Ransomware: how to build a backup the virus can't reach

Ransomware encrypts your files and demands a ransom to give them back. Paying guarantees nothing. The defense that works best is having a copy the virus can't reach and versions from before the attack.

Signs this guide is for you

• Files with a strange extension that won't open anymore.
• A text file with payment instructions in several folders.
• The backup drive, which was plugged in, was encrypted too.
• The cloud folder synced the already encrypted files.

Why it happens

• Ransomware writes to everything your user account can write to: internal drives, connected external drives, network folders and synced folders.
• A backup with a single copy gets replaced by the encrypted version on the next run.
• Weak passwords, outdated programs and email attachments are the most common ways in.

How to do it, step by step

1. If the attack is happening now: unplug the network cable, turn off Wi-Fi and disconnect any external drive. Don't force the computer off if you are going to call a specialist.
2. Don't pay the ransom before talking to a professional and reporting it to the police. Companies may be legally required to notify the data protection authority.
3. To prevent it: keep a backup drive unplugged between backups. In Neural Backup, set it to run when the drive is plugged in.
4. Keep versions for at least 30 days, so you can go back to before the attack even if it takes a while to be noticed.
5. Use a cloud copy with versions and encryption, separate from your everyday synced folder.
6. After cleaning the computer or reinstalling Windows, restore from the version before the attack and check the files before using them again.

So it doesn't happen again

• Keep Windows and your programs up to date.
• Turn on Windows Defender ransomware protection (Controlled folder access).
• Be wary of unexpected attachments and links, even from known contacts.

Menu names may vary with your version of Windows. If a file is already missing, do not write anything to the drive where it was before trying to recover it.

No backup is an absolute guarantee: a destination can fail at the same time as the computer, and files that never made it into a backup cannot be restored. That is why the app verifies copies, tests restores and always recommends two destinations.