ATI 2016 damaged by malware - Shadow Copy question

Hairy Pooter, some key questions to be asked here:

Do you have a full disk & partitions backup of your Windows 7 OS drive?

What actions have you taken so far since the malware attack?

Have you isolated this computer from your network to ensure that nothing can spread to any other computers or other devices you have connected?

If you have a full backup, is this on a disk drive that is not at risk from the malware attack, i.e. a disconnected USB or Network drive?

Personally, the best way to recover from this type of malware attack is to boot the computer from your Acronis Rescue Media and restore the whole Windows 7 OS drive from your backup image.

Steve, all backups have vanished. Booting from the Rescue Media doesn't work because it can't find anything to restore.

I did a repair install and it seems to have been effective but System Restore still doesn't work.

BTW, I'm a computer serviceman, and I know my way around W7 systems. I've tried maybe 30 different fixes for System Restore that I've found online and none have worked. Lots of VSS-related stuff. Windows is functioning OK but no System Restore. There's something badly wrong with the Volume Shadow Copy system and I can only conclude that it was something to do with the deletion of ATI.

I ran the Acronis cleanup tool but there's no change.

I think the only proper fix will be a complete reinstall of W7 but I thought I'd ask you guys first.

Sorry to hear the further update on this issue.  I assume that as you have experience in this area, that you have tried various file recovery / undelete tools etc in case the malware has done a simple file delete for your backup files?  

If you have no other 'offline' backups then there is not a whole lot more than a complete reinstall to suggest which is always painful to both suggest and to perform.

The big problem with any form of malware infection is the unpredictable nature of what this can do to your computer system, and personally I would be hesitant to trust a system that had just been repaired in case there were any hidden deep back doors or other added 'features' left behind!

If you have Win 7 operational, then try doing an inplace upgrade of the same OS - see webpage: http://www.sevenforums.com/tutorials/3413-repair-install.html

Thanks, Steve, will do.

OK, I'm making some progress with my previous A.T.I. deletion by malware, and non-functioning System Restore, but I need some advice, please.

I fixed the malware problem and the computer is clean and functional again.

I'm now trialling A.T.I. New Generation 2017. It installed OK and I'm about to try some backups.

Only problem is, I can't delete any of the thirty or so .tibs created by the old installation.

I keep getting this message:

"You need permission to perform this action. You require permission fromAdministrators to make changes to this folder."

Help, please.

With ATI 2017 NG you will have Active Protection enabled by default when you installed the program, so you will need to Turn off Active Protection first before you can delete any of your thirty + old .tib files as these are being protected against such an action.

You can do this by right-clicking on the System Tray Acronis Active Protection icon or from within the main ATIH 2017 NG GUI on the Settings page.

Thanks, Steve, worked perfectly :-)

Another question: If ATI does manage to creat a backup, does this mean that (W7) Volume Shadow Copy and associated files must be functional?

I haven't been able to run System Restore since the previous ATI (2016) was damaged.

ATIH 2017 NG has some additional options in the area of Snapshot methods, aka VSS.

See KB 59440: Acronis True Image 2017: 'Snapshot for backup' option overview for these changes, which shows how VSS is still used as the default for Disks & Partitions backups, so if you have been able to make a successful full backup of your Windows 7 OS drive that this would have used VSS for doing this.  If the backup using VSS doesn't succeed, then you have other options you can use from the Advanced settings tab.

Steve, again, thanks.

The backup was created without incident, so that's great.

Also, equally rewarding for me - System Restore is working again!

Most excellent :-)

That is great news that all seems to be working correctly for you for both backup creation and System Restore etc.

Make sure that you put a copy of your full backup aside as a completely isolated and protected resource that could be used in the future should you encounter any further battle with malware!