Again, these updates should be installed as soon as possible.

If you or your organization requires assistance, please let us know. We can assist here in Upstate & Greenville SC with all your desktop, server and network security needs. We are an authorized Microsoft Partner and provide sales, service and support of their entire line of offerings. We can keep your computers secure, and in the event they need a virus cleaned off or removed, we can assist with that too!

Businesses wanting to employ the use of a patch management system, which will collect information about desktops, notebooks and other devices on their network, and push out updates from an easy to monitor server should contact us for more information!

864-990-4748 or use the contact link on our website.

If you have purchased, or plan to purchase, a new computer with the OEM version of Microsoft Office 2013 on it, please understand that the installation of that Office 2013 can only be done on the computer it was first installed on.

In other words, let’s assume you buy a new computer from Homeland Secure IT along with Microsoft Office 2013 OEM / PKC, and 2 years later, you replace the computer. Previous versions of Microsoft Office would permit you to reinstall the OEM office that you originally purchased on a new computer, but, 2013 will NOT.

This is not anything new, as OEM / PKC versions of Microsoft Office have always been licensed for use with a new computer only. The license agreement expressly forbid you from installing it again on another computer.  Just like the OEM version of the Microsoft Windows Operating System. It was meant for one computer only. Without question, people have purchased the OEM version and then (against the license agreement) installed it on their next new computer too.

What IS new is that the RETAIL version of Microsoft Office will only allow you to load it on the first computer you install it on, then it is forever locked to that computer. That’s not just part of the EULA, it is apparently part of the registration mechanism.

Computer World and other computer news outlets have been obtaining more information, but it appears that this is true for the OEM, Academic, and the retail Home & Business versions.

You can read the Microsoft EULAs here: http://www.microsoft.com/en-us/legal/intellectualproperty/UseTerms/default.aspx

Homeland Secure IT is an authorized Microsoft reseller and partner… Offering the complete line of Microsoft products for sale in the Greenville / Upstate area. We can provide Office, Office 356 or Windows for one computer or one thousand.

Please call us if you have any questions or would like to purchase a Microsoft product. 864-990-4748

You should insure that updates are installed!

Should you require assistance applying these critical security updates to your computer or your entire network of computers, please call us at 864-990-4748. We specialize in providing computer and network service and support in Greenville, Spartanburg and Anderson South Carolina.

—

Here’s some reading for you regarding the Flash Windows and Mac Attacks:

http://securitywatch.pcmag.com/none/307887-adobe-patches-flash-windows-mac-users-under-attack

And the latest bulletin from MS:

********************************************************************
Title: Microsoft Security Advisory Notification
Issued: February 12, 2013
********************************************************************

Security Advisories Updated or Released Today ==============================================

* Microsoft Security Advisory (2755801)
  – Title: Update for Vulnerabilities in Adobe Flash Player in
    Internet Explorer 10
  – http://technet.microsoft.com/security/advisory/2755801
  – Revision Note: V8.0 (February 12, 2013): Added KB2805940 to
    the Current update section. 

Hopefully, you will be home, safe and sound yourself, but if you are not, and need assistance with your computer, server or network, please call or email us and we shall attempt to help remotely.

Be careful out there!

The Department of Homeland Security’s suggestion to disable Java in your browser, whether you are using a Mac, Linux box or Windows PC is still probably the best route for you to take, but I know you won’t.

Here’s the details….  As I warned our customers – the patched version of Java 7 is *still* vulnerable to exploitation.

To make it even more interesting, the exploit is available for the “bad guys” to purchase and use for a mere $5k.

You can read that story over here: $5000 will buy you access to another, new critical Java vulnerability

Again, to anyone reading this…  If you can get along without it, you might consider the advice to disable the Java plugin. If you need assistance with that, please let us know.  Optionally, if you feel your computer may have been exploited, seek professional technical support. We are happy to discuss the matter with you here in the Greenville SC area.  Give us a call at 864-990-4748.

Be safe out there…

This week, the Department of Homeland Security suggested disabling or uninstalling Java based on a CERT publication where they announced Java 7 fails to restrict access to privileged code. That original posting has been updated as recently as today, January 12, 2013.

