Once the malware is activated, it sits dormant for three days and then encrypts files on the infected computer. It then demands a ransom in exchange for decrypting the files. While the ransom does not increase over time, files will remain permanently inaccessible until the ransom is paid. Datarecovery.com’s research teams are working to find solutions for KeRanger victims and can help you resolve infections on any type of computer or network.

If your computer has been infected with KeRanger, turn it off, disconnect all Time Machine media (backup media on Mac OS X systems), and call Datarecovery.com at 1-800-237-4200 to speak with a malware expert. Our specialists are standing by to discuss your options.

What is KeRanger Ransomware (And How Does It Work)?

KeRanger is the first ransomware that targets Mac OS X. This means that after years of treating malware as a Windows problem, Mac users must finally familiarize themselves with ways to protect themselves against ransomware. Here are some key points to know about KeRanger.

• KeRanger uses a sophisticated method to infect new victims. The attackers created a fake version of the legitimate torrent client Transmission. They gained access to Transmission’s website and replaced the real application with a Trojan. The developers had a compromised digital certificate from Apple, which caused the malware to go undetected on infected computers.
• The malware infected application includes a file named General.rtf that is not a legitimate RTF document. It’s actually an executable program, and when a user runs the infected Transmission app, the malicious executable is copied to “kernel_service” and executed. It eventually begins encrypting various file types on the computer, attached devices, and even networked media.
• Gatekeeper, a new security feature from Apple, blocks any app that does not have a developer ID. However, KeRanger acquired and misused a valid certificate, so Gatekeeper initially did not give any warnings about the malware.
• KeRanger is a variant of Linux.Encoder.1, which was the first malware to target Linux users.
• Palo Alto discovered that KeRanger’s developers appear to be working toward an attack on Time Machine in order to prevent Mac users from retrieving their backup files. If your computer is infected with KeRanger, we recommend turning your machine off immediately and disconnecting all Time Machine media to prevent the infection from spreading.

Datarecovery.com is working on ways to combat KeRanger and recover files for those affected by the malware. Because we believe that KeRanger’s developers are working on ways to encrypt even backup files, it is crucial to act immediately if your computer is affected.

How Does KeRanger Ransomware Infect My System?

While many malware programs are spread through emails and hacked web sites, KeRanger has a different approach. It contains itself in a false RTF file that victims download when they install a torrent client on their computer. When that torrent client is opened by a user, the RTF file is executed, and the malware sets itself in motion.

After staying dormant for three days, KeRanger sifts through a variety of file types and encrypts them. The following is only a partial list of the files that KeRanger targets.

.asp, .avi, .class, .csh, .cpp, .db, .doc, .docx, .docm, .dot, .dotm, .eml, .flac, .gzip, .java, .jpg, .jpeg, .lua, .mp3, .mp4, .mpg, .pem, .ppt, .pptx, .pptm, .pot, .potx, .potm, .pps, .ppsm, .ppsx, .rar, .sql, .tar, .xls, .xlsx, .xlsm, .xlt, .xltm, .xltx, .txt, .csv, .rtf, .te, .wav, .zip

What Ransom Payment Does KeRanger Demand for Decrypting Files?

KeRanger demands a payment of one bitcoin, which is now approximately $650 US. The ransom does not increase over time, nor is there a deadline for paying it, but your chances for recovering your files decreases as time goes on. As is often the case with ransomware, the attackers will decrypt one file for free as proof that the decryption service works.

Can I Disable KeRanger Ransomware Encryption?

If you have not already run Transmission 2.90 (the torrent client that was initially compromised), you can upgrade to 2.92, which will remove the malware file from your computer. If you have already installed the infected program, it’s possible that your files are recoverable through Time Machine.

Call the security experts at Datarecovery.com to discuss your situation. We will look for the least expensive and most effective way to recover your files, ideally without paying the ransom request. If it is possible to recover uninfected files through Time Machine or other backup systems, our specialists can provide the resources you need to complete the recovery safely. As a last resort, we can facilitate a secure bitcoin payment to fulfill the ransom requirements.

Datarecovery.com may be able to restore your files, but time is a factor, and we recommend seeking immediate assistance at the first sign of KeRanger ransomware infection. Our malware experts are ready to help at 1-800-237-4200.

The post KeRanger Ransomware Infection And Decryption Services appeared first on Datarecovery.com.

Apple’s Xserve utilizes a wide variety of RAID levels, and Datarecovery.com offers services for every configuration.

The most common configuration is a standard stripe set with parity ( RAID 5). The default RAID stripe size is 64k (128 sectors), and data is striped across all of the disks with a parity block that rotates between the drives; this parity block uses the XOR algorithm.

If one disk fails in a standard RAID 5, the RAID controller card can default to degraded mode and the server can continue to operate without interruption. Data recovery may be necessary if there is corruption within essential parity blocks or if a second drive fails while the array is operating in a degraded state. Additional data loss issues include failed firmware upgrades, RAID controller card failures, and natural disasters.

Xserve also supports hardware RAID levels 0, 1, 3, and 0+1. RAID levels 10, 30, and 50 are available, but these levels must be supported supported using host-based software RAID. Our engineers have experience with every configuration, including options not supported by Xserve hardware, and each of our laboratories is completely outfitted for Xserve data recovery.

If you have an Apple Xserve and you need to recover key files after a failure, contact us right away at 1.800.237.4200 to discuss options.

Real Laboratories for Xserve RAID Data Recovery

To keep your downtime to a minimum, we will work closely with your IT staff to create a case-appropriate recovery and reintegration plan. In some circumstances, this can include on-site recovery at your location or remote data recovery. We recognize that Xserve systems play a critical role in your business’s operation, and our experience with various Xserve models allows for a RAID recovery success rate of 95 percent (dependent on scenario, RAID level, and other factors).

Datarecovery.com operates fully outfitted laboratories – unlike our competitors, we do not receive your media and immediately outsource it to another facility.  With locations throughout the United States and Canada, we can quickly gain access to your RAID media and begin working on your case. We create full clones of every drive in the array before performing data recovery, and our Apple specialists can create software on-the-fly to address your server’s specific needs.

Datarecovery.com’s Xserve technology is unparalleled, and we’re always available to provide a free consultation. Call us now at 1.800.237.4200 and ask to speak with an Xserve expert.

Apple Xserve RAID
*Xserve is a registered trademark of Apple Computer, Inc. Datarecovery.com, Inc. is not affiliated with Apple Computer, Inc. All images herein are property of Apple Computer, Inc.

The post Apple Xserve RAID Data Recovery appeared first on Datarecovery.com.

March 16, 2011 – Edwardsville, IL – Datarecovery.com today announced the release of a new Apple/Mac OS version of its popular data recovery software solution, SaveMyFiles.

SaveMyFiles is able to recover deleted, corrupt, or otherwise lost data from Apple and Windows-based systems.

The Mac OS version of the software uses very different methods from the Windows version, as the Windows operating system doesn’t automatically overwrite deleted data in the way that Mac OS does. Mac OS also uses an entirely different file system known as HFS+.

The Mac OS version of SaveMyFiles will carry a similar price as the Windows version and will be available for download at DataRecovery.com.

“We wanted to give consumers a fully featured data recovery program that really lives up to its name, as that’s lacking in the Mac OS market right now,” said Ben Carmitchel, President of DataRecovery.com. “Most recovery programs don’t do what they promise, but by using our experience in working with thousands of damaged Apple hard drives, we’re able to offer a product that we can stand behind.”

In addition to its primary function as a data recovery program, SaveMyFiles can be used for investigative purposes to see which files on a computer have been downloaded or to view recent activity. This could allow for an easy method of computer forensics and electronic discover for home buyers who may not be able to afford expensive legal services.

“We’ve already had customers use the software to find evidence of employees’ illegal activities, to find and prove infidelity before a divorce, and to keep track of what their children are doing on the Internet,” said Carmitchel. “As long as SaveMyFiles is used legally, it can be an incredibly powerful forensic tool.”

The software can be purchased at DataRecovery.com.

DataRecovery.com is a worldwide leader in data recovery services for RAID systems, hard drives, flash media, and other digital storage devices since 1998. They are currently one of only three data recovery companies to hold a US Government GSA contract and have locations across the United States and Canada.

Contact Information
Datarecovery.com, Inc.
Ben Carmitchel
1-618-307-0068
www.datarecovery.com
Ph. 800.237.4200 ext. 253

The post Datarecovery.com Releases Data Recovery Software for Mac File Systems appeared first on Datarecovery.com.