Showing posts with label viruses. Show all posts
Showing posts with label viruses. Show all posts

17 April 2016

RansomWare 3,
Recovery

by Leigh Lundin


 WARNING  In part 1, we discussed a nasty type of malware (malicious software) called ransomware and in part 2, we recommended preventive steps. In this final article, we explore options in the event your computer is attacked.

Don’t Pay

That’s the advice of most professionals. Besides filling criminal coffers, a better reason leaps out. FireEye Security and technical advisor Alain Marchant estimate only 60% of payees get their computer back intact. BitDefender estimates even dimmer odds, as few as half of those who pay see their files returned. Symantec hasn’t published figures but they’re also not optimistic about the odds of success.

The poor odds of successfully retrieving files has drastically impacted the ‘business’ of extorting stolen files. TeslaCrypt perps have taken two unusual steps.
  1. They set up a secretive TOR ‘dark web’ message center to facilitate payment.
  2. To prove they can actually decrypt files, they offer to decrypt a small (very small) file of the user’s choice.
Yet, as they try to extract payment, their pages hint at the myriad failures and pitfalls: «If step 2 goes wrong, then attempt this and if that goes wrong then try that and maybe try again in 10-12 hours… which may exceed the allotted time… blah, blah.»

Then consider the matter of who reaps the stunning profits from ransomware. It’s tempting to blame ordinary criminals but in fact, ransomware funds terrorist groups like Daesh/ISIS and al-Qaeda. State-sponsored extortionists include the obvious suspects, China, North Korea, and Russia. Technical authors Gregory Fell and Mike Barlow further accuse Iran and Israel of sponsoring attacks at the expense of the rest of us.

Ransomware is an international problem. The Russian security firm Kapersky Lab was reportedly hit with ransomware and thus turned their attention to addressing the problem. French security consultant Alain Marchant, who goes by the name xépée and cheerfully admits Marchant may not be his real name, has developed a client base of victims ranging from individuals to major companies. Here at home, developers of anti-virus products have trained their sights to the problem.

The Costs

Worldwide, malware sucks more than a half-trillion dollars out of the annual economy. Some target individual countries like Japan (TorLocker) and Russia (Kryptovor), but others are indiscriminate. The US alone loses $100-billion annually.

Cyber crime is lucrative and safe. While one or two man operations bring in as little as $1100-5500 daily, Symantec traced one revenue stream that amounted to $35 000 a day, a number consistent with a study by FireEye Security. At the upper end of the scale, Cisco’s Talos Group calculated the Angler exploit (CryptoWall, TeslaCrypt) each day targets more than 90 000 users, pulling in $100 000… every day.

Losing family photos is one thing, but businesses have lost their files, charities their revenue, hospitals their patient records, government agencies their data, and– in at least three cases– people their lives.[1],[2]

Practicalities

Acquaintances of ‘Mark’, a victim mentioned in last week’s article, casually recommended caving to demands and paying off, ignoring the odds and consequences. Those acquaintances may be well-heeled and untouched by ordinary concerns like money and terrorist funding, suggesting if one can afford it, why not? Fortunately, Mark had a friend to help see him through the worst of a bad situation.

If you are a victim, only you understand your circumstances or desperation, but treat pay-offs only as an absolute last resort. Be prepared for the worst– your payment may go for naught.

Easy Pickings

Chances are you’ve seen web pages or pop-up windows that claimed your computer has been damaged or compromised and to call ‘Windows’ or ‘MacOS’ where ‘professionals’ for a fee will help you stamp out this insidious nuisance, one they created, although they don’t tell you that.

These are usually simple browser attacks– JavaScript on a web page seizes control of your Edge browser, or Internet Explorer, Safari, Chrome, FireFox, etc. The good news is they’re relatively easy to defeat, although getting out of the situation can puzzle an average user.

In these cases, don’t panic and don’t call the toll-free number the bad guys so thoughtfully provided. You may want to call a friend for technical assistance, but you may be able to solve it yourself.