What does it all mean?

Well, in a nutshell, if you have the vulnerable version of Java on your Mac, Windows or Linux PC and happen upon a nasty bit of code designed to exploit the Java “zero day” vulnerability, your machine can be completely taken over.

Right now, the web forums are abuzz with tales of Apple Mac jackings, Linux anommolies and Windows x malware.  The numbers of postings have ramped up considerably over the last couple days, leading me to believe this is a valid concern.

We recommend that no matter which platform you are on, that use use extreme caution while browsing and consider disabling Java on your browsers as well.

Here’s what CERT has to say: (taken from the article linked above)

Solution

If for any reason you believe your machine may have already been exploited, contact an service professional immediately.

If we can assist you with this, please let us know. We provide computer service and repair in the Greenville, Spartanburg and Anderson Upstate area.

You can call us at 864-990-4748 M-F, 8:30 – 5:30.

No, this isn’t a Mac mini….  It’s an Amiga….  And for only $2495, you can buy one.

And starting at $1295, you can get the C64X Supreme!

No, I didn’t leave out a decimal point.

Here’s the whole story: http://gizmodo.com/5895462/

The logic behind that is, if Symantec releases viruses, then people need anti-virus software, right?

If I had a quarter for every time I had heard that, I would easily have enough for a steak dinner!

I don’t believe that to be true, any more than the companies that sell police radar guns, also sell radar detectors.  No wait, that was true, but I digress. As much as a conspiracy theorist as I am, I don’t believe that it is in the best interest of an anti-malware company to release malicious software. There’s enough people out there doing that for free already that the likes of a Trend Micro would not need to risk everything on that kind of activity.

However, with that being said, an interesting tidbit in the news is that John McAfee, the guy who McAfee anti-virus security is named after, has apparently admitted that he intentionally infected notebook computers which were provided to law enforcement and government officials. John McAfee has nothing to do with the current McAfee company, but these admissions sure have caused blogs and web forums world-wide to light up with “I told you so!” type comments.

Read the whole story over on nakedsecurity.

One thing is for sure – if anyone gives me a free notebook computer, I’m going to immediately wipe it and reload the operating system!

We’re two days into the new year – what do you think of 2013 so far?

We’re hoping this will be a fantastic year for Homeland and for our friends, family and clients!

If there is anything we can do to assist with your computer or network needs, please do not hesitate to call upon us!

If you are using a Microsoft Windows based computer, or even a Mac running Windows on it, and you become infected with the latest strain of Reveton / Trojan.Ransomlock.G, that is the message you might see.

Whatever you do – do not pay the “ransom” to unlock your PC, that is a scam as well.   This isn’t just extortion, this is an attempt to harvest personal credit information.

Protect yourself from infection by running current and reliable anti-virus, such as Trend Micro, and be sure to keep your computer up to date. Updates and patches are constantly being made available for your operating system, support software (Java, Adobe Flash, Adobe Reader, Microsoft Office), and these updates should not be ignored.

Should you find yourself infected, please call us at 864-990-4748 as we are specialists in virus removal here in the Greenville Anderson Spartanburg area.

‘Twas The Night Before Christmas – Computer Version

‘Twas the night before Christmas, and all through the shop,
The computers were whirring; they never do stop.
The power was on and the temperature right,
In hopes that the input would feed back that night.

The system was ready, the program was coded,
And memory drums had been carefully loaded;
While adding a Christmasy glow to the scene,
The lights on the console, flashed red, white and green.

When out in the hall there arose such a clatter,
The programmer ran to see what was the matter.
Away to the hallway he flew like a flash,
Forgetting his key in his curious dash.
He stood in the hallway and looked all about,
When the door slammed behind him, and he was locked out.

Then, in the computer room what should appear,
But a miniature sleigh and eight tiny reindeer;
And a little old man, who with scarcely a pause,
Chuckled: “My name is Santa…the last name is Claus.”

