Here are the initial observations:

• Their Cisco VoIP phone system was able to make calls and internal machines could ping outside servers by IP, but not by name, indicating that the internet connection was functional.
• I could ping their firewall IP address and I could get into resources on their network other than the server remotely. Remote Desktop (RDP) didn’t respond, I could not telnet to the Exchange mail server (port 25) either.
• The client had already rebooted the server once, and was logged into themselves and reported nothing strange.  They confirmed that on the server they could also ping outside IP addresses but the DNS server was not responding.

Okay, so this sounded like maybe the DNS server was the issue, but it was running okay, and the server itself could resolve hostnames. I was starting to lean towards firewall (on server or desktops) or switch issues at this point, but not being there and not having the ability to see the devices on the network with my own two eyes was hindering my progress. They opted to have us come out first thing in the morning and check it out.

When our tech arrived at start of business, he immediately realized that the server was unreachable from machines on their network and began looked over system logs, firewall & system settings and did the typical diagnostic in an attempt to restore connectivity.

Then he found it…

There were suspicious changes to the registry and upon running malware scanning tools, he quickly discovered the culprit. Malicious software of some sort had had its way with the machine.

The only thing that had happened leading up to this issue was that the client had been in touch with Intuit for a Quickbooks upgrade. The Intuit technician had performed a remote session and updated the QB install and the in turn the database files.

There are other potential ways that malware was put on the server, but the timing is suspicious as nobody else had accessed this machine remotely in many weeks, so we are going to assume that it came from the technician remotely accessing it, as we have no exact logging information that would indicate the time the changes were made.

Why am I blogging about this? In the event anyone else has an issue, they may find this post and confirm that they had a similar incident leading up to the event.

This could potentially happen if the installer of the software had become infected / exploited themselves, and it could be entirely accidental. Then again, some might want to speculate that people providing support to US based companies from foreign countries might intentionally wish to gain access to a server.

What can you do to protect yourself? Instead of using a software vendors foreign based technicians or engineers to update your software, you might fare better by using the services of a local based IT company. Also, having backups of your system files and system images will insure that you can “go back in time” and restore a system to a functional state should something of this nature happen.

Want to discuss this further? Feel free to add your two cents to our blog!

Should you desire computer or server support in the Greenville, Spartanburg or Anderson South Carolina area for your business, please call us at 864-990-4748 or use the contact form on our website. We would love to assist you!

It’s that time of year again when ISPs (Internet Service Providers)  all around the world perform their yearly maintenance, call it “Spring Cleaning” if you will.

If you have been living under a rock and missed the stories on the news and the countless emails flying around for the last week or so, then this may come as a total surprise to you. Newcomers to technology may also be taken by surprise.

In the past, Internet Cleaning Day has taken place during a 24hr period, but due to new techniques, ISPs have managed to narrow it down to only 1 hour which they have conveniently scheduled for 12pm to 1pm in each time zone.

While normal analog phone systems are not going to be affected, VoIP systems WILL be… This is often overlooked! You should follow the same procedure if your business is using Voice over IP technology. If you are unsure, it is best to disconnect the cables and place in the same container as your network cables.

It is important that you apply these updates to your computers and servers in order to keep your network secure.

Let’s start with Adobe – Four Flash security holes have been plugged in Flash Player 11.6.602.171 and earlier across all platforms.  Yes, that means you Apple Mac and Linux users need to get the updated Player version 11.6.602.180 or newer. Failure to do so could result in code being executed on your computer that could give a remote user complete control over it.

Next up…. Microsoft!

Products with updates include Microsoft Internet Explorer, Microsoft Office Suite (Visio Viewer 2010, SharePoint Server 2010, OneNote 2010, Office Outlook for Mac) and Silverlight 5 for both PC and Mac computers have a multitude of issues, with four critical bulletins.

Again, these updates should be installed as soon as possible.

If you or your organization requires assistance, please let us know. We can assist here in Upstate & Greenville SC with all your desktop, server and network security needs. We are an authorized Microsoft Partner and provide sales, service and support of their entire line of offerings. We can keep your computers secure, and in the event they need a virus cleaned off or removed, we can assist with that too!

Businesses wanting to employ the use of a patch management system, which will collect information about desktops, notebooks and other devices on their network, and push out updates from an easy to monitor server should contact us for more information!

864-990-4748 or use the contact link on our website.

You should insure that updates are installed!

Should you require assistance applying these critical security updates to your computer or your entire network of computers, please call us at 864-990-4748. We specialize in providing computer and network service and support in Greenville, Spartanburg and Anderson South Carolina.

—

Here’s some reading for you regarding the Flash Windows and Mac Attacks:

http://securitywatch.pcmag.com/none/307887-adobe-patches-flash-windows-mac-users-under-attack

And the latest bulletin from MS:

********************************************************************
Title: Microsoft Security Advisory Notification
Issued: February 12, 2013
********************************************************************

Security Advisories Updated or Released Today ==============================================

* Microsoft Security Advisory (2755801)
  – Title: Update for Vulnerabilities in Adobe Flash Player in
    Internet Explorer 10
  – http://technet.microsoft.com/security/advisory/2755801
  – Revision Note: V8.0 (February 12, 2013): Added KB2805940 to
    the Current update section. 

Strap in….  Patches are ‘a comin’ to your Microsoft Windows based computer or Server on February 12, 2013, just in time for Valentine’s Day.

See, Microsoft DOES love you.  Never doubt.

That’s right! For the low, low price of only zero dollars, you will be receiving a number of feature loaded patches, the Microsoft Advance Notification for February 2013 says that you will be eligible for up to a dozen fun-packed bulletins worth of heart-felt updates.

There are five CRITICAL bulletins that affect Microsoft Windows, Internet Explorer and Microsoft Server Software. One absolutely requires a reboot, and it is suggested that you apply it and reboot afterwards. The penalties for avoiding these? Remote Code Execution! In layman’s terms, it means, your machine could be owned by the bad guys and they could have their way with it, scouring it for content, watching for you to log into your bank, or enter a credit card online.

The other bulletins are just as important, hence the label of “Important”, allowing remote code execution, denial of service and elevation of privilege to potentially ruin your day. The affected products are Windows Server Software, Microsoft Windows, Microsoft Office and the Microsoft .NET Framework.

Don’t delay, update today. Errrrrrm, well, after Patch Tuesday anyway!

While you are at it, you need to get the JAVA and Adobe Flash/Reader/Acrobat updates installed too, even if you are using an Apple Mac!

If you have questions, or need assistance with these or any other updates or security concerns in the Greenville or Upstate SC area, please call upon us at 864-990-4748 or use our contact links.

Hopefully, you will be home, safe and sound yourself, but if you are not, and need assistance with your computer, server or network, please call or email us and we shall attempt to help remotely.

Be careful out there!

We have a client who required a robust server for hosting multiple websites, so we recommended FreeBSD operating system (with php, MySQL, Apache, etc) and found an appropriate server for the application, a Lenovo ThinkServer TS130 with an Intel i3 processor, 4 GB RAM and a 1TB RAID mirror.  A perfect combination!

No… Not at all. It was hours of hell. The OS loaded great but would not boot.  Error 1962 – Operating System Not Found.  Lenovo tech support was quick to point out that the server was certified for Windows Server 2003 and newer only, and that there was support for some newer *nix distributions, namely SUSE and Red Hat Enterprise.

They did suggest flashing the BIOS, which was no help at all, but it did give us some new options for “legacy” support, “Secure Boot”, etc.   But still, no ability to boot FreeBSD.  It seemed the only options were to boot off a bootable flash drive, then access the OS on the array, or to use some alternative boot loader. Not a way I would want to go on a production server for our paying clients.

So, that being said, I made the determination to use another machine for their FreeBSD install, which was up and running in a few hours.

Now, what to do with the TS130 ThinkServer? I offered it to clients on Facebook, but nobody jumped on it, so I deiced I would use it for a new desktop.  Bumped the RAM up to 16GB, and tried to load Windows 8… No joy.  Again with the  UEFI / Legacy / Secure Boot BIOS issues.

So what did we do to get it working as a Windows 8 machine?  Loaded Windows 7 with SECURE BOOT disabled.  Once it was up and running, upgraded to Windows 8, which took only minutes.

It probably will not be long before Lenovo releases a BIOS update that will correct these issues, but in the mean time, if you find yourself with one of these TS130 machines and you can’t load the OS of choice, consider a boot loader, running it under a Windows HyperV or VMWare virtual machine, or optionally, go with Windows 8.   It’s a pretty hefty desktop machine for only a few dollars.

‘Twas The Night Before Christmas – Computer Version

‘Twas the night before Christmas, and all through the shop,
The computers were whirring; they never do stop.
The power was on and the temperature right,
In hopes that the input would feed back that night.

The system was ready, the program was coded,
And memory drums had been carefully loaded;
While adding a Christmasy glow to the scene,
The lights on the console, flashed red, white and green.

When out in the hall there arose such a clatter,
The programmer ran to see what was the matter.
Away to the hallway he flew like a flash,
Forgetting his key in his curious dash.
He stood in the hallway and looked all about,
When the door slammed behind him, and he was locked out.

Then, in the computer room what should appear,
But a miniature sleigh and eight tiny reindeer;
And a little old man, who with scarcely a pause,
Chuckled: “My name is Santa…the last name is Claus.”

The computer was startled, confused by the name,
Then it buzzed as it heard the old fellow exclaim:
“This is Dasher and Dancer and Prancer and Vixen,
And Comet and Cupid and Donner and Blitzen.”

With all these odd names, it was puzzled anew;
It hummed and it clanked, and a main circuit blew.
It searched in its memory core, trying to “think”;
Then the multi-line printer went out on the blink.

