AllenM
Hi mowman,
Thanks very much.
I am very careful which is why this is only the second time I've been hit in 21 years. The last time before this was probably at least 15 years ago. I guess it goes to show that no matter how careful you are no one is 100% immune from being a victim of these criminals. 
Nevertheless I think I did allow myself to get a little complacent with the RDP thing. I never should have enabled RDP without setting up an encrypted tunnel first. In this case RDP was my downfall. Oddly enough I found that supposedly RDP in Windows 7 does have encryption capabilities built in to it but it is OFF by default. I don't know why Microsoft would turn something as crucial as this to OFF. Its kind of buried beneath the surface and you have to go through a somewhat convoluted path via control panel or know the command to enter at the prompt.
That is no excuse for me though since I know better and certainly know how to research it.
The only thing I can figure from the Ghost restoral is that indeed my Ghost image backup did still have some dormant infection present which a scan with MBAM and NIS was not able to detect. I did do this scan before doing the restoral. I probably should have restored a Ghost image from the July time frame which was definitely prior to me first enabling RDP, especially when the evidence indeed pointed to someone hacking my computer via RDP.
Again, thanks for everything. 
Thanks
Allen
Nevertheless I think I did allow myself to get a little complacent with the RDP thing. I never should have enabled RDP without setting up an encrypted tunnel first. In this case RDP was my downfall. Oddly enough I found that supposedly RDP in Windows 7 does have encryption capabilities built in to it but it is OFF by default. I don't know why Microsoft would turn something as crucial as this to OFF. Its kind of buried beneath the surface and you have to go through a somewhat convoluted path via control panel or know the command to enter at the prompt.
That is no excuse for me though since I know better and certainly know how to research it.
The only thing I can figure from the Ghost restoral is that indeed my Ghost image backup did still have some dormant infection present which a scan with MBAM and NIS was not able to detect. I did do this scan before doing the restoral. I probably should have restored a Ghost image from the July time frame which was definitely prior to me first enabling RDP, especially when the evidence indeed pointed to someone hacking my computer via RDP.
Again, thanks for everything.
Thanks
Allen
