Once the malware is activated, it sits dormant for three days and then encrypts files on the infected computer. It then demands a ransom in exchange for decrypting the files. While the ransom does not increase over time, files will remain permanently inaccessible until the ransom is paid. Datarecovery.com’s research teams are working to find solutions for KeRanger victims and can help you resolve infections on any type of computer or network.

If your computer has been infected with KeRanger, turn it off, disconnect all Time Machine media (backup media on Mac OS X systems), and call Datarecovery.com at 1-800-237-4200 to speak with a malware expert. Our specialists are standing by to discuss your options.

What is KeRanger Ransomware (And How Does It Work)?

KeRanger is the first ransomware that targets Mac OS X. This means that after years of treating malware as a Windows problem, Mac users must finally familiarize themselves with ways to protect themselves against ransomware. Here are some key points to know about KeRanger.

• KeRanger uses a sophisticated method to infect new victims. The attackers created a fake version of the legitimate torrent client Transmission. They gained access to Transmission’s website and replaced the real application with a Trojan. The developers had a compromised digital certificate from Apple, which caused the malware to go undetected on infected computers.
• The malware infected application includes a file named General.rtf that is not a legitimate RTF document. It’s actually an executable program, and when a user runs the infected Transmission app, the malicious executable is copied to “kernel_service” and executed. It eventually begins encrypting various file types on the computer, attached devices, and even networked media.
• Gatekeeper, a new security feature from Apple, blocks any app that does not have a developer ID. However, KeRanger acquired and misused a valid certificate, so Gatekeeper initially did not give any warnings about the malware.
• KeRanger is a variant of Linux.Encoder.1, which was the first malware to target Linux users.
• Palo Alto discovered that KeRanger’s developers appear to be working toward an attack on Time Machine in order to prevent Mac users from retrieving their backup files. If your computer is infected with KeRanger, we recommend turning your machine off immediately and disconnecting all Time Machine media to prevent the infection from spreading.

Datarecovery.com is working on ways to combat KeRanger and recover files for those affected by the malware. Because we believe that KeRanger’s developers are working on ways to encrypt even backup files, it is crucial to act immediately if your computer is affected.

How Does KeRanger Ransomware Infect My System?

While many malware programs are spread through emails and hacked web sites, KeRanger has a different approach. It contains itself in a false RTF file that victims download when they install a torrent client on their computer. When that torrent client is opened by a user, the RTF file is executed, and the malware sets itself in motion.

After staying dormant for three days, KeRanger sifts through a variety of file types and encrypts them. The following is only a partial list of the files that KeRanger targets.

.asp, .avi, .class, .csh, .cpp, .db, .doc, .docx, .docm, .dot, .dotm, .eml, .flac, .gzip, .java, .jpg, .jpeg, .lua, .mp3, .mp4, .mpg, .pem, .ppt, .pptx, .pptm, .pot, .potx, .potm, .pps, .ppsm, .ppsx, .rar, .sql, .tar, .xls, .xlsx, .xlsm, .xlt, .xltm, .xltx, .txt, .csv, .rtf, .te, .wav, .zip

What Ransom Payment Does KeRanger Demand for Decrypting Files?

KeRanger demands a payment of one bitcoin, which is now approximately $650 US. The ransom does not increase over time, nor is there a deadline for paying it, but your chances for recovering your files decreases as time goes on. As is often the case with ransomware, the attackers will decrypt one file for free as proof that the decryption service works.

Can I Disable KeRanger Ransomware Encryption?

If you have not already run Transmission 2.90 (the torrent client that was initially compromised), you can upgrade to 2.92, which will remove the malware file from your computer. If you have already installed the infected program, it’s possible that your files are recoverable through Time Machine.

Call the security experts at Datarecovery.com to discuss your situation. We will look for the least expensive and most effective way to recover your files, ideally without paying the ransom request. If it is possible to recover uninfected files through Time Machine or other backup systems, our specialists can provide the resources you need to complete the recovery safely. As a last resort, we can facilitate a secure bitcoin payment to fulfill the ransom requirements.

Datarecovery.com may be able to restore your files, but time is a factor, and we recommend seeking immediate assistance at the first sign of KeRanger ransomware infection. Our malware experts are ready to help at 1-800-237-4200.