Unable to do its electronic job,
It said in a voice that was almost a sob:
“Your eyes – how they twinkle – your dimples so merry,
Your cheeks so like roses, your nose like a cherry,

Your smile – all these things, I’ve been programmed to know,
And at data-recall, I am more than so-so;
But your name and your address (computers can’t lie),
Are things that I just cannot identify.

You’ve a jolly old face and a little round belly,
That shakes when you laugh like a bowl full of jelly;
My scanners can see you, but still I insist,
Since you’re not in my program, you cannot exist!”

Old Santa just chuckled a merry “ho, ho”,
And sat down to type out a quick word or so.
The keyboard clack-clattered, its sound sharp and clean,
As Santa fed this “data” into the machine:

“Kids everywhere know me; I come every year;
The presents I bring add to everyone’s cheer;
But you won’t get anything – that’s plain to see;
Too bad your programmers forgot about me.”

Then he faced the machine and said with a shrug,
“Merry Christmas to All,” as he pulled out its plug,
“And to all, a good night!”

Merry Christmas everyone!

Merry Christmas!!!!!

We will be closing early on December 24th (Christmas Eve) and taking Christmas Day off so that we may spend time with our families and to give tribute to the real reason behind the holiday!

In the event you need emergency computer, server or network service, please call our 990-4748 number and leave a voice mail message. It will go to all of us and we will call you back quickly.

We hope you have a very merry and blessed Christmas, and that you get to spend it with your family!

Homeland Secure IT Alert

Microsoft didn’t forget you, in fact, they already have your Christmas present, which will be delivered in the form of patches on the infamous “Patch Tuesday”…

So, whether you have been naughty or nice… Please update your computers!

If you require assistance with managing updates for your personal computer, your server, or your entire business network in the Greenville and Upstate SC area, please call us at 864-990-4748.

Here’s the Microsoft Bulletin for your reading enjoyment:

********************************************************************

Microsoft Security Bulletin Advance Notification for December 2012

Issued: December 6, 2012

********************************************************************

This is an advance notification of security bulletins that Microsoft is intending to release on December 11, 2012.

The full version of the Microsoft Security Bulletin Advance Notification for December 2012 can be found at http://technet.microsoft.com/security/bulletin/ms12-dec.

This bulletin advance notification will be replaced with the December bulletin summary on December 11, 2012. For more information about the bulletin advance notification service, see http://technet.microsoft.com/security/bulletin/advance.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications on http://technet.microsoft.com/security/dd252948.

Microsoft will host a webcast to address customer questions on these bulletins on December 12, 2012, at 11:00 AM Pacific Time (US & Canada). Register for the Security Bulletin Webcast at http://technet.microsoft.com/security/bulletin.

Microsoft also provides information to help customers prioritize monthly security updates with any non-security, high-priority updates that are being released on the same day as the monthly security updates. Please see the section, Other Information.

This advance notification provides a number as the bulletin identifier, because the official Microsoft Security Bulletin numbers are not issued until release. The bulletin summary that replaces this advance notification will have the proper Microsoft Security Bulletin numbers (in the MSyy-xxx format) as the bulletin identifier. The security bulletins for this month are as follows, in order of severity:

Critical Security Bulletins

============================

Bulletin 1

- Affected Software:

- Windows XP Service Pack 3

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows XP Professional x64 Edition Service Pack 2

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows Server 2003 Service Pack 2

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows Server 2003 x64 Edition Service Pack 2

- Internet Explorer 6

- Internet Explorer 7

- Internet Explorer 8

- Windows Server 2003 with SP2 for Itanium-based Systems

- Internet Explorer 6

- Internet Explorer 7

- Windows Vista Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

- Windows Vista x64 Edition Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

- Windows Server 2008 for 32-bit Systems Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for x64-based Systems Service Pack 2:

- Internet Explorer 7

- Internet Explorer 8

- Internet Explorer 9

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Internet Explorer 7

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1:

- Internet Explorer 8

- Internet Explorer 9

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1:

- Internet Explorer 8

- Internet Explorer 9

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1:

- Internet Explorer 8

- Internet Explorer 9

(Windows Server 2008 R2 Server Core installation

not affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Internet Explorer 8

- Windows 8 for 32-bit Systems

- Internet Explorer 10

- Windows 8 for 64-bit Systems

- Internet Explorer 10

- Windows Server 2012

- Internet Explorer 10

(Windows Server 2012 Server Core installation not affected)

Windows RT

- Internet Explorer 10

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 2

- Affected Software:

- Windows XP Service Pack 3

- Windows XP Professional x64 Edition Service Pack 2

- Windows Server 2003 Service Pack 2

- Windows Server 2003 x64 Edition Service Pack 2

- Windows Server 2003 with SP2 for Itanium-based Systems

- Windows Vista Service Pack 2

- Windows Vista x64 Edition Service Pack 2

- Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Windows 8 for 32-bit Systems

- Windows 8 for 64-bit Systems

- Windows Server 2012

(Windows Server 2012 Server Core installation affected)

Windows RT

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 3

- Affected Software:

