Recommended Process for Handling a Virus

If a virus infects your computer and modifies your files, some of those infected files may be uploaded to your Network Drive where they can be shared around other users connected to your Network Drive, and also re-infect your computer.

Before we begin, it’s important to identify common misunderstandings and address them:

  • MSB Support doesn’t have access to your data, so we cannot delete it for you or run antivirus scans on it server-side
  • Your data is enclosed in containers, which cannot infect other files while uploaded – a computer (connected to the disk) would have to run the virus in order for the infection to spread
  • Infected files cannot be moved from one Online Disk to another unless you have both Online Disks open/connected to the same computer

Part 1: Disconnect and Scan

  1. Shut down MSB’s connection by stopping the MSB Service.
  2. – Windows: Go to  Start > Run > “services.msc” > then find and stop MySecureBackup*
    – Mac: Open a terminal windows and enter: sudo launchctl unload /Library/LaunchDaemons/com.mysecurebackup.workgroupservice.plist
  3. Once this is done for all computers that usually run MSB (at home and at work), run your antivirus software to scan your entire computer and fix any problems it finds.

Part 2: Save Data to Local Hard Drive

  1. Start the MSB service back up on one computer and monitor this computer for the next 24 hours to see if anything strange happens (virus related)
  2. – Windows: Go to  Start > Run > “services.msc” > then find and start MySecureBackup*
    – Mac: Start the MSB Activity Monitor and you will receive a pop-up asking if you want to start the service (click OK/Yes here to do so)
  3. While this is going on, download/restore all irreplaceable files to your computer (we recommend an external hard drive so you can keep these on a drive separate from your computer’s operating system in case they are infected)
  4. If you are unable to view your files on the Network Drive, check Web Access to see if your files/folders are visible there. If you can see your files in Web Access, it’s likely the virus has hidden them from your Network Drive. You can check out This Walkthrough for further information.
  5. Once you have all the files pulled off of the disks you need, run another scan on this entire computer and on the external hard drive to check and fix any new virus-related problems

Please note that even if everything looks good after 24 hours, there is no sure way to verify 100% that nothing else was changed/modified, then uploaded to your Online Disks. We would recommend continuing with Part 3, but the choice is ultimately up to you.

WARNING! DID YOU SAVE YOUR DATA ALREADY? IF NOT, STOP NOW AND RETURN TO PART 2. ONCE PART 3 IS COMPLETE, ALL DATA ON OUR END WILL BE PERMANENTLY DELETED!

Part 3: Delete all Online Disks

To be completely sure the virus has been removed from your disks, you can ask us to delete the online disks, and create new ones.

* Note: Do we recommend reformatting your computers? Not necessarily, but if you can, then do. No antivirus is completely perfect, and there are bound to be some files that were missed from time to time. On the other hand, antivirus companies focus their best and brightest moments on finding and resolving issues that viruses cause in computer systems. Like with Part 3 (deleting all online disks), choosing to reformat all of your computers is entirely up to you. Our stronger recommendation (i.e. to delete/recreate all online disks), is built out of the knowledge that Online Disks are used to sync across multiple computers. Because of this, a virus that would normally live on only one computer can unintentionally wind up on another, making the possibility of network-wide infection much greater, depending on how your network, online disks, and antivirus are configured.

What to do going forward?

  • Avoid adding your cache folder to your antivirus’s Realtime Scanning Folder Exception List. Instead (if possible), try safelisting just your Backup Database if experiencing issues with antivirus interfering with or locking your backup database
  • Keep antivirus software updated and installed on all of your computers
  • Follow up with any reports of virus-like behavior from your users as quickly as possible
  • Keep all of your operating systems up to date as often as possible and don’t use older operating systems, since these are at a higher risk for infection
  • Educate your users on how to spot virus-like activity (folders that suddenly have “.exe” at the end of them, for instance) and reassure them that reports of these kind are welcomed and very important to you and the stability of your company’s computer infrastructure
Tagged: