Strange filepro event

[Richard Kreiss]

Nancy,

May I suggest that a check on the following:

1. Check the report of the from the anti-virus software being run.
2. check the Windows update as the malware removal update may have done this.
3. check to see who was logged in over the week-end.

I hope they had backups.

One of my clients was hit with ransom-ware and refused to pay the ransom.  We found a company in Florida which was able to remove this.  We have changed the backup procedure for this client.

1. Backup is done to a USB memory stick each night and replaced with a new memory stick.  The previous one is delivered the to the company owner's office off premises.
2. They are running filePro's mirror function to a backup server.
3. Installing a NAS to be used for backup also.

Their insurance company suggested that a VPN be setup between warehouses and the data copied to a computer there.  The worst case scenario would be that they would be one day behind if there were an issue at the current location and needed to install on another server.  As it stands,  the mirror computer is a server and can be activated quickly if necessary.

Richard



> -----Original Message-----
> From: Filepro-list [mailto:filepro-list-
> bounces+rkreiss=verizon.net at lists.celestial.com] On Behalf Of Nancy Palmquist
> via Filepro-list
> Sent: Tuesday, February 27, 2018 11:49 AM
> To: filepro-list at lists.celestial.com
> Subject: Re: Strange filepro event
> 
> Jose,
> We know filepro did not do it but since it affected my filePro customer I took
> some liberty and suggested it might affect other filepro customers.  It is not like
> Credit is not an unlikely prefix for a filepro output or process table.
> 
> But it was a bit weird and gave me a chuckle.
> 
> Nancy
> On 2/27/2018 11:33 AM, Jose Lerebours via Filepro-list wrote:
> > not sure how this is an "strange filePro event" since it is more of a
> > "intrusive antivirus program" ... Perhaps, this program has a "white
> > list" where anything in ~filepro ~fp is given a pass?
> >
> > lol, I am sure I am gonna get it for even thinking that a white list
> > may exist as the list itself could be compromised and hide viruses ...
> > what a vicious cycle.
> >
> >
> >
> > On 02/27/2018 11:25 AM, Nancy Palmquist via Filepro-list wrote:
> >> Fellow filepro Users,
> >>
> >> I just had a customer call that is using a Windows Server for
> >> filepro.  They reported that an error indicated a file was not found
> >> which turned out to be a file called "CREDITFM.prc".
> >>
> >> We looked further and the "CREDITFM.OUT" was also missing as was
> >> another form and process called "CREDIT2.prc" and "CREDIT2.out"
> >>
> >> We searched further and it seems every filepro process and output
> >> that started with the letters "CREDIT" were removed. They had such
> >> files in two different filepro databases.
> >>
> >> My guess is that these files were somehow tagged as possible virus
> >> files and maybe removed automatically or a user somewhere was queried
> >> about removal and agreed.  It is unlikely that a user searched out
> >> these files and deleted them for sport.
> >>
> >> I am usually not surprised by this when I see filepro files
> >> disappear.  I had zero length files deleted - usually DATA files
> >> which you don't notice until you try to change the map or expand the
> >> file.
> >>
> >> But if you have a customer on a windows server and files of this type
> >> disappear maybe this will save you some time checking it out.
> >>
> >> I do not have the name of the virus scanner they use.  The user was
> >> not familiar with that part of the system.
> >>
> >> Nancy
> >>
> >>
> >
> 
> --
> Nancy Palmquist         MOS & filePro Training Available
> Virtual Software Systems    Web Based Training and Consulting
> PHONE: (412) 835-9417           Web site:  http://www.vss3.com
> 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <http://mailman.celestial.com/pipermail/filepro-
> list/attachments/20180227/65fb0ed5/attachment.html>
> _______________________________________________
> Filepro-list mailing list
> Filepro-list at lists.celestial.com
> Subscribe/Unsubscribe/Subscription Changes
> http://mailman.celestial.com/mailman/listinfo/filepro-list