- Microsoft Word 2003 Service Pack 3

- Microsoft Word 2007 Service Pack 2 and

Microsoft Word 2007 Service Pack 3

- Microsoft Word 2010 Service Pack 1 (32-bit editions)

- Microsoft Word 2010 Service Pack 1 (64-bit editions)

- Microsoft Word Viewer

- Microsoft Office Compatibility Pack Service Pack 2 and

Microsoft Office Compatibility Pack Service Pack 3

- Microsoft SharePoint Server 2010 Service Pack 1

- Word Automation Services

- Microsoft Office Web Apps 2010 Service Pack 1

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 4

- Affected Software:

- Microsoft Exchange Server 2007 Service Pack 3

- Microsoft Exchange Server 2010 Service Pack 1

- Microsoft Exchange Server 2010 Service Pack 2

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 5

- Affected Software:

- Windows XP Service Pack 3

- Windows XP Professional x64 Edition Service Pack 2

- Windows Server 2003 Service Pack 2

- Windows Server 2003 x64 Edition Service Pack 2

- Windows Server 2003 with SP2 for Itanium-based Systems

- Windows Vista Service Pack 2

- Windows Vista x64 Edition Service Pack 2

- Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Impact: Remote Code Execution

- Version Number: 1.0

Important Security Bulletins

============================

Bulletin 6

- Affected Software:

- Windows XP Service Pack 3

- Windows XP Professional x64 Edition Service Pack 2

- Windows Server 2003 Service Pack 2

- Windows Server 2003 x64 Edition Service Pack 2

- Windows Server 2003 with SP2 for Itanium-based Systems

- Windows Vista Service Pack 2

- Windows Vista x64 Edition Service Pack 2

- Windows Server 2008 for 32-bit Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for x64-based Systems Service Pack 2

(Windows Server 2008 Server Core installation not affected)

- Windows Server 2008 for Itanium-based Systems Service Pack 2

- Windows 7 for 32-bit Systems and

Windows 7 for 32-bit Systems Service Pack 1

- Windows 7 for x64-based Systems and

Windows 7 for x64-based Systems Service Pack 1

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation not affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Windows 8 for 32-bit Systems

- Windows 8 for 64-bit Systems

- Windows Server 2012

(Windows Server 2012 Server Core installation not affected)

- Impact: Remote Code Execution

- Version Number: 1.0

Bulletin 7

- Affected Software:

- Windows Server 2008 R2 for x64-based Systems and

Windows Server 2008 R2 for x64-based Systems Service Pack 1

(Windows Server 2008 R2 Server Core installation affected)

- Windows Server 2008 R2 for Itanium-based Systems and

Windows Server 2008 R2 for Itanium-based Systems Service

Pack 1

- Windows Server 2012

(Windows Server 2012 Server Core installation affected)

- Impact: Security Feature Bypass

- Version Number: 1.0

Other Information

=================

Follow us on Twitter for the latest information and updates:

http://twitter.com/msftsecresponse

Microsoft Windows Malicious Software Removal Tool:

==================================================

Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services, and the Download Center.

Non-Security Updates on MU, WU, and WSUS:

========================================================

For information about non-security releases on Windows Update and Microsoft update, please see:

* http://support.microsoft.com/kb/894199: Microsoft Knowledge Base

Article 894199, Description of Software Update Services and

Windows Server Update Services changes in content.

Includes all Windows content.

* http://technet.microsoft.com/wsus/bb456965: Updates

from Past Months for Windows Server Update Services. Displays all

new, revised, and rereleased updates for Microsoft products other

than Microsoft Windows.

Microsoft Active Protections Program (MAPP) ===========================================

To improve security protections for customers, Microsoft provides vulnerability information to major security software providers in advance of each monthly security update release. Security software providers can then use this vulnerability information to provide updated protections to customers via their security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. To determine whether active protections are available from security software providers, please visit the active protections websites provided by program partners, listed at http://www.microsoft.com/security/msrc/collaboration/mapp.aspx.

Recognize and avoid fraudulent email to Microsoft customers:

=============================================================

If you receive an email message that claims to be distributing a Microsoft security update, it is a hoax that may contain malware or pointers to malicious websites. Microsoft does not distribute security updates via email.

The Microsoft Security Response Center (MSRC) uses PGP to digitally sign all security notifications. However, PGP is not required for reading security notifications, reading security bulletins, or installing security updates. You can obtain the MSRC public PGP key at https://technet.microsoft.com/security/bulletin/pgp.

To receive automatic notifications whenever Microsoft Security Bulletins are issued, subscribe to Microsoft Technical Security Notifications on http://technet.microsoft.com/security/dd252948.

********************************************************************

THE INFORMATION PROVIDED IN THIS MICROSOFT COMMUNICATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

********************************************************************

To manage or cancel your subscription to this newsletter, visit the Microsoft.com Profile Center at <http://go.microsoft.com/fwlink/?LinkId=245953> and then click Manage Communications under My Subscriptions in the Quicklinks section.

For more information, see the Communications Preferences section of the Microsoft Online Privacy Statement at:

<http://go.microsoft.com/fwlink/?LinkId=92781>.