The post KeRanger Ransomware Infection And Decryption Services appeared first on Datarecovery.com.

Apple, Inc. recently announced the new file system to developers, although APFS wasn’t the direct focus of the company’s WWDC 2016 keynote address.

Since APFS draws from the successful features of Apple’s HFS+ while incorporating features from other next-generation file systems such as ZFS, Datarecovery.com’s engineers already have an established set of viable data recovery tools.

“Some of the new features of APFS have been around for a while, so we’ve already developed resources that we could reliably use in a data recovery case,” said Ben Carmitchel, President of Datarecovery.com. “Obviously, we need to build new recovery utilities for the file system efficiently, but our research engineers are already hard at work.”

“We’re completely confident that we could handle an APFS case with our current technology,” Carmitchel added. “Now, we’re working at making that process more efficient.”

APFS will support clones, writable copies of storage blocks that track changes and allow those changes to be rolled back. This is largely seen as preferable to the copies used in HFS+, because clones are writable (not just readable). Mac users will be able to use the new features to back up their systems reliably.

“APFS is exciting, and it should make data backup even easier for Mac OS users,” said Carmitchel. “That means fewer instances of data loss. However, until the file system has been in popular use for several months, we strongly recommend keeping full, offsite backups of any APFS volumes to protect important data.”

Other features of the operating system include improved atomicity, adaptable filesystem-level encryption and TRIM support. Datarecovery.com’s engineers will perform simulated recoveries of APFS from various media, including solid-state drives and servers, to establish a streamlined process for APFS data recovery.

“From what we’ve seen so far, APFS improves on HFS+ in just about every conceivable way,” said Carmitchel. “However, it’s important not to confuse functionality with redundancy. Data loss will still be a problem with this file system, so proper backup procedures are absolutely important.”

“If a drive fails, or a file becomes corrupted without a back up, we’ll be ready to help.”

Datarecovery.com is a worldwide leader in data loss prevention, computer forensics and data recovery services. With four locations in California, Illinois, Arizona, and Toronto, the company provides a variety of services to thousands of clients each year. Visit https://datarecovery.com for more information.

The post Datarecovery.com Announces Support for APFS File System appeared first on Datarecovery.com.

March 16, 2011 – Edwardsville, IL – Datarecovery.com today announced the release of a new Apple/Mac OS version of its popular data recovery software solution, SaveMyFiles.

SaveMyFiles is able to recover deleted, corrupt, or otherwise lost data from Apple and Windows-based systems.

The Mac OS version of the software uses very different methods from the Windows version, as the Windows operating system doesn’t automatically overwrite deleted data in the way that Mac OS does. Mac OS also uses an entirely different file system known as HFS+.

The Mac OS version of SaveMyFiles will carry a similar price as the Windows version and will be available for download at DataRecovery.com.

“We wanted to give consumers a fully featured data recovery program that really lives up to its name, as that’s lacking in the Mac OS market right now,” said Ben Carmitchel, President of DataRecovery.com. “Most recovery programs don’t do what they promise, but by using our experience in working with thousands of damaged Apple hard drives, we’re able to offer a product that we can stand behind.”

In addition to its primary function as a data recovery program, SaveMyFiles can be used for investigative purposes to see which files on a computer have been downloaded or to view recent activity. This could allow for an easy method of computer forensics and electronic discover for home buyers who may not be able to afford expensive legal services.

“We’ve already had customers use the software to find evidence of employees’ illegal activities, to find and prove infidelity before a divorce, and to keep track of what their children are doing on the Internet,” said Carmitchel. “As long as SaveMyFiles is used legally, it can be an incredibly powerful forensic tool.”

The software can be purchased at DataRecovery.com.

DataRecovery.com is a worldwide leader in data recovery services for RAID systems, hard drives, flash media, and other digital storage devices since 1998. They are currently one of only three data recovery companies to hold a US Government GSA contract and have locations across the United States and Canada.

Contact Information
Datarecovery.com, Inc.
Ben Carmitchel
1-618-307-0068
www.datarecovery.com
Ph. 800.237.4200 ext. 253

The post Datarecovery.com Releases Data Recovery Software for Mac File Systems appeared first on Datarecovery.com.