The key to recovery is killing the script, the little program abusing your browser. You may be able to simply close the page, and if so, job well done.

Another approach is to open the browser Preferences or Options and disable JavaScript. Once JavaScript if paused, you can close the web page at your leisure, alt-ƒ4 or the more nuanced ctl-w for Windows, cmd-w (⌘-w) for the Mac. Unfortunately, FireFox made the decision to remove the option to disable JavaScript, but add-ons like QuickJS, NoScript and Ghostery give users that option. For the Mac, typing command-comma (⌘,) normally brings up preferences, but the malicious script may thwart that move.

What happens if you can’t close the web page and can’t disable JavaScript? You have no choice but to kill the browser and restart with a goal of stamping out the offending window. Use the Macintosh Force Quit (⌘-opt-pwr) or the venerable Windows Task Manager (win-shft-esc). You may be able to right-click on the program icon to close it. When restarting Safari and Edge, use finger dexterity to close the offending window– you may have to force-quit and restart a couple of times to succeed. FireFox is helpful here: They provide a dialogue box asking which pages you want to reopen (or not).

Note that you may have to smack down more than one browser window. At least one exploit deploys two pages using one to reopen the other if it’s closed. Both pages need to be killed.

Trust Issues

As with other ‘exploits’ (short for exploitations in professional parlance), you can (and should) take the preventive measure of downloading an alternative browser to your computer, say Opera, FireFox or Chrome. If a bad script has nailed your Safari or Edge browser, you can fall back on an alternative until you can get help.

The other key step is not to download anything you don’t trust. Don’t fall for messages claiming your Java or Flash or SilverLight player needs to be updated. Be extremely shy of web mail that offers to upgrade Windows 10. The safe way to update is not to click on the helpful button, but to locate the official web sites and manually download any updates yourself. Make certain the URL says java.com, adobe.com, or microsoft.com (with or without the www.) and no variation like javaupdate.com.

In the past, professionals have disdained automatic updates and that’s fine for them. Let them micromanage if they will, but for the average user, I break with my colleagues and suggest automatic updates might prove safer. The reason is that if you already trust a program, then its updates are reasonably safe as well. At worst, you may get a message saying that FireFox must be restarted, although if you don’t restart immediately, the updates will kick in after you quit your current session.

Apple and Microsoft occasionally check for updates. While I approve of the automatic mode, I suggest running the update check one time manually so you know what to look for.

RansomWare

Thus far we’ve discussed the simplest form of ransomware that merely subverts your browser. At present, you’re more likely to encounter web exploits than the really nasty kind that takes over your computer by encrypting files and user programs.

True ransomware programs demand payments ranging from $200 to over $2300 ($475 appears average) in untraceable digital payments, up to tens of thousands of dollars when targeting hospitals, corporations, and crippled city and county governments. There is no single flavor of ransomware. At least half a dozen strains are extant plus offshoots and variants. Each makes up its own rules and demands. Early models sought cash transfers via Western Union and later Ukash, MoneyPak, and PayPal My Cash, but nearly all now demand payment in anonymous digital money– BitCoin.

The other characteristic found in most ransomware is the imposition of a deadline, after which the bad guys state they’ll refuse to restore your files altogether and at least one variant claims it will permanently ruin your hard drives, not merely beyond recovery but beyond formatting (a highly dubious claim).

The time limit serves one primary purpose, to apply pressure and rattle the victim, to preclude the user from thinking his way out of the dilemma. A time limit makes it difficult to gather information, tools, and help. The target may not have sufficient opportunity to order recovery tools or a second drive to work from or a create a bootable disc.

Besides your backup, you will need a reinstallation disc. These days, few computers come with installation DVDs. Some computers feature a bootable partition that contain tools and recovery programs. In other cases, you must download a so-called ISO file from the internet to burn to an optical drive (Blu-Ray DVD, etc)– but you can’t safely do that from your compromised system– you either need to boot from a trusted drive or ask someone to download a recovery ‘disc image’ for you.

As far as the threat to permanently wreck a hard drive, it’s hypothetically possible but unlikely. Black hats may alter your boot tracks or drivers, but those can be repaired with a disc formatting program. In the unlikely case that bad guys were to zap your drive’s firmware, they’d have to strike after the time limit they imposed. Long before then, an aware user should have powered down his computer.

Demanding Money with Menaces

British use the term “demanding money with menaces” regarding blackmail, extortion, and kidnapping for ransom. The threat of ransomware is clear: If you don’t pay, you lose your files. But if you do pay, you may still lose your files. Damned if you do, damned if you don’t, the track record is not good.

Beyond the substantial risk a victim will never see his files after payment, there are sound reasons for not paying or attempting to communicate in any way. The victimized may inadvertently expose more information than realized such as passwords and bank account information. My colleague Thrush says paying or trying to reach out tells the bad guys “they have a live fish on their line.”

If a victim attempts to reach his bank on-line, an infected computer can forward passwords and account information to the miscreants. Because the bad guys have control of their subject’s computer, they may be able to extract injurious information. A wise solution is to quickly disconnect from the internet to interrupt the outflow of information.

One-Way Communication

Security consultant Alain Marchant says about 12½% of victims opt to pay, but less than ⅗ of those cases see the return of their files even after payment. He suspects the percentage may be considerably worse because of under-reporting.

Marchant’s stats are highly consistent with FireEye reports. He attributes failures to restore hostage files to a number of factors.
  • There may be no hidden server that can unlock the files. The victim has only the criminal’s word such a server exists. Maintaining servers exposes the bad guys to risks they may not be willing to take.
  • Perpetrators may simply not bother. A one-man operation can easily bring in a minimum of thousands of dollars (or euros or pounds) a day, millions a year without lifting a mouse-finger. An extortionist whose biggest problem is hiding money from authorities may feel no obligation to release hostage files.
  • Hidden servers, if existing at all, may be taken down by its ISP, by government raid, by weather, by a denial-of-service (DoS) attack, by power failure or other outage, or by the bad guys themselves to evade detection. Perpetrators, particularly those on the move, may rely on laptops that are on-line only for brief periods. A perpetrator who can’t connect can’t repair the damage.
  • Because of a restricted ability to test malware, perpetrators’ programs may be bug-ridden and unable to recover the data. FireEye reports that files encrypted and then decrypted by TeslaCrypt turn out corrupted.
  • Perpetrators may not have the sharpest grasp of time zones, which may cause a premature trashing. Problems are exacerbated within one time zone of the Greenwich meridian and worldwide during daylight savings time changes. Ransomware does not take into account weekends, holidays, and banking hours.
  • Perpetrators may not have the sharpest grasp of exchange rates. For example, a ransom page may demand $300, but with worldwide reach, may receive $300 Canadian instead of US dollars and therefore not release the files.
  • Victims’ machines may be knocked off-line by the same problems above that affect perpetrators’ servers.
  • Victims’ drives may be so badly damaged, that recovery becomes impossible. Moreover, perpetrators may encrypt the very keys or tokens victims need to communicate with their bank.
  • Victims usually don’t possess a clear understanding of bitcoins. Some attacks require users to install modified TOR browsers to arrange payments. While these measures help perpetrators hide from authorities, victims lose time and possibly their files while trying to figure out the process.
  • Victims’ anti-virus software may belatedly catch and delete the ransomware program making recovery impossible.
  • Multiple malware infections may collectively interfere with each other. Victims may inadvertently exacerbate the problem by researching malware on the internet, triggering secondary infections that make recovery impossible.
  • Victim’s computers may reinfect themselves as drives are brought on-line.

Recovery

Clearly the odds of recovery are better with anti-ransomware programs, assuming data hasn’t been deliberately damaged beyond encryption. If at all possible, create and work from an external drive. You may find better success removing the computer’s hard drive and hooking it up to a clean computer. The idea is to keep the virus dormant while attempting to remove it and correct the damaged files.

At the end of the countdown period (typically 72 or 96 hours), some malware strains sabotage the rest of the hard drive, erasing boot tracks and directories. Marchant suggests it might be possible to turn back the clock in a PC BIOS by several hours to extend the period of analysis and recovery. For this to work, the computer must remain disconnected from the internet.

If there is an extant key, it may not reside in a remote server at all but could be buried in your machine. That can help assist programs in decryption.

Following are a few Mac and Windows resources to help in preventing and recovering from ransomware.

Be safe out there!

10 April 2016

RansomWare 2,
Vampires and Zombies

by Leigh Lundin


 WARNING  Last week, we discussed a particularly vicious type of virus, one that poses a severe risk to your computer’s contents. It’s called RansomWare and it’s coming to a computer or cell phone near you. This week, we offer specific steps to protect yourself.

Zombies vs Vampires
To infest and infect, one of the givens of vampires is that they must be invited into one’s home. Dracula and his ilk may mesmerize or seduce, but only when a victim throws open the window can the creature waft in.

Viruses– and more typically a variant called Trojan horses– work the same way. A colleague hands the victim a flash drive, or she (or he) clicks a disguised download button or the attachment of an email. Voilà, she’s unknowingly invited the devil into her life.

Sometimes the effects are relatively minor– they may quietly turn the target into a zombie server, a computer that sends out spam, illicit files, and even malware without the owner’s knowledge. The truly bad infections can suck the lifeblood out of the system. Ransomware falls into this latter category.

Recently, Dale Andrews received an apparent email from Velma with an attachment. Strange… she rarely emails and I knew our secretary hadn’t emailed anything since the beginning of the year. Fortunately Dale didn’t open the attached payload. It may have been nothing more than a Nigerian scam letter… or it could have been considerably worse.

Pleadings

My colleague Thrush keeps enough computers to power Bulgaria, nearby Serbia and Romania. He thinks like a pro; he takes security very seriously.

His friend Mark phoned– he’d been hit with ransomeware. Arriving home in the evening, Mark had sat down at his computer, tired and less than alert. One of his emails raised the spectre of a lawsuit; it included attached court documents.

He downloaded them and… innocently unleashed the wolves. Whatever had been attached, they weren’t pleading papers. A screen popped up… his computer had been encrypted by ransomware, demanding a few hundred dollars to return his goods.

The man immediately detached his computer from his local network (LAN), one that included his backup mechanism and his wife’s computer, which fortunately contained their most critical files. His desktop was done for, but quick action saved their most important files.

Defense

The best protection against malware (malicious software) and ransomware in particular is to prepare your fortress now.

I. Backups

Back up, back up often. I previously mentioned it’s critical to back up to drives or discs that can be detached. The reason is that if your backup drive is on-line when malware strikes, you could lose your backup and everything on it.

A simple strategy used in the early days of computing is to make grandfather-father-son backups: You cycle through your discs (or tapes or other media) reusing your oldest backup each time. This includes one vulnerability in that you may back up defective or damaged files without realizing it. For that reason, archive a backup each month or so. Tuck it in a drawer or bank vault and exclude it from the recycling.

Consider using Blu-Ray discs with write-once technology. Those discs are not only less expensive than rewritable discs, they’re safer in that they cannot be later altered and their life span could last for decades.

The Macintosh includes a backup program called Time Machine. It can operate in manual mode, which is useful for detachable drives. It also offers a continuous mode in which changed files are backed up every hour to an attached drive, the cloud, or a NAS (network area storage) unit. Continuous backing up is great unless ransomware attacks the backup files.

A method of safe continuous backup is possible for desktop computers using these steps:
  1. Ensure files you want backed up are either in your public folder or outside your home folder altogether. In other words, make sure items to be backed up are visible beyond the confines of your user folder.
  2. W-D USB back-up drive
    W-D My Passport back-up USB drive
    Establish another user account called Backup. If set up properly, it should be able to see the files and folders you want backed up. Keep things pure. Do not use this account to surf, read email, or shop on-line.
  3. Attach a back-up drive, cloud storage, or NAS using a password. Only the Backup account should have the passwords readily available. Don’t access these drives from your main user account(s). (Western Digital external drives not only provide good back-up programs, they also allow the drive to be password protected.)
  4. Start the back-up program, providing its security services with passwords if needed. Don’t log off the Backup account when returning to the main user account.

