Forum Topic

Nearly caught by ransonmware

I have Acronis True Image as my backup software. It has built in ransomware protection. Yesterday I was going through emails in Outlook and it sprang up to tell me that a process was trying to encrypt my files and asking me what I wanted to do. I stopped the process and it recovered the encrypted files. It warned me that when I started up Outlook again the process would revive. I was very puzzled but everything seemed OK. Today I wanted to delete a couple of emails from a well known bank. This was genuine about a savings account that was ending. When I clicked on one of them to delete them, Acronis sprang up again. I realised that this was what I had done yesterday as well. This time it recovered 62 encrypted files. I had a look and they were all cache so not important. In order to delete the rogue emails, I turned off the reading pane and deleted them from the list. And then emptied them from deleted items. What surprised me was that this ransomware were in genuine emails from a big 4 bank. I did not want to send them to the bank as to do so meant keeping them around and they are dangerous

Iris Hill ● 1955d12 Comments

Iris Hill explainedI have Acronis True Image as my backup software. It has built in ransomware protection....Acronis includes an encryption option. If you have inadvertantly turned this on yourself (there may be a keyboard shortcut for emergency use) then quite possibly these are exactly the type of messages you would expect to get from the program.This must mean that either you've done something yourself or possibly is the result of an automatic program update.  I'm not familiar with the program but could find out at a pinch, but before going any further can you tryand find the Acronis program prefernces for yourself ?And then check whether encryption is turned on ?If it is, then as it wasn't turned on before, beforeyou had the problem there should be no problem in turning it off again.Ransomware as you probably know, is when another person accesses your computer and claims to have encrypted your files. But as Acronis itself can do this - its an actual selling point - I would be looking in that direction first myself.Anyway if you can't find where the preferences are to check whether or not encryption has been accidentally turned just post again in a while.michael adams...

Michael Adams ● 1955d

Thanks Michael. As far as I can see encryption is not turned on - there would need to be a password involved. Acronis says "When you install Acronis True Image, select the “encrypt backup” option and enter a password that you will remember."Nor has there been a recent update. Nor do I backup to the Cloud. This only happened when clicking on one email. And yesterday it was the same email as today. And when Acronis stopped the process involved, it recovered 62 files. TBH I think it more likely that the bank has been hacked again and ransomware injected into the email system. I have raised this with Acronis support.

Iris Hill ● 1955d

Iris Hill explained:" As far as I can see encryption is not turned on "Fair enough. I only suggested that because on my limitedunderstanding, and I stand to be corrected on this as always, as soon as you become aware of a ransomware attack its already too late.But then again if Acronis offers ransomware protection then presumably this isn't the case.I say on my "limited understanding" because ever since the early days my answer to computer security has not been to install complex security software but rather to buy a succession of cheap secondhand ex-corporatemachines Dell as it happens and wire them up as necessary. O.k if you have plenty of room maybe,perhaps not so for laptops.michael adams...

Michael Adams ● 1955d

Yes Acronis 2021 offers ransomware protection, and can also help if you don't have it but get caught. In this case, it had started to encrypt data and Acronis stopped it and recovered all but two files. As they were cache they didn't matter too much. Acronis are saying it could be a security breach of the bank or it could be a false positive, and are going to investigate. I have read that that bank has been breached previously and has also had DDOS attacks (maybe they all have though!). I prefer a well protected desktop, fully backed up (although only to an external drive, not attached permanently) but with backups also to Dropbox and to my email provider.

Iris Hill ● 1954d

I recommend turning off the reading pane in Outlook - having this enabled means that emails will run any active content as soon as you open them - this could be inadverently, if you delete the previous email and it automatically moves to the next.If you are not expecting any emails from your bank, please check the email address - while the "display name" will show HSBC, Barclays, etc. the actual email address can be completely different!There are several ways to do this, depending on email provider and how you are viewing the email(s) - a quick web search should provide assistance for your setup.

John Hannon ● 1954d

Do you do just a file backup iris?I do the same but also every two weeks create a system image backup to an external drive. Does not take long and that way it will install the whole system including files and progs back to when one created the image backup. That way you can restore your whole PC back to when you created the image. Not happened but if the pc was even to go belly up that system image will have saved you not only time instaling operating system but everything you had installed and back to how it was at the time of creating it.

Julian Pavey ● 1954d

Iris Hill explained" Yes Acronis 2021 offers ransomware protection "I'm sorry I'm simply not thinking. Acronis is a virus (or whatever) protection program so when it detects a virus (or whatever) this behaviour is exactly what its expected to do. When I first started making backups, it required sitting by the computer feeding in a succession of floppy discs every ten minutes and hoping they didn't throw up anywrite errors. Fortunately before ever having to use any of them in anger, cheap S/H hard discs become available. Along with a program called Ghost which initially cloned entire discs but latterly could make images of entire disks or partitions. Of which "improved"versions have appeared down the years. So there's always at least one clean image available of the C: drive; while data can be incrementally backed up almost anywhere nowadays even onto thumb drives. michael adams

Michael Adams ● 1954d

The problem with ransomware is that even if you do backups, you may end up with a backup of the encrypted files which can’t be used either.So the backup should keep an archive of the files so you can go back to a previous version rather than the backup replacing an old version of the file with a new one.

Michael Robinson ● 1954d

No - I do a full backup as a system image. Usually once a month. Working on the same principle as you.

Iris Hill ● 1954d

I realise that Michael - I do a system backup so that I can if needed restore the old versions of the files

Iris Hill ● 1954d

I remember Ghost! a long time ago :-( No Acronis is backup software, not security software. It just happens that it now provides some security within this. I do full system backups monthly, but I can retrieve individual files if needed

Iris Hill ● 1954d

Thanks - the reading pane can only show active content if I allow it to show images. This is off by default. Thank you for your advice about checking emails - I do infact know how to check headers if I need to, and am experienced in spotting spoofed addresses. These two emails were in fact genuine and expected which is why I wondered if the bank had been hacked, or if it was a false positive.

Iris Hill ● 1954d