For the complete Microsoft Online Privacy Statement, see:

<http://go.microsoft.com/fwlink/?LinkId=81184>.

For legal Information, see:

<http://www.microsoft.com/info/legalinfo/default.mspx>.

This newsletter was sent by:

Microsoft Corporation

1 Microsoft Way

Redmond, Washington, USA

98052

If that doesn’t work… Call Homeland Secure IT at 864-990-4748 for real computer & server support and repair in the Greenville SC area!

What follows is a guest blog post from our friends at EPC, a company providing data destruction services for your end of life computer equipment.

What Does Free Really Cost?

You’ve met the “guy with the pick-up truck” that can take your PC in for free. All of us have. But where does your data on that PC “go?”

Even in a down economy, you have to take a longer look at what “free” means to you not only as a business, but personally. Every year, millions of dollars both outright and in reputation are lost by companies and people all over the world. What can you do to ensure that the data that makes you the company that you are stays safe? How can you protect the information, say from website transactions you make during the year, and trust that your data won’t fall into the wrong hands?

First things first: Let the guy in the pick-up truck drive off empty handed.

Data Destruction isn’t just drilling holes in hard drives or chopping them in half with axes. Today’s hacker can extract data from places you haven’t even yet imagined. It’s time to make sure that the data on your hard drives and electronic media are appropriately sanitized via a certified, NAID sanitation process;  this ensures all information on that drive is permanently  erased.

EPC, Inc. established in 1984, has been in the Data Destruction business for a long time, serving thousands of companies in North America. From the smallest Mom & Pop shop, to Fortune 100 industries, EPC, Inc. has not only the experience, but a proven track record of ensuring that the information that makes companies what they are never falls into the wrong hands.

Whether it’s our e-Steward-certified E-Scrap Processing Center, or our fleet of DDRV’s (Data Destruction Recycling Vehicles), EPC, will deliver the customized service to fit your Data Security needs.

Secure Data Erasure is the ultimate solution, but if your company is looking for another sound option in Data Destruction, EPC, Inc. features a series of HIPAA-compliant, NAID-certified processes that not only shred the materials to Department of Defense specs, but ensure that the materials go to the right place. EPC ensures responsible handling that adds even more security to a solution that will get you satisfied.

EPC, Inc. has recently teamed-up with John Hoyt of Homeland Secure IT, to offer customers in South Carolina a true solution to your IT Destruction needs.

Are you ready to do something different, that ensures the integrity not only of the data on your PCs, but also your reputation? Why not also help the environment at the same time?

It’s time to change the way you think about the end of your electronic assets inside and outside business. Let EPC, Inc. help you meet those needs.

Start your search for a solution now:  Call Eric Levy 636-443-1999
Or visit: http://www.epcusa.com

Here, safe and sound in the Upstate of South Carolina, we have only felt a small portion of the devastation ourselves. FedEx and UPS packages have not made it to us yet. Flights were cancelled. Product is back-ordered while factories get their production lines back online…  Some of us have had friends or family that were in the Northeast and they are finding out that they are okay (I least I hope they are).

Then we have the one company here in the Upstate who is temporarily out of business.  I found out about it through a friend’s Facebook timeline.  This company has not been able to run their manufacturing line since the storm hit the NYC area. Three shifts a day are not working. From what I gather, they host their production data in “the cloud”, where the primary servers are located in New York City, with backups in Chicago and Los Angeles.

The NYC data center went down due to power and internet issues immediately, and the mirrored servers both captured bad images of the data from the primary servers, making them useless. One of the backup sites was able to restore to a previous image of the data within a couple hours, and then it was discovered that a key element was not being copied from the primary.  With the NYC still offline as of an hour or two ago, and no ETA of when that data center would be live again, the local company in question remains offline.

I was unable to get all of the details, but what I have goes something like this: Two years ago, a new system administrator determined that the local company would save X number of dollar by not hosting the data on their premises and paying for servers. They did a study and it all added up, so they moved to a multi-hosted, private intranet solution. “The Cloud”.

The transition was rough, many roadblocks were encountered, mainly bandwidth, as they had to increase their multiple T1s to a Charter Business Fiber connection to handle the traffic for the administration, design and production lines, and some software had to be rewritten.

After several months, things began to run more like they had in the past, with the exception of long delays while they downloaded larger files. And a number of times, they have lost internet connectivity, taking them down for minutes to hours at a time.

The administrative staff and the designers began to keep copies of the most important files on their local machines. They looked into getting a caching server onsite, but the cost was more than they were wanting to pay.

Now, today, they are completely offline, with no idea of when they will be back in production.

Of course, as an IT provider here in the Upstate, I have already made my pitch to help them relocate their data back to servers they control, with backup on remote servers, but their IT personnel still feel the current way is the best way, even though their “savings” was never realized, with no return on investment. We’ll see. I’ll keep at them.

If your business is considering a move to hosted services, make sure it is right for you.  There is a LOT that is often overlooked!