While you’re working, the Backup account will quietly save your data. If you are attacked, malware won’t be able to get at the back-up drive. You need only consider this for continuous automatic back-up programs like Time Machine.

II. Modems, Routers, and Firewalls

The Backup account acts as a sort of firewall to seal off back-up drives from the rest of the machine. Chances are your router as well as your computer contain software firewalls. Because of the variety of manufacturers, I won’t attempt to address specifics other than to suggest learning how or seeking help in using them.

With the router, keep open ports to a minimum. Use long passwords for both your modem and your router. Be careful whom you let into your network. Some wireless routers allow ‘guests’ with imposed limitations. If both your router and your guest’s computer, tablet, or phone features a WPS button, you can permit guests to connect without giving out a password.

III. Computer Settings


Besides judicious sharing and firewall settings, a seemingly minor option offers major potential. By default, both Windows and the Mac don’t display common extensions (.doc, .rtf, .gif, .mp3, .exe, .app, etc.) An invisible extension might look a little prettier, but that extra piece of information might help you save your computer.

Say you get a breezy email purportedly from a friend containing an attachment called FamilyFotos.jpg. You start to open it but, if you’ve activated the showing of extensions, you’ll see the full name is FamilyFotos.jpg.app … uh oh!

Or, say you visit SexyBuns.com, download HunkyGuys.mp4 (yes, I’m talking about you, Jan Barrow Grape of 103 Rodekyl Lane, Armadillo, Tx 78657) and spot that the complete file name is hunkyguys.mp4.exe

These are big clues that those files are not friendly.

Show extensions by visiting Control Panels Files and Folder Options (Windows) or Finder Preferences (Mac) and checking the appropriate box. Now you can have more confidence that LegalPapers.pdf is truly what it claims.

MacOS Finder prefs
MacOS X show extensions
Use extra caution with .doc and .docx files. Unknown files may contain malicious macros and may even suggest you turn macro support on if it’s not. More recent variants reportedly can leap the divide from MS Word to infecting the rest of your computer.

If you wish to peek at unknown Word files, use WordPad (Windows) or TextEdit (Macintosh) or equivalent text processors that ignore embedded macros. Whenever possible, use .rtf instead of .doc as a far safer alternative.

Windows File and Folder Options
Windows hide extensions
Email filtering not only keeps annoying mail out of your in-box, but it can also provide a line of defense against malware. Even if you blacklist/whitelist, keep in mind that bad guys may have hijacked a friend’s contacts list and try to spoof their address relying upon your trust.

IV. Too Helpful

Be wary of too-helpful emails and pop-up windows that offer updates to Flash, Silver Light, or Java, and especially shortcut links to your banking web site. If you receive an email supposedly from PayPal, your financial institution, HealthVault, IRS, Social Security, or other site containing personal and financial information, don’t click on any embedded links. Instead, type in the URL address yourself to be assured you’re not accessing a ‘spoof’ site trying to trick personal information from you.

virus infection irony
Consider the irony
Notices urging upgrades– usually employing pop-up menus– can serve as fronts for malware. Don’t fall for the false convenience. Be cautious of notices your computers has been infected with a virus. If your browser screen locks up, get help. Don't call the toll-free number on the screen.

Such notices may try to trick you into installing nasty stuff. If you think you might need a newer Flash player or Java component, then hie directly to their web sites and check for download versions.

V. AntiVirus Protection

Obtain a good anti-malware suite, either free (like AVG) or from Kaspersky Lab, Symantec/Norton, BitDefender, Malwarebytes, or WinPatrol. They each take different approaches. BitDefender’s defense works as a sort of vaccine. The free Panda Ransomware Decrypt Tool tries to restore deliberately damaged files.

