Forum Index  ViceVersa HOME         FAQ and Knowledge Base

 FAQForum FAQ   SearchSearch Forum  RegisterRegister 
 ProfileProfile   Log inLog in 

ViceVersa and Ransomware best practices

 
Post new topic   Reply to topic     Forum Index -> Support
Author Message
seanb
Guest
PostPosted: Thu May 18, 2017 2:29 am    Post subject: ViceVersa and Ransomware best practices Reply with quote
Hi,

I have a scheduled synchronization between my PC C drive and my NAS drive every day as a backup.

It has occurred to me that if my PC was infected with ransomware and my C drive encrypted and I did not notice this before the next scheduled
synchronization that I would wipe out my backup with the encrypted files.

Is there any way (setting) in ViceVersa that could protect me from this situation. E.g. if an unusually large amount of files were found to be different that the scheduled synchronization would be stopped and ask for user input?

thanks
Back to top
TGRMN Software
Site Admin


Joined: 10 Jan 2005
Posts: 8769
PostPosted: Thu May 18, 2017 2:33 am    Post subject: Reply with quote
Hello,

We are planning to add the capability of stopping replication/sync if too many files have changed in the next release. It will be condition-based.
Also it looks like ransomware usually changes the file extensions, so the target files would not be overwritten.

Another option is to enable file archiving in ViceVersa (for overwritten files) or have a rotating target every 7 days or so.

e.g.

x:\target\<dayofweek>

<dayofweek> is replaced with 1 digit day of the week. 1 = Sunday, 2 = Monday, ..., 7 = Saturday when the ViceVersa profile runs.

So even if malware takes over, you should have a few extra backup copies which are good.

It would also help if the target folder(s) is kept offline and connected only as needed when the ViceVersa profile runs.
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com
Back to top
TGRMN Software
Site Admin


Joined: 10 Jan 2005
Posts: 8769
PostPosted: Thu May 18, 2017 11:56 pm    Post subject: Reply with quote
Another option is to encrypt and/or compress target files in ViceVersa. This will change the extension of target files. Since often ransomware targets specific file extensions such as .doc , .txt , . pdf - etc. , encrypting will help.
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com
Back to top
jrtuser



Joined: 18 Jun 2017
Posts: 1
PostPosted: Sun Jun 18, 2017 8:09 pm    Post subject: ransomware and archiving Reply with quote
With reference to Ransomware.
I have set vvpro to archive in order to protect me from having the files on my NAS backup being overwritten by Ransomware. However, the archive drive does not have the capacity to hold all of the files if all of the files in the source drives were altered.
Will VVPro stop and send an error if there is insufficent space for archiving?
Thank you.
Back to top
TGRMN Software
Site Admin


Joined: 10 Jan 2005
Posts: 8769
PostPosted: Mon Jun 19, 2017 3:09 am    Post subject: Reply with quote
Yes, if the files cannot be archived first (e.g. not enough space), then they will not be overwritten or deleted. Replication / Sync will stop.
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com
Back to top
vv4tp



Joined: 20 Apr 2018
Posts: 9
PostPosted: Mon May 18, 2020 12:01 am    Post subject: Reply with quote
TGRMN Software wrote:
Hello,

It would also help if the target folder(s) is kept offline and connected only as needed when the ViceVersa profile runs.


I'm assuming that this process is an automated one? Perhaps using VV Engine? If so, could you point me towards an explanation of how you implement this please? Specifically, how you keep target folders offline and connect only as needed.

Thanks very much and warm regards
Back to top
TGRMN Software
Site Admin


Joined: 10 Jan 2005
Posts: 8769
PostPosted: Wed May 20, 2020 1:48 am    Post subject: Reply with quote
Hello

Quote:
We are planning to add the capability of stopping replication/sync if too many files have changed in the next release. It will be condition-based.
Also it looks like ransomware usually changes the file extensions, so the target files would not be overwritten.


This feature has been added in version 3. So the profile replication can now be stopped if too many files are overwritten (a user-defined number can be set in the profile settings)

Quote:
It would also help if the target folder(s) is kept offline and connected only as needed when the ViceVersa profile runs.


We use a removable SSD for instance and the profile starts automatically in VVEngine when the drive is inserted. We use multiple drives.
If you are backing up to online for instance to Azure Files, you could have the connection offline and then enter accnt + pwd to login in the ViceVersa profile settings.
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com
Back to top
vv4tp



Joined: 20 Apr 2018
Posts: 9
PostPosted: Thu May 21, 2020 2:09 am    Post subject: Reply with quote
Quote:
We use a removable SSD for instance and the profile starts automatically in VVEngine when the drive is inserted. We use multiple drives.
If you are backing up to online for instance to Azure Files, you could have the connection offline and then enter accnt + pwd to login in the ViceVersa profile settings.


Thanks very much for this response. I'm reading the connection process, whether to a local server or cloud provider, as being a manual process rather than programatically automated? I was hoping that VV could establish the connection when the backup was initiated and close it when concluded, all without human intervention. I guess that's not the case.
Back to top
TGRMN Software
Site Admin


Joined: 10 Jan 2005
Posts: 8769
PostPosted: Fri May 22, 2020 2:23 am    Post subject: Reply with quote
Hi, yes that is possible, what type of authorization is needed?
_________________
--
TGRMN Software Support
http://www.tgrmn.com
http://www.compareandmerge.com
Back to top
altecsole



Joined: 14 Apr 2010
Posts: 14
PostPosted: Fri Jul 09, 2021 2:23 pm    Post subject: DayOfWeek not as per FAQ or helpfile Reply with quote
TGRMN Software wrote:

Another option is to enable file archiving in ViceVersa (for overwritten files) or have a rotating target every 7 days or so.

e.g.

x:\target\<dayofweek>

<dayofweek> is replaced with 1 digit day of the week. 1 = Sunday, 2 = Monday, ..., 7 = Saturday when the ViceVersa profile runs.


I've started using 'dayofweek' with noscan option and found that Monday is 1 and Sunday is 7?
_________________
UK High School Network Technician
Back to top
TGRMN Software
Site Admin


Joined: 10 Jan 2005
Posts: 8769
PostPosted: Sat Jul 10, 2021 1:40 am    Post subject: Reply with quote
Hi, I re-tested this today and dayofweek is 7 for Saturday. Could you send the profile log to support via e-mail please? Maybe it's a time zone issue. thanks
Back to top
Display posts from previous:   
Post new topic   Reply to topic     Forum Index -> Support All times are GMT
Page 1 of 1

 
Jump to:  
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


Powered by phpBB © phpBB Group
Copyright © TGRMN Software. TGRMN Software products:
· ViceVersa: Windows Backup Software, File Synchronization, File Replication
· Compare And Merge: File Compare Software for Windows