• If you work with large CAD files that take a long time to open on your network now, remember, that you will move from a 100 or 1000 megabit connection, to a MUCH SLOWER connection if you move the files off site.
• If you use Quickbooks or Peachtree, you might find that a connection less than 10meg up and down is simply not going to work for the size of your company file.
• If you run a production line with 50 employees, that would be out of work without an internet connection, this is a bad idea for sure!

There are many factors that may make hosting elsewhere out of the question, but if you don’t know them, it may be too late when you find out.

Call us and schedule a consultation at 864-990-4748!

Our preferred remote backup solution provider is expanding in a big way!

Servosity, which is based right here in Greenville South Carolina, has made a commitment to create 30 new positions over the next 12 to 18 months. And these will be higher paying jobs with a much higher skill requirement.

We continue to use Servosity ourselves and provide their disaster recovery and backup services to our clients because they have one of the best offerings in the business. In addition to that, the money stays right here in the Upstate.

If you would like to find out more about how remote backup and disaster recovery solutions can protect your business data from catastrophic events, such as the recent hurricane that has pounded the East Coast this week, then please, give us a call at 864-990-4748 or use our contact form on the http://www.HomelandSecureIT.com website to arrange a free consultation.

We can protect one single desktop or laptop, or a Microsoft Exchange Server, or an entire network consisting of several servers and many computers with recovery of a lost system to new hardware possible within minutes!

For a price, you can have access to a Fortune 500 server and network according to an article on krebsonsecurity.com.

In the article, they explain hackers are creating a virtual services network of their own, using exploited / compromised / hacked systems sitting inside the corporate networks of Fortune 500 companies.

But it is not just the big corporations that are being compromised, it is businesses just like the one you work at or maybe own. The hackers are able to leverage holes in the operating systems of servers and weak passwords to gain full access, and then sell that access to others who might use your server to gain further access into your network, or simply setup a porn server, or a point where they can hack through your server to other servers elsewhere.

How do you protect yourself? Contact an IT professional who can assist you with an evaluation of your network.

Homeland Secure IT will work with you to help tighten up computer and network security as well as to help determine if your server has already been exploited. We can check your Microsoft Windows servers, RDP servers, firewalls and other common means of access for updates, apply them and determine the best way to keep your company network up to date without affecting your work flow.

Call us today at 864-990-4748 or use our CONTACT link on the website for more information.

You can read about the attack timeline and response here and the WSPA news article here.

If the State’s server can be exploited, what about you?

Do you host data on your company server and feel it is totally safe?

For instance, you have a Microsoft Exchange Server, which resides behind a firewall, and it does not host anything but email, so you feel it is safe?

Not so fast – An Exchange Server might be behind a firewall, but is that firewall up to date? It might be so old that the latest firmware and software cannot even be applied to it. More importantly, if your Exchange Server does not have all the latest patches to it, it might be vulnerable to attack, even though a firewall is present.

A large number of servers at businesses go unpatched, and unprotected, yet are exposed to the internet. It might be an FTP server, a web server, SQL database server, or Remote Desktop server.  They all require updates, patches and evaluation, to assure their continued security.

Should you have a question about the status of your Greenville or Upstate network’s security, please call us at 864-990-4748 and arrange for a consultation. We specialize in small and medium business networks, servers and computers and would be happy to work with you to discover what can be done to protect your business.  We’re also partners with some of the most respected security industry leaders, such as Cisco, Symantec, Trend Micro, WatchGuard, SonicWALL, and more!

Your mailbox is almost full emails still going around… Don’t fall for it…

An email arrives in your inbox with the subject of “Helpdesk Upgrade Alert”, tells you that your mailbox is almost full, and it includes a handy indicator saying that of your 244 MB quota, you have used 241MB.

The text reads, “The Helpdesk is upgrading and maintaining database Server from the old Microsoft Server (No420134x) to the new Microsoft Server (No520193x) CLICK HERE” (With a link) and a nice “Thank You” from the “Helpdesk Upgrade Team”.

That’s just fantastic! *FINALLY* they are getting around to upgrading your database server.    Trouble is, that’s not the case at all.  Instead, this is an ongoing scam, and apparently it works well or we likely would not be seeing as many of them as we do.

This phishing attempt is not all that sophisticated, just a very basic social engineering email offering that link, with text prompts you for anything in the email itself, so this type of message slips past many anti-spam / anti-malware packages, including the Barracuda email appliance.

How do you know this type of message is a scam? For one thing, you probably don’t have a “Helpdesk Upgrade Team” working on the upgrade of your old Microsoft server, however, even if you do, the name of the sender is likely not familiar to you.   The “To:” field may be blank.

Another giveaway is that it doesn’t make sense. IE:  244MB of storage? Come on.   The average mailbox is over a gig now.  Gmail gives you what, 8 to start out?

Hover your mouse over the “CLICK HERE” and you will see the goes outside your company to a Google docs site.  If you visit the site (if your anti-malware / anti-phishing software will let you browse there), you will see a form that asks for your username, password and email address.  Here’s what it looks like:

Helpdesk Upgrade Alert Scam – IT HELPDESK SERVICE form example

If you are not exhausted from a 7 day work week of 12 hour days, you probably will catch on the very moment that you see this site and understand that no IT department in the world would ask for this information in plain text, on a Google docs site.

Then again.  You might just be a trusting soul and enter your username, password and email address, allowing whoever monitors that data to freely access your account.

Should you that be you, and you just realized you have been had at some point, then it is time to change your information.   If your username is JoeBlow and your email address is JoeBlow@somecompany.com, then you might even consider changing to something else.  jblow or JoeCBlow, and change your password while you are at it.  How long ago did this happen?  Has your email been monitored and harvested for a long period of time? If banking information, a credit card or social security numbers were sent in email, ever, then you might have bigger things to worry about.

Alerting your IT department or computer service provider is a great idea at this stage in the game. You want them to know, no matter how embarrassed you might be about it, as they have seen this before, and they will be more than happy to help secure your account and assess the potential damage.

Are you in the financial, legal, government or medical field or work with sensitive or proprietary data of any nature? You may have compliance issues, and those will need to be addressed, quickly. Your IT provider can assist with contacting the proper authorities.

Homeland Secure IT helps Greenville / Upstate SC businesses and individuals with these and other computer and network security issues. We can help you recover, assess the impact and protect you from it in the future. If this has never happened to you, but you are concerned it could occur at your company, to a desk worker, your CEO or yourself, please call us at 864-990-4748 and we will be happy to discuss the matter. Don’t risk identity theft!

Not a pumpkin patch, but a Microsoft Patch!

Here we are, another Patch Tuesday, where Microsoft makes updates available to their products.

The Microsoft Security Bulletin Advance Notification for October 2012 indicates there are seven bulletins that will be addressed today.  They include:

1. Critical – Remote code execution – Affecting Microsoft Office and Microsoft Server
2. Important – Remote code execution – Affecting Microsoft Office
3. Important – Elevation of privilege – Affecting Microsoft Office, Microsoft Server Software, Microsoft Lync
4. Important – Remote code execution – Affecting Microsoft Office, Microsoft Server Software
5. Important – Elevation of privilege – Affecting Microsoft Windows
6. Important – Denial of Service – Affecting Microsoft Windows
7. Important – Elevation of privilege – Affecting Microsoft SQL Server

As always, we highly recommend these and *every* Microsoft related update be applied to your servers and workstations, without delay.

Please remember that failure to do so, leaves unpatched “holes” that can be leveraged to gain control of or access to your desktops and servers.

A network security evaluation should be performed frequently on your business network, and Homeland Secure IT will be happy to undertake this duty in the Greenville / Upstate SC area. Please give us a call at 864-990-4748 or use our contact form. We are Microsoft Small Business Specialists!

We would appreciate it dearly if you could be so kind as to refer your friends or business contacts to us, and if you have time, leave us a review on Google or even just keep us in your thoughts and prayers!

Ideal connections for us are small and medium businesses, from just a handful of people, to dozens of computers and even companies with multiple locations. Businesses who we work best with are law and medical offices, churches & non-profit organizations, manufacturing, and just about anyone with computers, servers, networks, voice over IP phone systems. We are even a great match for home based offices who rely heavily on their computers.

Know of a particular need?  A business considering a new server, phone system or maybe replacing a single computer or even a dozen of them? We’re perfect for that!

I know your time is valuable, but if you could help us out with a referral, I would appreciate it more than you know. Referrals and reviews help keep us busy and out of trouble.

Speaking of reviews…  When someone searches Google for “Greenville Computer Service” it doesn’t matter so much, but if they go to Google Places or search from something like “Greenville Computer Repair Shop”, they are presented with the local search listing, which DOES show reviews. A person who needs help will likely call the business with the highest number of reviews and the highest score.   Please help us by leaving a positive review for us.

You can find our reviews here:

https://plus.google.com/112683747267029712129/about?hl=en

In order to leave a review, you will have to convert your regular old Gmail account over to a Google Plus account (if you have not already), which is free, simple to do, and gives you a number of new networking tools to use yourself.  Once you have done so, you can leave a review.  Please consider marking us a “3″, if you have been happy with us!

If you already have helped with a referral or a review, you have my deepest gratitude!  THANK YOU!

John

If you are like most people, when everything is running well, you get comfortable and begin to do the job you were hired to do, so if you are the accounts manager and pull double duty as company IT administrator, chances are, you get back to doing what you do best – taking care of the accounts.  That is, until something comes along and throws a wrench in the works and your networking is not working.

But what about all those updates? Do you back-burner those until there is a good time to reboot the server? After all, rebooting the server takes everyone down, and causes your phone to light up with questions like, “When will I be able to access the X drive again?”.

During the time between updates, your server and other systems are vulnerable. It honestly may not be a matter of IF your network is compromised, but rather, WHEN.

Many non-dedicated IT admins will apply the updates but not reboot the server, or will wait until there are so many updates it may take 2 or three reboots to get everything applied. This is a very bad practice. Especially for servers facing the internet (Mail, SQL, Web).

What about backups?  You ARE backing up, and it does work properly, right?

Don’t get caught with your pants down.  Bring in an IT support company who can help you determine where you stand. Are you overworked and just unable to do it all? Consider an IT company who will provide you with a statement to that affect which you can provide to your manager or superior to document that there is additional work to be done.  Sure, you’ve told them time and time again, but maybe, just maybe, they might listen to an outside source.

Let Homeland Secure IT be that source of information. We’ll come in and take a look at the state of your network, provide suggested course of action, and can even quote the labor or upgrade of components (if required). Simply don’t have time to maintain all this gear and want to source it to someone who will be on top of it?  Then we’re on IT! Give us a call at 864-990-4748 or use the contact link above.

We provide complete IT service, sales and consultation to the entire Upstate of South Carolina. We’re your Microsoft, Cisco, Symantec, Trend Micro, Lenovo, HP partner, specializing in small and medium businesses (SMBs) just like yours!

“My computer is locked and a screen is displaying a message from the FBI saying I have to pay a fine in order to use it again”

“A window says I am in violation of the law for downloading media or port and says it is from the FBI”

One user in the know says, “I am infected with the Reveton FBI virus, can you remove it?”

Without question, this has been one of the more popular exploits we have seen so far this year.  It is called the Reveton virus, and is part of a Citadel malware payload that distributes a number of malicious software.

This is so popular that the FBI has had a “new internet scam” page up since August and this is an excerpt from that page that goes back to May 2012. (This is not new by any means):

The IC3 suggests the following if you become a victim of the Reveton virus:

• Do not pay any money or provide any personal information.
• Contact a computer professional to remove Reveton and Citadel from your computer.
• Be aware that even if you are able to unfreeze your computer on your own, the malware may still operate in the background. Certain types of malware have been known to capture personal information such as user names, passwords, and credit card numbers through embedded keystroke logging programs.
• File a complaint and look for updates about the Reveton virus on the IC3 website.

Just because the office is locked up doesn’t mean we are not here for you though, so if Monday comes and your computer or server is having problems and you are NOT enjoying “down time”, then please call us anyway, as voice mail will go to our email accounts and we will return your call ASAP.

Hopefully, you will get a day off too, and enjoy a three day weekend.

Be safe, have fun!

Look no further than Homeland Secure IT in Greenville South Carolina! We offer sales, service and support both home and business computers, servers and network components. We repair computers whether we sold them to you or not!

If you want to save money, bring your computer to us! People from as far away as Georgia and Knoxville, TN travel to our location for us to repair their desktop, notebook or other components. We have had computers shipped to us from the coast, and from the North East too!

By bringing your computer to us, we are able to reduce our rates to an unheard of 75.oo per hour. With FREE estimates.  Why so cheap? Because we do not have to dispatch a technician to your location to perform the service. However, if you are in the Upstate and need service, we will happily go to you.

Save some money, call us and arrange a time to come in.  We suggest you do not just stop by, because sometimes everyone is in the field performing service.

Call us at 864-990-4748 or use the contact form in the menu above.

We are partners with and offer for sale many different lines of computers too!  A few brands we sell and work with regularly are HP, Lenovo, Toshiba, Dell, Nexlink, Samsung, Acer, Asus, Sony, Microsoft, Cisco, Symantec, Trend Micro and a long line of others!

A few cities in the Upstate that people come from and we offer service to are Easley, Simpsonville, Six Mile, Clemson, Seneca, Duncan, Spartanburg, Anderson, Liberty, Taylors, Greer, Mauldin, Berea, Boiling Springs and anywhere within about an hour’s drive from Greenville.

• Initial outlay of cash
• Downtime during installation & migration
• Learning new software, time to train
• Double entry on two systems working simultaneously for a period of time
• Final migration to the new system after they see the new software working
• Lost revenue during this change-over

The list was actually longer than that, but I made it a little more concise in the interest of not boring you with details.

I then remembered a recent letter I received from one of our lending partners which says they offer Flex Plans, designed specifically to help out during times like this!

They can offer a 60 or 90 day “delay plan”, to keep cash flow at current levels until after the installation is complete.

That sounds like a winner to me! Maybe it can work for the client in question, and potentially someone reading this may have a similar concern and the knowledge that this is available could help.

Should your business be considering an upgrade of computers, servers or network equipment, please give us a call at 864-990-4748 or use the CONTACT link in the menu and let’s talk about what we can do for you!

The updates released this week are serious, people.

If you do not patch up your computers and servers, or call us in to do it for you, the chances of being exploited are incredibly high….  Especially for the Microsoft Exchange and Remote Desktop vulnerabilities.

Sorry to harp on it, but this is important….  Too many gaping holes to ignore this time.

Should you need help with this or any other IT service in Greenville, Spartanburg or Anderson, please call us at 864.990.4748.