The computer was startled, confused by the name,
Then it buzzed as it heard the old fellow exclaim:
“This is Dasher and Dancer and Prancer and Vixen,
And Comet and Cupid and Donner and Blitzen.”

With all these odd names, it was puzzled anew;
It hummed and it clanked, and a main circuit blew.
It searched in its memory core, trying to “think”;
Then the multi-line printer went out on the blink.

Unable to do its electronic job,
It said in a voice that was almost a sob:
“Your eyes – how they twinkle – your dimples so merry,
Your cheeks so like roses, your nose like a cherry,

Your smile – all these things, I’ve been programmed to know,
And at data-recall, I am more than so-so;
But your name and your address (computers can’t lie),
Are things that I just cannot identify.

You’ve a jolly old face and a little round belly,
That shakes when you laugh like a bowl full of jelly;
My scanners can see you, but still I insist,
Since you’re not in my program, you cannot exist!”

Old Santa just chuckled a merry “ho, ho”,
And sat down to type out a quick word or so.
The keyboard clack-clattered, its sound sharp and clean,
As Santa fed this “data” into the machine:

“Kids everywhere know me; I come every year;
The presents I bring add to everyone’s cheer;
But you won’t get anything – that’s plain to see;
Too bad your programmers forgot about me.”

Then he faced the machine and said with a shrug,
“Merry Christmas to All,” as he pulled out its plug,
“And to all, a good night!”

Merry Christmas everyone!

Merry Christmas!!!!!

We will be closing early on December 24th (Christmas Eve) and taking Christmas Day off so that we may spend time with our families and to give tribute to the real reason behind the holiday!

In the event you need emergency computer, server or network service, please call our 990-4748 number and leave a voice mail message. It will go to all of us and we will call you back quickly.

We hope you have a very merry and blessed Christmas, and that you get to spend it with your family!

Homeland Secure IT Alert

Microsoft didn’t forget you, in fact, they already have your Christmas present, which will be delivered in the form of patches on the infamous “Patch Tuesday”…

So, whether you have been naughty or nice… Please update your computers!

If you require assistance with managing updates for your personal computer, your server, or your entire business network in the Greenville and Upstate SC area, please call us at 864-990-4748.

Here’s the Microsoft Bulletin for your reading enjoyment:

********************************************************************

Microsoft Security Bulletin Advance Notification for December 2012

Issued: December 6, 2012

********************************************************************

This is an advance notification of security bulletins that Microsoft is intending to release on December 11, 2012.

The full version of the Microsoft Security Bulletin Advance Notification for December 2012 can be found at http://technet.microsoft.com/security/bulletin/ms12-dec.

This bulletin advance notification will be replaced with the December bulletin summary on December 11, 2012. For more information about the bulletin advance notification service, see http://technet.microsoft.com/security/bulletin/advance.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications on http://technet.microsoft.com/security/dd252948.

Microsoft will host a webcast to address customer questions on these bulletins on December 12, 2012, at 11:00 AM Pacific Time (US & Canada). Register for the Security Bulletin Webcast at http://technet.microsoft.com/security/bulletin.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security, high-priority updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.

This advance notification provides a number as the bulletin identifier, because the official Microsoft Security Bulletin numbers are not issued until release. The bulletin summary that replaces this advance notification will have the proper Microsoft Security Bulletin numbers (in the MSyy-xxx format) as the bulletin identifier. The security bulletins for this month are as follows, in order of severity:

Critical Security Bulletins

============================

Bulletin 1

- Affected Software:

- Windows XP Service Pack 3

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows XP Professional x64 Edition Service Pack 2

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows Server 2003 Service Pack 2

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows Server 2003 x64 Edition Service Pack 2

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows Server 2003 with SP2 for Itanium-based Systems

- Internet Explorer 6

- Internet Explorer 7

- Windows Vista Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

- Windows Vista x64 Edition Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

- Windows Server 2008 for 32-bit Systems Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for x64-based Systems Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Internet Explorer 7

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1:

- Internet Explorer 8

- Internet Explorer 9

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1:

- Internet Explorer 8

- Internet Explorer 9

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1:

- Internet Explorer 8

- Internet Explorer 9

(Windows Server 2008 R2 Server Core installation

not affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Internet Explorer 8

- Windows 8 for 32-bit Systems

- Internet Explorer 10

- Windows 8 for 64-bit Systems

- Internet Explorer 10

- Windows Server 2012

- Internet Explorer 10

(Windows Server 2012 Server Core installation not affected)

Windows RT

- Internet Explorer 10

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 2

- Affected Software:

- Windows XP Service Pack 3

- Windows XP Professional x64 Edition Service Pack 2

- Windows Server 2003 Service Pack 2

- Windows Server 2003 x64 Edition Service Pack 2

- Windows Server 2003 with SP2 for Itanium-based Systems

- Windows Vista Service Pack 2

- Windows Vista x64 Edition Service Pack 2

- Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Windows 8 for 32-bit Systems

- Windows 8 for 64-bit Systems

- Windows Server 2012

(Windows Server 2012 Server Core installation affected)

Windows RT

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 3

- Affected Software:

- Microsoft Word 2003 Service Pack 3

- Microsoft Word 2007 Service Pack 2 and

Microsoft Word 2007 Service Pack 3

- Microsoft Word 2010 Service Pack 1 (32-bit editions)

- Microsoft Word 2010 Service Pack 1 (64-bit editions)

- Microsoft Word Viewer

- Microsoft Office Compatibility Pack Service Pack 2 and

Microsoft Office Compatibility Pack Service Pack 3

- Microsoft SharePoint Server 2010 Service Pack 1

- Word Automation Services

- Microsoft Office Web Apps 2010 Service Pack 1

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 4

- Affected Software:

- Microsoft Exchange Server 2007 Service Pack 3

- Microsoft Exchange Server 2010 Service Pack 1

- Microsoft Exchange Server 2010 Service Pack 2

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 5

- Affected Software:

- Windows XP Service Pack 3

- Windows XP Professional x64 Edition Service Pack 2

- Windows Server 2003 Service Pack 2

- Windows Server 2003 x64 Edition Service Pack 2

- Windows Server 2003 with SP2 for Itanium-based Systems

- Windows Vista Service Pack 2

- Windows Vista x64 Edition Service Pack 2

- Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Impact: Remote Code Execution

- Version Number: 1.0

Important Security Bulletins

============================

Bulletin 6

- Affected Software:

- Windows XP Service Pack 3

- Windows XP Professional x64 Edition Service Pack 2

- Windows Server 2003 Service Pack 2

- Windows Server 2003 x64 Edition Service Pack 2

- Windows Server 2003 with SP2 for Itanium-based Systems

- Windows Vista Service Pack 2

- Windows Vista x64 Edition Service Pack 2

- Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation not affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Windows 8 for 32-bit Systems

- Windows 8 for 64-bit Systems

- Windows Server 2012

(Windows Server 2012 Server Core installation not affected)

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 7

- Affected Software:

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Windows Server 2012

(Windows Server 2012 Server Core installation affected)

- Impact: Security Feature Bypass

- Version Number: 1.0

Other Information

=================

Follow us on Twitter for the latest information and updates:

http://twitter.com/msftsecresponse

Microsoft Windows Malicious Software Removal Tool:

==================================================

Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.

Non-Security Updates on MU, WU, and WSUS:

========================================================

For information about non-security releases on Windows Update and Microsoft update, please see:

* http://support.microsoft.com/kb/894199: Microsoft Knowledge Base

Article 894199, Description of Software Update Services and

Windows Server Update Services changes in content.

Includes all Windows content.

* http://technet.microsoft.com/wsus/bb456965: Updates

from Past Months for Windows Server Update Services. Displays all

new, revised, and rereleased updates for Microsoft products other

than Microsoft Windows.

Microsoft Active Protections Program (MAPP) ===========================================

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed at http://www.microsoft.com/security/msrc/collaboration/mapp.aspx.

