Tag Archives: backup

01.17.18
by

So…are you backing up your computer?

In late 2017 Microsoft released Windows 10 Update 1709.  If you’re a Windows 10 Home user, you were not given a choice to install the update, and may have been subject to some of the issues that this latest update caused.

In the that followed the update we had numerous calls of crashed PCs.  All of them had two things in common.  First, they were Windows 10.  Second, they had just been updated.

In all cases the user data was not accessible.  Although we were able to fix all of them, it was only because we had installed imaging software on them.

Which brings us to the topic of this post:

Are you backing up your computer?

One of the first questions that we ask clients when it comes to their computers is “Is there anything on this computer that you absolutely, positively cannot live without?”.  If the answer is “yes” (which is usually is), we ask how they are backing up.  Most don’t have a plan.

There are several ways to backup a computer, and we’ll discuss each one of them in detail here.

Before we do that, though, let’s break down what your PC consists of.  Whether you’re running a Windows or Linux based PC or a OSX based Mac, your computer has three basic software items:  The Operating System, Programs, and Data.

The Operating System (OS) is what makes it go.  When you push the power button on your computer, the OS starts up.  Programs can’t run without it.  Peripherals couldn’t be installed without it.  Everything depends on the OS.

The Programs are what allow you to do things, like create documents, spreadsheets, edit photos and videos, listen to music, watch music, and thousands of other things.

Data is what you create with programs.  It’s your documents, your spreadsheets, your pictures, your videos, your music, your stuff.  It’s the only item of the three that cannot be replaced, because YOU created it, not the OS creator or the program vendor.

If a computer crashed, we could recreate everything using the OS DVD (or USB) and the program disks.  If your computer didn’t come with a restore DVD, then you will have a problem if the hard drive crashes.  Either way, bringing back the data will be impossible.

So data is probably the single most important thing to back up.  If you do need to reinstall the OS and the programs, be prepared to spend some time with it.

When we setup a backup plan, we offer several different options.

Option 1 – Image Backup – An image backup is just as the term implies.  It’s an image, or picture, of the hard drive.  Using a backup program (for Windows 10 Home we recommend EaseUS Home Backup , for Windows 10 Professional, we recommend EaseUS Workstation Backup – either will work for their Windows 7 or 8.1 counterparts).  EaseUS Backup will allow you to create several different types of backup, including an image backup.

You will need a destination for the backup.  If you have more than 1 computer, we recommend a Network Attached Storage (NAS) device.  This is basically an external hard drive that is accessed via your network.  It allows multiple computers to backup to is, as well as store additional data, like music, pictures, videos, that can be accessed by anyone on the network who has the right credentials.  You can also use a USB external hard drive, but that limits the number of computers that can use it as a destination to only one.

EaseUS will prompt you to create a WinPE rescue USB when you first install it.  Make sure you do this, and put the USB thumbdrive in a safe place.  If your hard drive crashes, you’ll need this to restore your PC.

Option 2 – Data Backup – A data backup is a backup of all of your “stuff”, but not your OS or your programs.  EaseUS does offer an option to backup only data, which we recommend in addition to the image backup.  This lets you restore just a single file or folder if you accidentally deleted it.  An image backup restores the entire computer.  Data backup just restores files and folders.

Option 3 – Cloud Backup – The cloud has become part of every computing environment, from enterprise, or business level, to home level.  You’re already using the cloud, whether you realize it or not.  Most smartphones use the cloud to store data, with iCloud, Dropbox, OneDrive, Google Drive being some of the more popular cloud applications and storage sites.

In a nutshell, the cloud is storage space on someone else’s network that is accessible only via the internet.  You can’t get to your stuff unless you’re online.  If something happens to your computer your data is not lost because it’s on the cloud.

Our favorite cloud backup system is iDrive.  It’s relatively inexpensive ($79 per year), fully automated, and gives you plenty of storage space (2 terrabytes, which equals 2000 gygabytes, which is more than enough for all of your photos, videos, music and documents).

Once you install the program, it backs up on a schedule that you determine (ours runs at 10:30pm daily) and, once the initial backup has been done (which could take days, depending on how much data you have, and what your upload speed is), it only backs up what has changed since the last backup.

Oh, and it’s not limited to just your computer’s data.  You can backup as many computers as you have, your tablet or iPad, and your smartphone, as long as the total of all the data is under 2 terrabytes (you can always buy more space, but it’s unlikely you’ll need it).

What method should you use?

We use all three.  We have a NAS, and we backup an image and data, and we use iDrive.  We can restore an entire computer, or just a file.

You should use whatever will prevent you from ever having to say

To sum it up…

It’s really pretty simple to get your system backed up, especially if you use the methods we listed.  However, if you need help, or if you didn’t backup and now you need to get your data off your hard drive, contact PCMDX today.  We’ll come to you and get your “stuff” back.

 

 

 

08.05.16
by

The Art of the Trojan

“Hi, I think my computer has been hacked.  Can you help me?”

This is probably the most common call we receive from PC clients on a weekly basis.  The correct term is most likely not “hacked”, but “infected” with some sort of malware, or malicious software.

Malware comes in many different varieties, including viruses, worms, and Trojans.  The main difference between these is that a Trojan needs your help in doing its job.  Without you doing something, like clicking on a link or opening an e-mail, the Trojan is completely harmless.

Here’s a great article detailing what a Trojan is, and how it works.

Now, how do you stop a Trojan?  The easiest way is to NOT DO WHAT IT WANTS YOU TO DO.  Over the past few days a Google Chrome Trojan has been making the rounds.  If you’re using Chrome, you’ll go to a web site and a second window will open displaying the Chrome logo along with “Urgent Chrome Update”, and a download button.

Chrome_scam_8-1-2016 1-43-21 PM_half

Chrome won’t update this way, however, the bad guys are hoping you don’t know that and will simply click on the blue button.  Before clicking on any link, look at the address bar, or hover over the link to see where it takes you.  If you’ll look at the red arrow, you’ll see that it’s on a site called ahtaeeredidit (dot) org.  Does that sound like Chrome or Google (owners of Chrome)?  So what do you do?  First, don’t click on it.  Second, close the window or tab.

If you do click on it, the result will be that you’ll get infected with the Trojan, which can be something that you won’t even realize is happening (your computer becomes a surrogate sender of Spam), to all of your important files becoming encrypted and, unless you pay a ransom to the sender of the Trojan, losing your files.  This is called Ransomware.  As always, we recommend a good backup of your system.

Remember, by hovering over a link you can see where it wants to take you before you click on it.  If it looks garbled, confusing, or simply suspicious, DON’T CLICK ON IT!

PCMDX specializes in both malware removal or, even better, malware prevention.  Using the right software, we can prevent most malware from even happening, including Trojans.  We say “most” because there are new attacks being developed daily, so the second thing we highly recommend is doing a good backup.

We recommend two types of backup.  First, an image backup, and second a off-site cloud backup of your files.  Ask yourself this question:  “Is there anything on your computer that you absolutely, positively cannot live without?”  If the answer is yes and you don’t have a backup plan, contact us today.  It’s cheaper than you think and far less costly than if you lose your files to computer failure or malware attack.

 

 

04.21.16
by

Ransomware: Time to Pay Attention or Pay Big Bucks

This post is a very long one, but it’s important you read every word if your data is important.

If you follow us on Facebook.com/pcmdx you know we’ve posted twice over the past month about ransomware attacks that we’ve been called to.

The attacks usually use the same method.  The user will receive an e-mail from an unknown sender and it will have the subject line of “Invoice Attached” or something similar.  The word invoice is the common denominator.

The user will look at the e-mail and see that it asks them to open the attached Word document, which is the “invoice”.  When they open the document, the ransomware attack begins, however, it is not noticeable to the user.

These particular attacks encrypted all of the users Office files (Excel, Word, Powerpoint, Access, Outlook PST) files.  It did not encrypt any PDF files or any image files, which usually would have been encrypted as well.

The user will notice that the attack has taken place when they attempt to open one of the files and the Windows program selector launches.  This is the Windows feature that comes up when you attempt to open a file and no program is associated with it, meaning it doesn’t know what program to use to open the file and it asks you to choose one.  In this case, there’s no program to launch an encrypted file.

We were called to attempt to recover the files and to remove the malware that encrypted the files.

The ransomware senders (we’ll call them the “bad guys”), usually have the ransomware program generate a text file that it leaves in each directory that has files that were encrypted.  We found this text file in all of the directories with Office files, as well as the Desktop.

The text file is the “ransom note”.  It explains what happened to the user’s files, and details how the files can be decrypted back to a usable state.

In a nutshell, the bad guys want a payment made via Bitcoin, usually ranging from a few hundred dollars to several thousand.

Although not always the case, once the ransom is paid, the decryption code is sent via e-mail.  Once the code is entered, the files are decrypted and are usable again.  It should be noted that this is some of the time, not all of the time.

In two of the cases, the ransom was not paid and the users accepted the fact that the files were gone.

In one of the cases the user felt that they needed the files, there was no backup, so they agreed to pay the ransom, although we recommended against doing so.  The payment process took about three hours to complete.