If at all possible, remove the wounded drive from its computer, or create and boot from an external drive to work on the damaged device. It’s possible the infection has altered the boot sectors of your hard drive. If you’re able to decrypt your damaged files, move them to a safe place and totally reformat the damaged drive.

The Myth of Customer Service

One of the internet ‘memes’ floating around the web speaks of ransomware ‘customer service’. This irresponsible wording is tantamount to insisting a rapist gives good customer service if he doesn’t kill the victim. Even professional developers who should know better use this expression, an indication of naïveté rather than an expert opinion. A paid criminal that restores files only 50-60% of the time does not exhibit good customer service.

More on that next week. In the meantime, avoid zombies, vampires, and malware.

03 April 2016

RansomWare 1,
The Threat

by Leigh Lundin


 WARNING  A particularly vicious type of virus poses a severe risk to your computer’s contents. It’s called RansomWare and it’s coming to a computer or cell phone near you.

Although no longer engaged in software design, I enjoy keeping an eye on technology. RansomWare had risen on my radar as an up-and-coming annoyance, but I hadn’t appreciated the level of threat it’s become.

Virus sophistication has risen from the early cutesy messages to vandalism to zombie-bots… hidden programs that turn your computer into a secret spam server. In the past, viruses were largely preventable and recoverable.

That’s changed. Bad guys have figured out how to monetize infections that can wipe out your photos, movies, letters, tax records, your home and work content. They can obliterate your recorded life.

The viciousness doesn’t stop at the personal level. We know only of attacks made public, but ransomware has assailed small businesses and large, county offices, schools, charities and non-profits.

The criminals behind the scenes have no compunctions. A favorite soft target has been hospitals where lives hang in the balance. Forensic experts believe some of those penetrations were deliberate attacks from the inside. To wit, someone deliberately hand-planted a ransom virus in hospital computers.

Even police agencies have been hit and– to the disgust of many– they paid the ransom. How can criminals be stopped if police dump public money into their coffers? For all anyone knows, the attackers may have been terrorists or state-sponsored Daesh/ISIS or al-Qaeda, China or North Korea, all badly in need of euros and dollars.

Destroying a victim’s computer’s contents can ruin years, even decades of work and study, crucial research and development. RansomWare can devastate careers and ruin lives. It even takes lives, at least three known victims, father-son deaths and a student suicide.

What is RansomWare?

A type of virus or infectious malware, ransomware invades a computer, renames and encrypts your files with mathematical, non-reversible encoding. The malicious program then offers to reverse the damage in exchange for a demand ransom ranging from two- or three-hundred in dollars, euros, pounds sterling, or the equivalent in untraceable bitcoin, into thousands. If the black hats recognize a high-value target like a hospital or government agency, they may demand tens of thousands of dollars. Some programs set a three-day deadline after which they promise to wreck the machine beyond repair.

The ransom virus lingers in the target machine long after the damage is done. Worst of all, victims face a substantial probability that even if they pay the ransom, they won’t get their files back.

At present, the worst of ransomware mainly attacks Windows computers, but Macintosh and Unix/Linux users shouldn’t grow complacent. One Mac malware program contains no mechanism to restore files after payment. Black hats have already breached a major Java component (JBoss) and some ƒ-head will figure out how to devise a devastating Unix-based attack. It takes little more than catching a human in a weak or distracted moment.