Recognize and avoid fraudulent email to Microsoft customers:

=============================================================

If you receive an email message that claims to be distributing a Microsoft security update, it is a hoax that may contain malware or pointers to malicious websites. Microsoft does not distribute security updates via email.

The Microsoft Security Response Center (MSRC) uses PGP to digitally sign all security notifications. However, PGP is not required for reading security notifications, reading security bulletins, or installing security updates. You can obtain the MSRC public PGP key at https://technet.microsoft.com/security/bulletin/pgp.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications on http://technet.microsoft.com/security/dd252948.

********************************************************************

THE INFORMATION PROVIDED IN THIS MICROSOFT COMMUNICATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

********************************************************************

To manage or cancel your subscription to this newsletter, visit the Microsoft.com Profile Center at <http://go.microsoft.com/fwlink/?LinkId=245953> and then click Manage Communications under My Subscriptions in the Quicklinks section.

For more information, see the Communications Preferences section of the Microsoft Online Privacy Statement at:

<http://go.microsoft.com/fwlink/?LinkId=92781>.

For the complete Microsoft Online Privacy Statement, see:

<http://go.microsoft.com/fwlink/?LinkId=81184>.

For legal Information, see:

<http://www.microsoft.com/info/legalinfo/default.mspx>.

This newsletter was sent by:

Microsoft Corporation

1 Microsoft Way

Redmond, Washington, USA

98052

The popular site, iFixit claims that the machine is right up there with MacBook Pro in the level of difficulty in repairing it. Previously, they stated that the MacBook Pro was “the least repairable laptop we’ve taken apart”. In fact, they both received a score of 3 out of 10 for that.

If upgrades are unimportant to you, then this information may not apply, but if you are like me, you might prefer the ability to easily (within reason at least) repair a computer, and it is looking like that is going to be an issue for many over time as they develop problems and need support.

Head over to iFixit and read their-tear down and related notes… It’s an i(Mac) opener. (See what I did there? That was cute, wasn’t it?

I would suggest comparing the iMacs to other computers, such as the Lenovo IdeaCentre A720, which sports a massive 27 inch touch screen before purchasing. You might find a different set of features, and a different mindset on repairs.

If you would like more information about any of the Lenovo computer products, please let us know. We are a Lenovo dealer offering sales, consultation and support here in the Greenville SC area.   864-990-4748

If that doesn’t work… Call Homeland Secure IT at 864-990-4748 for real computer & server support and repair in the Greenville SC area!

What follows is a guest blog post from our friends at EPC, a company providing data destruction services for your end of life computer equipment.

What Does Free Really Cost?

You’ve met the “guy with the pick-up truck” that can take your PC in for free. All of us have. But where does your data on that PC “go?”

Even in a down economy, you have to take a longer look at what “free” means to you not only as a business, but personally. Every year, millions of dollars both outright and in reputation are lost by companies and people all over the world. What can you do to ensure that the data that makes you the company that you are stays safe? How can you protect the information, say from website transactions you make during the year, and trust that your data won’t fall into the wrong hands?

First things first: Let the guy in the pick-up truck drive off empty handed.

Data Destruction isn’t just drilling holes in hard drives or chopping them in half with axes. Today’s hacker can extract data from places you haven’t even yet imagined. It’s time to make sure that the data on your hard drives and electronic media are appropriately sanitized via a certified, NAID sanitation process;  this ensures all information on that drive is permanently  erased.

EPC, Inc. established in 1984, has been in the Data Destruction business for a long time, serving thousands of companies in North America. From the smallest Mom & Pop shop, to Fortune 100 industries, EPC, Inc. has not only the experience, but a proven track record of ensuring that the information that makes companies what they are never falls into the wrong hands.

Whether it’s our e-Steward-certified E-Scrap Processing Center, or our fleet of DDRV’s (Data Destruction Recycling Vehicles), EPC, will deliver the customized service to fit your Data Security needs.

Secure Data Erasure is the ultimate solution, but if your company is looking for another sound option in Data Destruction, EPC, Inc. features a series of HIPAA-compliant, NAID-certified processes that not only shred the materials to Department of Defense specs, but ensure that the materials go to the right place. EPC ensures responsible handling that adds even more security to a solution that will get you satisfied.

EPC, Inc. has recently teamed-up with John Hoyt of Homeland Secure IT, to offer customers in South Carolina a true solution to your IT Destruction needs.

Are you ready to do something different, that ensures the integrity not only of the data on your PCs, but also your reputation? Why not also help the environment at the same time?

It’s time to change the way you think about the end of your electronic assets inside and outside business. Let EPC, Inc. help you meet those needs.

Start your search for a solution now:  Call Eric Levy 636-443-1999
Or visit: http://www.epcusa.com

We have so few subscribers that your odds of being selected were extraordinarily high! In fact, I actually was selected once, so in the essence of fairness, I ran the random number generator until someone not associated with Homeland Secure IT was selected.

Normally, our rules are that you have to be able to walk in our door and pick the item up in person, but we bent them this time…

Here are the people who get the Trend Micro Internet Security anti-virus packages:

Marta Holt – Springdale, Arkansas
Rick Bivans – Greenville, South Carolina
Amy Holiday – Greenville, South Carolina
Craig Rhodes – Spartanburg, South Carolina
Andrea Bennett – Greenville, South Carolina

Winners – please come by and pick up your prize…  Except Marta from Arkansas, I’ll need your mailing address…

Don’t pout though if you were not selected… We’re going to offer Trend Micro Anti-Virus at a discount to anyone who mentions this “giveaway” until our stock is depleted.   Hurry up and get it before you have to pay the retail price!

BTW: If you happen to be a Mac owner – Trend Internet Security comes with a Mac product too….

Hope your Thanksgiving was relaxing and filled with many things to be thankful for!

Homeland Secure IT is most thankful for you! Thank you for sharing in our lives and supporting our business and thank you for reading this silly blog, hope you get something good out of it from time to time!

Lenovo IdeaPad S400

Here’s a lovely little laptop for you to consider…

The Lenovo IdeaPad S400 14″ LED Notebook with Intel Core i3 dual core processor, 500GB HD and 4 GB of RAM.

Webcam, USB 3.0, HDMI output, Microsoft Windows 8 and 1 year Lenovo warranty.

There’s not much else to say!  Thin, lightweight, and brisk performance…  Rated at 5 hours battery life.

We’ve got it for $529.99, so if you want one, give us a call at 864-990-4748 or use our contact form!

Homeland Secure IT is a Lenovo Partner and we offer sales to individuals and businesses in the Greenville, Anderson and Spartanburg SC area as well as support, for the entire line of Lenovo desktop, notebook and server products! We can migrate all your data to your new S400 and if you have never used Windows 8 before, we can teach you the basics!

Our preferred remote backup solution provider is expanding in a big way!

Servosity, which is based right here in Greenville South Carolina, has made a commitment to create 30 new positions over the next 12 to 18 months. And these will be higher paying jobs with a much higher skill requirement.

We continue to use Servosity ourselves and provide their disaster recovery and backup services to our clients because they have one of the best offerings in the business. In addition to that, the money stays right here in the Upstate.

If you would like to find out more about how remote backup and disaster recovery solutions can protect your business data from catastrophic events, such as the recent hurricane that has pounded the East Coast this week, then please, give us a call at 864-990-4748 or use our contact form on the http://www.HomelandSecureIT.com website to arrange a free consultation.

We can protect one single desktop or laptop, or a Microsoft Exchange Server, or an entire network consisting of several servers and many computers with recovery of a lost system to new hardware possible within minutes!

Relying on Jesus for computer and network security will not protect you

I bet that title got your attention!

But according to a list of passwords examined, “Jesus” will not protect you, as it is on SplashData’s list of password’s that are considered unsafe due to the sheer usage of them. Obviously, “password” is the worst, followed by “123456″ and “12345678″.

I stole the following list of passwords from SplashData from the original article on cnet:

1. password (unchanged)
2. 123456 (unchanged)
3. 12345678 (unchanged)
4. abc123 (up 1)
5. qwerty (down 1)
6. monkey (unchanged)
7. letmein (up 1)
8. dragon (up 2)
9. 111111 (up 3)
10. bassball (up 1)
11. iloveyou (up 2)
12. trustno1 (down 3)
13. 1234567 (down 6)
14. sunshine (up 1)
15. master (down 1)
16. 123123 (up 4)
17. welcome (new)
18. shadow (up 1)
19. ashley (down 3)
20. football (up 5)
21. Jesus (new)
22. michael (up 2)
23. ninja (new)
24. mustang (new)
25. password1 (new)

If you are using any variation of these, we need to talk!  Honestly, if you are using simple passwords of this nature at all, then please call us at 864-990-4748 or use our contact form on the www.HomelandSecureIT.com website.

Business owners and those in IT departments of businesses in the Upstate / Greenville area of South Carolina can call us to schedule an evaluation of their computer and network security. We can help you secure your network, enforce user password strength and much more.  Please call us today and let’s take care of IT!

Your mailbox is almost full emails still going around… Don’t fall for it…

An email arrives in your inbox with the subject of “Helpdesk Upgrade Alert”, tells you that your mailbox is almost full, and it includes a handy indicator saying that of your 244 MB quota, you have used 241MB.

The text reads, “The Helpdesk is upgrading and maintaining database Server from the old Microsoft Server (No420134x) to the new Microsoft Server (No520193x) CLICK HERE” (With a link) and a nice “Thank You” from the “Helpdesk Upgrade Team”.

That’s just fantastic! *FINALLY* they are getting around to upgrading your database server.    Trouble is, that’s not the case at all.  Instead, this is an ongoing scam, and apparently it works well or we likely would not be seeing as many of them as we do.

This phishing attempt is not all that sophisticated, just a very basic social engineering email offering that link, with text prompts you for anything in the email itself, so this type of message slips past many anti-spam / anti-malware packages, including the Barracuda email appliance.

How do you know this type of message is a scam? For one thing, you probably don’t have a “Helpdesk Upgrade Team” working on the upgrade of your old Microsoft server, however, even if you do, the name of the sender is likely not familiar to you.   The “To:” field may be blank.

Another giveaway is that it doesn’t make sense. IE:  244MB of storage? Come on.   The average mailbox is over a gig now.  Gmail gives you what, 8 to start out?

Hover your mouse over the “CLICK HERE” and you will see the goes outside your company to a Google docs site.  If you visit the site (if your anti-malware / anti-phishing software will let you browse there), you will see a form that asks for your username, password and email address.  Here’s what it looks like:

Helpdesk Upgrade Alert Scam – IT HELPDESK SERVICE form example

If you are not exhausted from a 7 day work week of 12 hour days, you probably will catch on the very moment that you see this site and understand that no IT department in the world would ask for this information in plain text, on a Google docs site.

Then again.  You might just be a trusting soul and enter your username, password and email address, allowing whoever monitors that data to freely access your account.

Should you that be you, and you just realized you have been had at some point, then it is time to change your information.   If your username is JoeBlow and your email address is JoeBlow@somecompany.com, then you might even consider changing to something else.  jblow or JoeCBlow, and change your password while you are at it.  How long ago did this happen?  Has your email been monitored and harvested for a long period of time? If banking information, a credit card or social security numbers were sent in email, ever, then you might have bigger things to worry about.

Alerting your IT department or computer service provider is a great idea at this stage in the game. You want them to know, no matter how embarrassed you might be about it, as they have seen this before, and they will be more than happy to help secure your account and assess the potential damage.

Are you in the financial, legal, government or medical field or work with sensitive or proprietary data of any nature? You may have compliance issues, and those will need to be addressed, quickly. Your IT provider can assist with contacting the proper authorities.

Homeland Secure IT helps Greenville / Upstate SC businesses and individuals with these and other computer and network security issues. We can help you recover, assess the impact and protect you from it in the future. If this has never happened to you, but you are concerned it could occur at your company, to a desk worker, your CEO or yourself, please call us at 864-990-4748 and we will be happy to discuss the matter. Don’t risk identity theft!