It included opening a Bitcoin wallet, which is a software based wallet.  Once the wallet was created, Bitcoin needed to be purchased.  We found a seller in Tennessee who would sell the amount of Bitcoin needed (B 0.74, which was about $350, the amount of the ransom).  Since there’s a trust issue between seller and buyer, the only way to pay the seller was to go to a Western Union type facility and wire the money.  In this particular case, the Walmart 2 Walmart method was chosen.  For those of you who don’t know what that is (and we didn’t know until this episode), you go to Walmart, fill out a form with the recipient’s name, address and phone number, give Walmart the cash amount, they then wire it to the Walmart closest to the recipient, who then picks it up.

Once the seller has been paid, he places the Bitcoin in an electronic escrow account, which the Bitcoin buyer then accesses and sends to his electronic wallet.  Once this has been completed, he sends the ransom Bitcoin amount to the wallet of the bad guys, which is given to him in the ransom note.  Once the bad guys confirm receipt, they provide a program to decrypt the files.  If this sounds complicated, it is.  Very complicated.

With this client, we received the decrypt program, ran it and it responded that the ransom had not been paid, therefore it shut down, without decrypting any files.

As odd as this may sound, the bad guys did have a “support” form on their web site where one could ask for help if the files didn’t decrypt.  We used this form and they responded by asking that we submit five of the encrypted files to them and they would send a new decrypt program.  Based on the timestamp of the response, we determined that they were in western Europe.

They provided a web site address to send the files to, but it required their e-mail address in order to send, which they refused to give, so we were unable to send the files.  After a back and forth requesting their e-mail address, they blocked any further conversation, so the episode was closed.

The client lost his files.  The client lost his ransom money.  The moral of the story is DON’T PAY THE RANSOM AND MAKE SURE YOUR FILES ARE BACKED UP! (PCMDX had recommended that they do not pay the ransom, however the client insisted).

The latest type of ransomware goes a step further.  It doesn’t encrypt the files.  It encrypts the entire hard drive, so nothing is usable.  Unless you have an backup image of your hard drive, you won’t even be able to log into Windows.

So what can you do to prevent ransomware from ruining your day, or your year?

First, ask yourself one simple question:  “Is there anything on my computer that I cannot absolutely, positively live without?”  If the answer is “Yes”, then you need to take steps to protect yourself against malware (including viruses, ransomware, Trojans, worms, rootkits, etc), hardware failures,  data theft, and other data losing issues.

The very first thing you need to do is to make sure you have a backup of your system.  PCMDX uses and installs two backup strategies, an image based backup and a file based backup.

An image based backup consists of an image, or “picture”, of you hard drive.  The backup software makes an exact replica of your hard drive.  In the event of failure or loss, the backup software recreates the hard drive onto another hard drive.  Think of it like cloning your hard drive.

PCMDX believes this to be a better system for one main reason:  time savings.

A conventional backup copies only the data from a hard drive.  Let’s say there’s a failure of the hard drive.  Here’s the recovery steps:  reinstall the hard drive, reinstall the operating system, reinstall the updates and patches,  reinstall the programs,  copy the data from the backup.  This could take hours, perhaps days until completed.

If there’s a hardware failure on a computer with an imaged backup, here’s the recovery steps:  reinstall the hard drive, insert rescue disk, point to image location, begin restoration.  45-60 minutes later it’s like nothing happened to the computer in the first place.  Everything is as it was when the image was created.

Depending on the software used, individual files can also be recovered from an image.  This is great if a user accidentally deletes a file.

The cost of setting up a backup system is less than what would be paid if there’s a ransomware attack.

We cannot emphasize the two following points enough:

  1.  Have a backup plan in place.  If you don’t know how to implement one, call PCMDX today.  We’re not talking about backing up one or two files on a thumbdrive (although that’s better than nothing).  We’re talking about backing up your system, and other systems in your network in case of disaster.  Again, if you answer the question “Is there anything on this computer that I cannot live without” with a “yes” answer, and you don’t have a backup plan in place, you need to create one today.
  2. NEVER open any attachments from senders you don’t know, from senders you’re not expecting anything from, from e-mails that are vague in nature or have spelling and/or grammar errors in the body of the e-mail.  If in doubt, call the sender and ask them if they sent you an attachment.
  3. If you’re hit, DON’T PAY THE RANSOM.  Our latest experience proves that even after you pay it, you’re dealing with people who have no ethics, no morals, no sense of right and wrong, and very poor command of the English language.  Your files are lost and paying the ransom simply adds to the cost of fixing the problem without recovering your data.

One other bit of information:  If your PC is on a business network, and you have networked drives (places on a server where you can access your files), including Dropbox, OneDrive, and Google Drive, those files can be encrypted as well.  Make sure they are also part of the backup plan.

Feel free to share this with your friends.