Crypto virus encrpyts tib files

Richard,

Thanks for the info about the TIB files being affected by encryption-ransomware variants.  I'd heard about this somewhere else but hadn't seen much about verified cases of Acronis files being included in these encryption/malware incidences.

I'm not sure what Acronis's official position is about typical home PC users and Backups, whether the average PC user maintains regular backup activites.

I look at the Backup concept as twofold:

- Full-HDD Backups (Cloning/Imaging)

- Specific-item Backups.  These are my must-have items, files that are frequently edited/changed, those that I can't afford to lose to malware.

This idea may not be practical in your situation where you have multiple customers that depend on you regarding their backup strategies but I'll offer my 2¢ on the topic based on my PC's:

I began researching backups, specifically full-HDD, about 4½ years ago.  I had the advantage of a friend's help with getting me past the initial learning curve about terminology ("cloning", "Imaging", etc).

Once I got past that part of the scene, I researched the topic and discovered that this stuff wasn't as complicated as I had originally figured it would be with my PC's.

If possible and depending on your customer base size, you might be able to put together some kind of basic Cloning and Imaging instruction guideline for the customers.

My approach regarding backups and how they provide protection against encryption/ransomware variants as well as almost all malicious intrusions (malware, PUP's, etc), is the following:

- Air Gap backups.  Insure that there are other backup copies/storage devices that aren't continuously connected to the parent PC.

- Redundancy.  For example, I have a couple of spare HDD's that are Clones of my OS/"C" HDD that remain on the shelf except during actual Cloning or Imaging.

I also have my "must-have" files backed up up on multiple drives.

I use Acronis to run a twice-daily specific-item backup to my continuously-connected portable USB HDD.  That suffices unless I'm affected by an encryption malware incident.

I also backup those same items once or twice daily to a couple of Flash Drives that are only connected to my PC during the copying process. 

To minimize the time that those Flash Drives are connected to the PC, I'm using a "copy" script to automate the actual copying process.  That eliminates all manual "drag/drop" or "copy/paste" requirements and completes in a few seconds.

Here's my overall backup routines:

- Clone PC once every 2 weeks.  This is my main "rollback" path so I can recover the PC in the event of almost all malware, user error, bad downloads, failed HDD, etc.

- Periodic full-HDD Images.  I usually Image my HDD every 2-3 months to a storage HDD that's only connected to the PC during the Imaging process time.

I Clone and Image outside of Windows, using bootable media.  I know that's not necessary but I like that approach as it tests a "worse-case" bare-metal recovery path in the event of undesired events occurring which would necessitate a complete HDD recovery process.

- Manual specific-item backups to a couple of Flash Drives.  I usually do that 1-2 times daily.

Hello Richard and Scoop,

There are following options to prevent computer viruses from damaging backups:

1) store backups in Acronis Secure Zone. See http://www.acronis.com/en-us/support/documentation/ATI2016/#13811.html for more details. This method does not require any additional resources: just set up a protected Acronis partition on the disk and send backups there.

2) get another disk for storing backups, create a second backup plan in Acronis to backup to that second disk and rotate it with the first disk. The idea is that there will be always backups that are physically away at the moment when computer is attacked by a virus and original data is getting encrypted. By booting computer from Acronis bootable media you can always restore from backups on the second disk. Just make sure that you connect that second disk only after booting into Acronis rescue environment and not in Windows, because otherwise virus can damage those backups as well. Virus is active only when Windows is running. Acronis rescue media is an isolated environment, based on Linux operating system.

3) use Acronis Cloud as destination for backups. Even though a virus can modify files on your computer and changed (encrypted or infected) files may still be uploaded to Acronis Cloud as part of backup, there is no possibility for viruses to access, modify or delete previously made backups that are stored on Acronis Cloud storage. Acronis offers unlimited cloud storage as part of "Acronis True Image Cloud" product meaning that you can store as many backup versions as you want online. It is important that full system image is uploaded only once, all subsequent backups are always incremental, uploading only changes since last backup. See http://www.acronis.com/en-us/personal/online-backup/ for more details. "Entire PC" and "Disks and partitions" backups stored in the Cloud could be recovered from rescue bootable media.

Regards

It is ransomware. In my opinion, the most dangerous kind of malware.

I keep reading that secure zone prevents viruses from gaining access. I dont' see how that's possible. I just ran a simple diskpart "list parition" and it shows the secure partition as #5.  I select partition 5.  I delete parition 5.  Goodbye partition - succesfully deleted (along with everything on it).  

If I can do this from Windows, where it's supposed to be safe from anything running in Windows, you can bet a virus can too.  Secure zone is just a fat32 partition with a modified header - I'm not sure how secure it really is, but I wouldn't rely on it for any measure of safety just from this simple test scenario.  Plus, if you're storing your backups on the same drive you need to recover from, yet the drive is corrupt or has failed, well, you're out those backup too... no working drive, means no accessible secure zone either.

Rotating disks out, or using a completely separate disk for offline backups that only gets connected for offline backup or restore, is the only sure bet (as sure as you're going to get).  Cloud\offsite backup is the next best thing, but if there's the slightest chance that something can traverse the Internet connection (I don't know how, but there's always someone smarter out there trying to figure it out), offline backups give you that additional peace of mind.