I rolled out a home-made backup script in Powershell - just a wrapper around wbadmin that backs up an entire system image and the a standard "Backup and Restore" backup on an external disk once I plugged it in.
It was not compromised a few days ago, that's just when the attack was disclosed. The actual compromise and exploitation happened months ago for several weeks.
Old notepad is still there, it's just in System32 and you have to disable app execution alias for notepad.exe (apps > advanced app settings > app execution aliases)
FYI, old notepad has a permanent advertisement / notification at the top saying that there's a new version of Notepad available!
I'm not sure if it's possible to get rid of the nag banner. And even if it is possible to get rid of it temporarily, it's probably not possible to get rid of it permanently.
I even signed it and everything.
reply