W-D USB back-up drive
W-D My Passport back-up USB drive
Now is the time for all good men and women…

Kindly accept today’s article as a heads-up, a wake-up call to take steps now to deal with this eventuality. Writers among us may be able to glean facts for a fine techno-thriller, but safety comes first. We’ll be discussing
  • backup, backup, backup
  • computer settings
  • modems, routers, firewalls
  • virus prevention and ransom software
  • pop-up and email software ‘updates’
Back-up

Next week I’ll share more detail but consider immediately buying one or more external drives for backing up your important files:
  • Western Digital USB Passport series starts about $45 including Mac and Windows back-up programs.
  • Flash drives are conveniently small although speed ratings of larger capacity drives can prove excruciatingly slow. These are convenient if you concentrate on backing up your data rather than your operating system or programs, which you can presumably otherwise recover.
  • Safest and cheapest of all, you can toast a permanent copy of your data to a Blu-Ray DVD if you limit your back-up to data only. Prices start around $120 for single-layer 25gig drives and increase for dual, triple, and quad-layer models. Single-sided media cost less than a dollar a disc; dual-layered discs run less than three dollars.
The key factor is to backup weekly or as frequently as your willingness to risk your most recent data allows. Then, once you’ve taken a backup, disconnect that drive from your system so it won’t fall victim to a ransomware infection.

Take an extra moment and visit your Control Panels (Windows) or Finder Preferences (Mac). Change the default setting to show all file-name extensions. I’ll explain why next week, but it may help you catch malware masquerading as innocent files.

Stay safe. See you next week with malware vampires and zombies.

17 March 2014

Germaphobic or what?

Jan Grape
by Jan Grape

I've never been germaphobic. In fact, I've always thought and even heard all my life that a little dirt is good for you. That you need to keep your antibodies built up and how some germs help that.  But I just spent eight days fighting what I self-diagnosed as norovirus. It's also called intestinal flu, where you erupt at both ends. I first got sick on Wed. March 5th. This episode lasted for about four hours. A friend came over to help me and brought some Pediasure which was a good thing because I was getting dehydrated and didn't realize it.

The next day I was better and even better by Saturday the 8th. Suddenly, the virus flared again. Lasted about an hour this time and wasn't as severe. In the meantime, I read up on my virus and discovered it was a very nasty virus. That the germ could live on a countertop or hard surfaces for weeks. A lot of people also have a high fever with the illness. I only had a low, about one degree to one and a half. I also had a sinus/allergy problem or a cold. None of it was fun.

This was just after my wonderful sixty-fifteenth birthday party which was super. All three of my grown children and spouses came, two of my grandchildren came, a niece and her son and his family came. My nephew's daughter is a great-great niece so that made it even more special to have family there. A large number of close friends also came. I think about 45 people came. The next morning the 2nd of March, my son and his family from Ft. Worth and my daughter from Nashville and I had a late breakfast before the FW group had to get on the road. So thinking again about germs, I was in two restaurants with a large number of other people inside so I could have picked up the germs in several ways.

After that Saturday I started feeling better again. Everything I read said you have to go three days without symptoms before you're germ free. I slowly felt good each day once again until Wednesday, the 12th, and the virus flared again. Each day as I was getting better I did have a vague uneasiness in my tummy. Not sick, but just not real good. I did talk to my doctor's nurse. I was doing everything that she suggested I do. Of course she asked who diagnosed norovirus. I said, I did. Might not have been but sure acted like it.

 I ate or drank a lot of soup. Drank a lot of Seven-Up and Pediasure. Ate bananas and rice and bland things. No sense in tempting the fates. The only good thing about this ordeal is I did lose seven pounds, it was just a horrid way to lose them. Now if I can just keep that number going down without being sick anymore I'll be a happy camper. I'm finally feeling almost normal, whatever "normal" is.

In thinking about the topic of my blog this week. I couldn't help wondering if anyone has written a story with a main character who is germaphobe or even if such a character is anywhere in a story. I don't know of any, but I'm fairly sure someone has written one. If you know of someone please comment about it. Actually the only famous people I've heard about who are germaphobic is Howard Hughes and Howie Mandell. And although I'm going to be a little more cautious, I'm going to be nutzo about it.

In the meantime, stay away from germs. Wash your hands with soap and water often and use one of those sanitary cleaners. I know that that's my plan.

Photo below taken on March 1st at my party which was held at a Mexican Food Restaurant and that's why I have on a huge sombrero. The staff brings it for you to wear when it's photo time. Prior to that I was wearing a tiara that a friend brought for me to wear.

Jan Grape