By clicking any of the following links, you agree to not hold Sage responsible for the accuracy or content of the information presented third-party web pages:

• SageCity announcement: http://sagecity.na.sage.com/support_communities/sage100_erp/b/sageerp_100_blog/archive/2014/06/25/sage-100-erp-and-cryptowall-virus.aspx
• Cyberoam: http://www.cyberoam.com/blog/cryptowall-the-extended-version-of-cryptolocker/
• BleepingComputer.com: http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information

One or more machines on your network has been compromised by a ransomware virus.

CryptoWall (or a related or copycat program) can spread by various means, but most commonly has been found to be distributed via emails with attachments that contain executables disguised as other files. An example would be e-mail text claiming that an attached PDF files is an invoice, order, or other business documents. Opening the file will instead lead to infection of the computer.

Resolution:

1. Contact your trusted IT personnel, consultant, or anti-virus provider to remove the virus from all machines on your network.
2. • Note: Following the recovery instructions created by the ransomware virus may or may not lead to any recovery of data, as this is a scam and will NOT remove the virus from your network. Some businesses have reported paying the ransom and receiving a corrupted decryption key which was useless.
3. After removing the virus from all machines and your software backup files, do the following:
   • Restore the entire MAS90 directory from a recent backup made before the CryptoWall trojan affected the system.
     • Example: Rename the "..\MAS90" directory at the server location where Sage 100 ERP is installed. Restore the last known good backup to that location.
   • Note: After restore, it may be possible (but likely is not possible, depending on whether *.M4T, *.soa, and other files were affected) to selectively put back the current (not backup) versions of these directories and their sub-folders:
     • MAS_XXX folder (where "XXX" is a company code)
     • MAS_System folder
     • MAS_Users folder
     • SOA folder
     • Note: If the above-mentioned folders contain .txt, .doc, .pdf or image or other encrypted files, those particular files will need to be restored from a backup as well. If for some reason, issues still persist though the trojan/virus has already been purged from the network; then restore the entire MAS90 directory instead of trying to selectively restore folders.

Possible Alternate Resolution:

For users without full backup or backup features; users can run a system repair from the original installation disc (or downloaded and extracted installation files).

Note: This method may not remove "DECRYPT" files and may not replace some types of removed encrypted files. It is still necessary to disinfect the virus and traces of it first!

1. Load the original installation CD or original installation files for the version installed:
2. • Note: Currently supported versions of Sage 100 ERP are downloadable from the customer portal: https://customers.sagenorthamerica.com
3. Follow the install process to emulate the process of installing the original version over again
4. When prompted to add module, reinstall, or uninstall select to reinstall and allow the program to run reinstall
5. Click Finish when done
6. Go back to the customer portal, download the product update the original version was on, and reinstall that previous product update
7. If there are third-party enhancements, also make sure to reinstall those as well.