Skip to main content

2 bad backups?

Thread needs solution

Hi all.

This might be a long post so apologies in advance.

I have had acronis since about 2009 and it has worked well most of the time. Now however I am having a really tough time with it.

I Have 2 Full one time backups which were made with true home 2011. They are stored on seperate internal hard drives. I maneged to get the uKash police scam virus a couple of days ago and it disabled all my anti virus and malware protection and also encrypted lots of my files. Even reinstalling anti virus software was no good, the live protection service simply will not work.

The corrupted/encrypted files are mostly documents and pictures or media files. After trying everything I decided to go with the full restore option. Loaded up acronis and there were my 2 backups. One is only a month old and the other is about 8 months old. Unfortunately none of them will work. I get a variety of errors including these which may not be the exact wording but you'll get the idea

This is not the last volume of the backup

Cant find the backup ( even when I browse to it and try to run it)

If I try and explore the backup it says it's corrupt.

There are others but it pretty much all adds up to the same thing, I cant restore either of the backups. I have tried running acronis from windows and from a recovery disc and its the same.

Does this virus corrupt acronis backup files? if so then whats the point of backing up to protect against viruses/malware if the malware can ruin your backups.

Is there anything I can do?

I don't want to lose years of pictures and documants etc due to this stupid malware. Sorry if it's becoming a rant here but I am really annoyed this has happened.

0 Users found this helpful

I'm sorry to hear you have been hit by this virus. Any files that can been seem from within Windows are at risk of being corrupted with any virus attack. It is a good policy to have the backup files on media that can stay disconnected when not needed, for safe keeping, in addition to backup files that are readily available for restores (ie. connected via internal controller, eSATA, firewire, etc.). The uKash ransomeware virus does not necessarily encrypt the files itself, but allows additional viruses to enter the system which can do this type of damage. There is no way to tell with what, how, or even if, the backup files may have been tampered with.

More to the problem.

When booted to the Rescue Media, try and perform a validation on each of your backup files. If they are reported as corrupt, you most likely will be out of luck restoring anything from them. If any validate okay, you could try and restore some files/folders out of them, or use the backup to recover your system if the backup file(s) include your entire system drive. Acronis does provide free support for Restore/Recovery issues, and "may" be able to help, but I would be doubtful about any success if the backup files are actually corrupt or have been tampered with.

The uKash virus family is very difficult to rid from a system. Only a disk wipe (using Windows diskpart or similar drive manipulation tool - booted from CD/DVD/USB drive) and OS reinstall (or recovery from a know clean system backup) will provide piece of mind on a system compromised by this virus family.

One long shot that may or may not work but it is worth trying.

Sign up for the 2013 trial version. No downloads necessary.
Register the trial version serial which is provided via email.
From within your own Acronis personal account, download the bootable iso file.
Burn the downloaded iso file onto a new CD.
Reboot using the new CD and see if the 2013 trial bootable CD offers any better results. if the most current backup fails, then try the oldest one.

Before throwing in the towel would be to try Acronis Support.
They provide free assistance when recovery is an issue.

Thanks guys. Yeah it's a heck of a virus. I have had a few variants of it before and although they have disabled the system I have always been able to remove them easily in safe mode with no damage to anything else.

The backups dont verify or let me do anything with any version of acronis. I can only imagine the virus corrupted them too even though it was only on the system for a few minutes maximum. Its just poor luck i think. 2 backups on 2 seperate drives and they have both been found and ruined.

I have luckily not lost a great deal of files that can't be replaced so I think I will just do a format of drive c and delete the corrupt files from my other drives while leaving the healthy ones in place.

Any advice on a sure fire way to clean my C drive completely so the virus doesn't pop up on my new installation?  Bear in mind I wont be in windows while cleaning the drive so needs to be something I can boot up.  Would the acronis drive cleaner thingy be ok?