Lots of good posts. I plan to look at each as we are still in the dark other than e know it was something and that whatever it was, it was as close to having some kind of AI running the show as i have ever seen.
Depending on too many variables it seemed to do different things. It also seemed to be tied in with multiple other "bad guys" such that oven when whatever the main threat was gone, there were many little things left laying around. If it was not Rombertik, it had all the earmarks. The weird background was probably part of the "trash" that is loaded into Rombertik in an attempt to obscure the Malware.
I can tied a few odd events that occurred to each of the people affected but there were people who also had those same odd events who did NOT get the "Full Monty" treatment.
For the time being, it is now using up more of my time trying to be sure it is GONE and not just HIDING. Once goingthrough an experiencelike this it leaves you feeling almost like there is no point in trying if there is no way to win
I know the AV software companies probably have this one under control by now. At least we have not had any further issues so I hope so.
I even understand their reasoning behind each one giving the same virus a different name. But that same reasoning makes it nearly impossible to know if a threat removed by the AV program now is the same threat I was dealing with a few days ago. It is hard when they ask for a "sample" yet I don't even have a Vector at this point, much less a way to contain a sample.
By the time i THOUGHT i knew what to look for, it appeared to have morphed into so many varied forms and types of damage it honestly was easier to just reformat.
And:
Even then, I can't be sure. Reformat to Factory?... maybe. As long as it hasn't infect that sector too.
With Windows 8.1 having no external media that i can be 100% sure about, and with the license codes embedded in bios, there is only so far you go. When all seems well a week later it could be just because the AV companies had finally gathered enough evidence to add a specific marker to their signature files so they catch it before the damage is done.
Thanks for all the comment and if the discussion itself got even one person to be more aware of their vulnerabilities it was worth it. Those who got hit lost every file they had.... One way or the other. If the virus did not get it, i had no choice but to scrub anyway because i could not risk that it might be hiding there. Anyone displaying almost any of the symptoms was a suspected carrier.
If nothing else, i learned a lesson in humility. It is easy to play Monday Morning Quarterback but when you are in the game while the ball is in play, things look a lot different.
And i hope the employees learned to make backups. NONE of them, not a single one, has made any attempt to keep anything now for years. Worst of all, they use their desktops like a filing cabinet and no amount of pushing on my part has made even a dent in that practice.
It doesn't help that Windows has made it nearly impossible to "restore to 3 days ago" instead opting for a more useful (but far more complex) method of "version per file" which requires an additional drive and by default is set to OFF.
Because NO ONE here has made the final jump in user interface, all of them preferring to keep their old Windows 7 layout through various utilities, it left most with not even a chance of recovery if affected.
