BackupAssist CryptoSafeGuard

CryptoSafeGuard Detector - prevents infected files from being backed up

When a backup job starts, BackupAssist scans the data being backed up. If there is any sign of a possible ransomware infection, all backup jobs will be blocked from running, and SMS alerts will be sent if configured. If your job backs up Hyper-V guests, the CryptoSafeGuard Detector will also scan the contents of those Hyper-V guests in one pass.

This scan errs on the side of caution so it may flag files as possibly infected, when they are not infected. If this happens, you will be able to whitelist these files so that BackupAssist knows they are safe, and will not flag them again.

Note: CryptoSafeGuard detects signs of a ransomware infection. It does not protect the actual system from ransomware, or remove ransomware.

CryptoSafeGuard Shield - protects your existing backups from ransomware

CryptoSafeGuard Shield prevents unauthorized processes from creating, deleting or updating data in your backups or CryptoSafeGuard's configuration files. This feature runs automatically in the background when CryptoSafeGuard is enabled.

Note: CryptoSafeGuard Shield will prevent you from manually deleting backups. If you need to manually delete backups, disable CryptoSafeGuard, make the deletion, and then re-enable CryptoSafeGuard again.

To enable or disable CryptoSafeGuard:

1. Select BackupAssist’s Safeguard tab.
2. Select Manage CryptoSafeGuard.
3. Ticking this box beside Enable CryptoSafeGuard protection will enable CryptoSafeGuard. Removing the tick from the box will disable CryptoSafeGuard.

Remember, this setting applies to all backup jobs.

Grace period points

The following points clarify how the grace period works across backup jobs:

• If there are 1 or 2 safe scans and then 1 failed scan during the grace period, an additional 3 consecutive safe scans will be required before the grace period for that job ends.
• If a job is within its grace period, any ransomware detections during the running of that job will not result in jobs being blocked.
• If a job is out of its grace period and it detects ransomware, all jobs will be blocked.
• If the yellow banner is current displayed, and a job that is out of its grace period runs, the yellow banner will be converted to a red banner and jobs will be blocked.
• If a job’s selections change, the grace period for that job is reinstated, but other jobs which are out of their grace period will remain out of their grace period (and will block jobs if they detect ransomware).

Grace period notifications

SMS notifications are sent when transitioning between banner / alert states:

• Unblocked (no banner) => Warning (yellow banner)
• Unblocked (no banner) => Blocked (red banner)
• Warning (yellow banner) => Blocked (red banner)

Since the yellow banner does not block jobs, any jobs that run during this state do not send an SMS, unless a job outside of its grace period detects ransomware, causing the yellow banner to be upgraded to a red banner (and an SMS to be sent).

Banner notification

You must click BackupAssist’s alert banner and follow the dialogs to respond to a possible ransomware infection. The banner includes a help link to the CryptoSafeGuard documentation. The banner is yellow during the grace period and red after the grace period has ended.

Email notifications

If you have set up the Email server settings and Email address list, and enabled Notifications in the backup job, a backup report will be sent with a BA8000, BA8001 or BA8002 error message to inform you of the possible ransomware detection.

SMS notifications

If you set up SMS notifications, SMS alerts will be sent when CryptoSafeGuard detects a possible ransomware infection.

To set up notifications, select BackupAssist’s Settings tab, click CryptoSafeGuard and update the SMS Notification tab.

SMS Number

To set up SMS notifications, simply enter the phone number that is to receive the notifications into this field using the standard international phone number format +<country code><mobile phone number>.

Additional message

Use this optional field to enter an identifier or description for this machine. This is especially useful if you manage a lot of servers and need to know exactly what server the message came from.

Send Test SMS

The Send Test SMS button will become active once a phone number has been entered in the correct format. Click Send Test SMS and a test message will be sent to that phone.

CryptoSafeGuard uses a third-party provider for SMS notifications. Click these links to view the provider's Privacy and Security information.

Deciding if your system is infected by ransomware will involve checks outside the scope of BackupAssist. In most cases, the first indication of a ransomware infection is a persistent ransomware message on your screen. If CryptoSafeGuard is the only indicator of an infection, your IT systems administrator's will review the suspected files. This review should include using anti-malware software and trying to open the listed files in their relevant applications to see if they still work.

Note: It is worth noting that the first time you run CryptoSafeGuard, it is possible that safe files will be flagged and need to be whitelisted.

If you resolve the ransomware infection without a recovery, the alert banner will still appear in BackupAssist.

To remove the banner and unblock jobs:

1. Click on the banner
2. Answer No (I’m not infected).
3. Click Unblock jobs.

The following actions can be taken with the detected file(s).

Whitelist selected file(s), paths or extensions

You can right-click each file and take one of the available actions, or select the file and click Whitelist selected files and take one of the available actions.

The available actions are:

• Whitelist selected file path <file path> - This option will whitelist the displayed file path.
• Whitelist selected file name <file name> - This option will whitelist any file with this name.
• Whitelist all <file extension> files - This option will whitelist all files with the file extension shown.
• Whitelist an entire directory - This option appears if you right-click a folder. It will whitelist all files in the folder and any sub folders.

Whitelist all file paths

You can select Whitelist all file paths to whitelist and clear all of the files detected. You should not do this unless you have reviewed the files and know they are safe. A confirmation dialog will appear to advise that the backup jobs will be unblocked.

Dismiss warning and Unblock Jobs

Unblock jobs is an option if you have a red banner and the jobs have been blocked. Dismiss warning is an option if you have a yellow banner and are therefore in the grace period. Selecting either of these options hides the banner and unblocks any blocked jobs. However, the alert may occur again next time a job runs if no action has been taken on the detected files.

Warning: Do not click Unblock jobs unless you have either whitelisted, deleted or restored each listed file. If you use Unblock jobs without taking these actions, all jobs may be blocked again next time a job runs.

Delete files

You cannot delete files using the CryptoSafeGuard UI, but you can access a file by right-clicking it and selecting Open folder. This will open the folder in Windows explorer.

Note: When deleting whitelisted files, hold down shift so the files do not go to the recycle bin, or empty the recycle bin after deleting the files. Whitelisted files in the recycle bin may still trigger a CryptoSafeGuard warning.

When all files have been cleared from the CryptoSafeGuard UI, a dialog will confirm that your backup jobs will be unblocked.

There are no files to whitelist or delete so you must check your system for signs of an infection.

You can do this in the following ways:

• Check if the desktop background has changed as ransomware will often remove the desktop wallpaper.
• Check all open windows and the desktop for any ransomware notification dialogs.
• Check a sample of the image files (png, jpg etc) and documents (doc, docx, xls etc) on your local drives to check they can still be opened.

Select Yes or No, based on whether you found a ransomware infection or not. Selecting No will unblock your jobs without the need to remove or whitelist files. Selecting Yes will block all jobs, so the backup are not infected by the ransomware found on your system.

To learn more about responding to a CryptoSafeGuard Alert, see your Blog article.

How to access the Manage Whitelist fields

Follow these steps:

1. Select BackupAssist’s Safeguard tab.
2. Select Manage CryptoSafeGuard.
3. Select the Whitelist tab

To learn how to edit the Whitelist, see Manage CryptoSafeGuard

Note: Adding files and folders to the whitelist means they are excluded from CryptoSafeGuard’s scan when a backup job starts. It is important to only whitelist files that create, or are expected to create, false-positive responses when the scan runs.

To run a manual scan:

1. Select the BackupAssist Safeguard tab.



2. Select Run Ransomware Scan.
3. Select the drives and directories that you want to scan.

You should select all of the drives and directories that you plan to back up.



4. Click Scan.

The scan will start and open the Monitor screen so you can see the scan's progress.

Note: During the grace period, you will only get warnings for flagged files. After 3 clean scans in a row the grace period will end, and any false positives or live detections will result in all backup jobs being blocked. If the backup selections are changed, the grace period will restart.

Hyper-V Server

When BackupAssist is installed on a Hyper-V host to back up the guests (VMs), CryptoSafeGuard will scan the guests’ contents before backing them up. However, only basic partitioned volumes are scanned. Dynamic partitioned volumes (e.g. striping, spanning) are not scanned.

On Windows Server 2008 and Windows Server 2008 R2 systems, Hyper-V guests are not scanned during CryptoSafeGuard detection (since BackupAssist 10.1.3). Guest scanning relies on timely creation and cleanup of Hyper-V checkpoints and their corresponding avhd files, and this cannot be guaranteed on these older operating systems.

Only locally supported file systems are supported when scanning guests. This means that Linux file systems like ext3 are not scanned inside guests unless there is a driver supporting that file system on the host.