0

Since being held ransom in order to regain access to my files I have implemented a deep and comprehensive backup plan. But the fear still haunts me; say I get infected with a virus that can encrypt files on my HD, how am I to plan ahead for this? I'm guessing the answer is include file versioning in my backup plan, which is something I already do. But what if the virus stays dormant until it becomes a part of all file versions (assuming they are time based)?

Improve this question
3
  • Usually those kind of viruses would aim at your hard disk content, and hopefully not your external HDD content. You can have offsite backup which the virus can't touch, unless somehow you backed up the encrypted content.
    – Darius
    Oct 5, 2013 at 8:23
  • Another suggestion: You can use a linux distribution for your important files/data. I'm not saying it's 100% impenetrable, but it's LESS LIKELY to be targeted and to execute such a virus. You have some tips about an encryption virus at malwaretips.com/blogs/… and at bleepingcomputer.com/virus-removal/…
    – Savvas Radevic
    Oct 5, 2013 at 8:27
  • What does it matter what the virus aims at? If it aims at my hard disc content and find a way in, it could become eventually a part of my backup with me knowing...
    – CarrotFile
    Oct 5, 2013 at 10:04

2 Answers 2

Reset to default
3

Backup to read only media such as CDR etc DVD, once written it can't be changed

can back up 25 GB on blue ray single sided

Improve this answer
1
  • 1
    But the virus can lay dormant on the read only media, eventually becoming a part of all me backups.
    – CarrotFile
    Oct 5, 2013 at 10:08
1

The basic idea is to not give the ransomware easy write access to all backup media.

Multiple backups

Create rotating backups on at least two different media that you store disconnect from your machine. That way ransomware can only encrypt at most one backup before you will notice and let it overwrite the other(s).

Network backup

Backup your files (incrementally) to a network medium, say another machine in the local network or “in the cloud”. I don't think ransomware touches network shares nowadays. If you want to be sure, prevent deletion of old backup data without a password.

Write-protected backup medium

Those will work too, as Steve suggests.

Improve this answer
4
  • What if I do not notice it while it is dormant until it had found its way on to all backups?
    – CarrotFile
    Oct 5, 2013 at 10:10
  • Just like biological viruses computer viruses cannot alter their environment without a host. Checking the backup for malware and removing it is good idea though if you notice one on your machine.
    – David Foerster
    Oct 5, 2013 at 10:14
  • So basically what I take from you is: If I get infected with a virus that shows itself or is detected by a AV, and damage has already been done, like say some of my files got encrypted I can go back to a backup, and even if that backup is infected with the dormant virus I can still save the day by removing the threat before it becomes active?
    – CarrotFile
    Oct 5, 2013 at 10:57
  • Yes. Just take care not to infect the host restoring the data. If your paranoid about that, use a Linux Live CD.
    – David Foerster
    Oct 7, 2013 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .