Read this BEFORE your five year old network dies!

We had a situation recently that really drove home a key point in technology planning for Small businesses. This is especially relevant to “paperless” professional offices, like doctors, dentists, veterinarians, and other business that don’t routinely keep paper backup…and rely on their computers to run business day-to-day.

First off, let’s make this clear: Data backup is the single most important protection for any business. Or person. Period. If you don’t have a tested data backup that is the first thing you need to do. Call or e-mail us today to make it happen. We won’t laugh, yell, or judge you, but we will act with all possible haste to make sure you’re protected.

So once you have your files safely backed up once a day you’re done, right? Indeed, for many small businesses a file-based backup is all they need. Sometimes, though, there is more to the story.

Another type of loss

A new client had a problem: Their server “died” unexpectedly overnight. The office manager arrived in the morning and found that she couldn’t access the system. They had a reliable data backup in place, so there was no initial panic, but after a few moments she realized she

• could not view the day’s schedule
• could not access patient phone numbers to ask the day’s patients to reschedule
• was not able to access patients’ records
• was not able to confirm tomorrow’s patients
• could not record procedures and calculate charges
• could not accept checks or run credit cards for payment

In short, this busy professional office was brought to a standstill.

A $300 per hour professional business owner and her $75 per hour technicians were unable to perform most of their core job functions. The office staff was unable to contact clients, compute bills, or collect payments. This collateral damage will set the operation back by thousands of dollars in addition to our emergency response labor charges.

Ouch. Of course we have a better way.

The Alternate Reality

One of our other clients had an event that started in a similar way: Their server “died” unexpectedly overnight. They knew they had a tested file-based backup system in place and didn’t panic. After a few seconds, the impact of a server-less day started to hit the office manager. She called us.

We connected into their network and accessed an on-site backup device….signed on…selected the server name, set a few options, and clicked a link called, “Virtualize this server.” Within ten minutes we saw a message saying “Server started” and were able to connect into a complete copy of their server  taken at the end of the previous day.

Within 30 minutes the office manager was viewing the day’s schedule. A full day’s work was done (and billed for!) We fixed the server in our lab during daytime hours at our normal labor rates, returned the system a couple days later, and performed a “bare metal” restore to re-install the server with then-current data.

This incident left the operation down for one hour. About a day’s labor at normal rates. Total cost is reduced by more than 70%.

Advanced recovery from major problems

We can also add off-site virtualization, so that in the event of a fire, flood, theft, or other major disaster we can start a copy of the server “in the cloud,” so that the practice owner and office manager can get into a working copy of their database to get the most critical information (next day’s schedule, financials, client contact info) and begin provisions to work from a temporary location…or at least notify the next day’s patients of schedule changes.

These systems are surprisingly affordable for businesses where they are needed. We generally use a combined approach with a file-based backup that maintains multiple revisions of key files, combined with a backup device to keep important systems available for use.

It’s almost certain that an investment of a few hundred dollars per month will save your business from several thousand dollars of loss during its life. Even if your server is relatively new we can show you how it works and determine if an advanced business continuity solution makes sense for your operations.

Call, e-mail, message, or connect with us to get the details!

-Greg

My contribution to Forgetful MS Access Developers Everywhere

When you’re developing a database that will work with other formats you’ll often find a need to export to the ol’ standard DBase (.dbf).

You’ll use the TransferDatabase method, either as a macro command, or in VBA it’ll look like:
DoCmd.TransferDatabase(acExport,”dBase 5.0″,”C:\Temp\”, ,”tblTransferTemp”,”newdb.dbf”)

This works fine in Microsoft Access 2003, Microsoft Access, 2007, and Microsoft Access 2010. You can also export to DBase III, DBase IV, or DBase 5.0 in addition to many other formats.

So you run the macro or VBA code, the file is created, then you notice that there’s a problem. Entire fields are blank. Entries aren’t there. Data missing. If you dig deeper you may notice that the Access TransferDatabase method has not saved ANY of your text or string data into the DBF file.

What’s going on? Access strings are 255 characters by default. The maximum length of a DBase string/text field is 254 characters. So the Access TransferDatabase command sees a 255-character field and rather than truncating it, simply does not export that field.

How do you fix it? Easy!

Truncate your string fields before trying to export them. In the simple example I was working on the other day I cut off the text at the 100th character in the underlying make-table query…problem solved.

So if your dbase export files are missing data , first check the tables that they’re derived from and make sure the data looks good, second check the string lengths and data types!

New reports of GPCode “Ransomware”

Executive summary: An automatic, up-to-date backup is your best protection against computer trouble. Next is up-to-date antivirus software. If you’re infected with GPCode and you don’t have a good backup you’re screwed.

I’ve heard reports from some of my colleagues of “Ransomware” cropping back up. A typical scenario:

You’re browsing the Internet, on web sites that never caused any trouble before. Then your hard drive starting working…and working….and working…and you see a message like this:

Attention!!! All your personal files (photo, documents, texts, databases, certificates, video)
have been encrypted by a very strong cypher RSA-1024. The original files were deleted. You
can check - just look for files in all folders. There is no possibility to decrypt these files
without a special decrypt program!
Nobody can help you - even don’t try to find another method or tell anobody. Also after n days
all encrypted files will be completely deleted and you will have no chance to get it back.

We can help to solve this task for 125$ via ukash/psc pre-paid cards. And remember, any harmful
or bad words to our side will be reason for ignoring your message and nothing will be done.
For details you have to send your requests on this email (attach to message a full serial key
shown below in this ‘ how to..’ file on desktop.

And your desktop background changes to this:

Uh-oh. When you see this screen the program is in the process of encrypting your files so that they can’t be read by normal means. Normally encryption is a good thing because it lets you (and only you) see the files. In this case the nasties give you no way of seeing or recovering your files.

Unlike many of the previous versions of these, the new GPCode virus will encrypt your files in-place, meaning that the old tricks we’d use to recover most of the data won’t work.

The instructions usually say to send $125 in prepaid cash cards.

1. This is for real. If you’ve got this variant, the files on your system are encrypted and nearly impossible to decrypt.
2. I have heard no reports of success by paying. Even if you DID try to pay it would take several days for your payment to reach the nasty guys in eastern Europe.
3. As of now (April, 2011) there is no good method for recovering these files. Because of the unknown method of encryption used it’s very, very difficult to plan a recovery. I would expect that over the next few weeks programmers will be reverse-engineering the code and possibly leveraging Amazon’s Electric Compute Cloud to develop a recovery plan. I’ll update this article or add comments as I learn of developments in this area.

What to do?

1. Back up your system. We recommend that everyone use an automated online backup program. Mozy or JungleDisk are fine for homes, we prefer our partner Intronis for business backups. If you’re unsure how to set this up, please contact us and we’ll lend a hand. If you’re infected with GPCode and you don’t have a good backup you’re screwed.
2. Run a modern, up-to-date antivirus. I know, some of the slow down your system. Some of them flag good files. You’re super-duper careful and never see the seedy underbelly of the internet. But any decent protection program will block GPCode. We recommend GFI VIPRE,eset nod32, and ZoneAlarm Extreme Security, or free-for-home-use avast! or Antivir.
3. Quick shut-down. If you see the desktop background change to something like I’ve shown above, shut your computer down. Unplug it or press and hold the power button for five seconds. It will take the virus several minutes to find, process, and encrypt your files. You may lose a few things but you can save most of your information if you shut down immediately.
4. General good habits. Don’t open e-mail from anyone you don’t know. Don’t open attachments, even from people you do know, unless you’re expecting them. Don’t go to web site links in e-mail. Keep Windows and Adobe Flash up to date. Avoid using Facebook Apps, and don’t click on anything that gets downloaded from Facebook.

Does your business need help recovering from (or better yet, avoiding) a tech disaster? Please contact us at 888-928-3336 or gregc@charlandtech.com

Quick Take: Quickbooks and The Cloud

At Charland Tech, we’re Quickbooks Certified ProAdvisors of a different sort. We’re not accountants. We don’t want to be accountants. But it’s critical for us to be able to install, support, and advise on Quickbooks issues.

One of the most common questions to come up lately is “Can I run Quickbooks from my favorite cloud provider (i.e. JungleDisk, Box.Net, DropBox, SkyDrive, etc)? What’s the best way to share or use a company file remotely?”

Sadly, we’re not always able to give the answer they’re looking for. Short answer: Quickbooks does not “play nice” with any kind of cloud/file sharing systems.

As most of us in the business know, the QuickBase database the runs Quickbooks panics whenever it “loses sight” of its files for a millisecond. The program has become more robust over the years but it still needs a CONSTANT network connection to avoid errors and corruption.

The problem comes when your cloud file service downloads a local copy…then opens it in QB…then QB tries to open another file handle in the cloud file, which is still being saved (and pushed back to the cloud). QuickBooks has so many different file handles open in different states that it won’t work well on a Network-Attached Storage device or Windows Home Server with DriveExtender even on a Local Area Network.

 We have tried several different providers, and even those using a local cache still have enough lag and file system mapping that the QB DB connection will break, even in single user mode. It’s a company file corruption waiting to happen. Similar to a NAS configuration, we recommend hosting the company on a local workstation that backs it up to the cloud.

It may appear to be working for a while but there’s a very high risk of data corruption. Company file corruption = no fun at all and often no way to recover.

For those businesses who want/need to have multiple users in multiple locations accessing a company file at the same time, there are options:
1. Use one of the intuit-approved QB hosting providers
2. Use gotomypc, logmein, etc to remote into desktops on your local network
3. We’ve found that Windows terminal services configurations are stable and reliable when set up properly (although technically unsupported by Intuit). SBS2011 gives us the ability to very easily run server-based applications on a remote desktop, which is nice because the Quickbooks data connection is not reliant on your network.

Keep in mind that each of these setups has its own performance and security ramifications. Contact us for more info about your specific situation and we’ll give our recommendations on best practices for your Quickbooks installation!

New guidance on free antivirus

A few quick thoughts:

1. Use extreme caution with computer and mobile device use! We have seen a major up-tick in virus, malware, and general crappy stuff running on our home clients and new-client systems over the past few weeks. Make sure you go to www.adobe.com, click “Get Flash Player” and install/update the latest one. Here’s a good page by Microsoft explaining “How does this crap get on my computer?”

2. We are no longer recommending Microsoft Security Essentials, Microsoft’s free anti-virus/anti-malware protection software. As we noticed a few months ago, there are some pretty bad gaps in MSE’s detection and protection ability. We also saw some performance issues on a few systems. Now it turns out there is a malware version of this package “in the wild.” This one looks and acts exactly like MSE but it periodically asks you to buy and install OTHER fake protection software. From the reports we’ve seen (and our own experiences) this fake version is too close for the average person to be able to tell the difference.

Because of these issues we do not recommend Microsoft Security Essentials for our home or business clients.

At this time we’re recommending paid antivirus for our home and corporate users. We’ve had good results with Sunbelt VIPRE, ZoneAlarm Extreme Security, and eset NOD32 in particular. Contact us and we’ll be happy to provide pricing and other details.

There are some decent free choices for home use. We have had generally good results with AntiVir Free (free download, shows an “upgrade to paid version” during each daily update, Avast! Antivirus (free, requires a free 14-month registration by e-mail), and AVG Free. Given the current state of the Internet and the prevalence of online banking and shopping we feel that most users will benefit from the added security integration and support provided by a paid solution.

We do not currently recommend a free antivirus solution for business use.

Microsoft Office 365, First Impression

Yesterday, Microsoft announced the integration of several “cloud” services into one: Microsoft Office 365. This also signals the end of their Office Live Small Business offering, which is certainly welcome news to me. More on that later.

Office 365 comes in a few different flavors. The key difference between the old vs new products is that 365 includes licenses for MS Office WebApps or Office Pro, depending on the version. Naturally it’s a subscription license that ends if you stop your service. This is nice as it’s an all-in-one cost that can ensure everyone in your company is using the same version of Office. On the other hand, there are 2-3 very nice Office suites available free. I’m thinking of openoffice.org, zohooffice.com, google apps, and even box.net has some nice features available in their free accounts.

You may remember MS Office Live SB as a “free forever” website and e-mail package that launched in 2006. Microsoft would register domain names on behalf of new sign-ups. After signing up, Microsoft sent a nice, large glossy envelope with all the pertinent details. About two years later they backtracked and changed the terms of service to say that “free” ended in 2009.

Which brings us to concern #1: After sending three e-mails to the e-mail address on record, MSOLSB’s third-party provider allowed customers’ domains to expire and immediately and irretrievably deleted all e-mail accounts and messages. I’ll write another entry with more details of these issues once I calm down again.

Yes, although Microsoft is a big name, the people in charge of some of the products CAN be “that stupid.”

Microsoft also changed their online licensing tool (formerly called eOpen) to make it better. Unfortunately the new VLSC site has been subject to several lengthy and unpredictable outages. It always is explained away as “planned work” but there never seems to be notice posted or sent to anyone. Even Microsoft’s biggest fans are having MONTHS of trouble with this.

Microsoft can’t run a reliable website so their customers can pay them.

Concern #3: Microsoft has been running this for a while and had some issues. I understand MSOLSB is not an “apples-for-apples” comparison with the Office 365 hosted Exchange service…that’s more like Microsoft’s paid Business Productivity Online Service (BPOS), a paid service that has been running for a couple years now. There have been some meaningful outages and concerns have been raised about recovery time and recovery point with the service.

I have signed up for the Office 365 beta, and will be testing. At this time, though I recommend more reliable hosted mail services. The feature set and promised capabilities sound impressive for the price. It’ll be a service to watch but I’m not going to be the first to move my clients onto it.

I’d love to hear your experiences with Microsoft’s online services.

5 Questions to Ask Your Online Backup Provider

There are a lot of choices out there when it comes to protecting your data. Many people and businesses are moving toward online backup services. These allow automated, easy backup of your information at very affordable prices.

Like any major decision, though, you owe it to yourself (and your business) to ask a few questions so you know what you’re getting into:

1. Where is my information stored?

Good answers: A service provider’s server in a SAS70-certified data center; the Amazon S3 cloud; the Rackspace cloud; an encrypted server in a locked cage in my office.

NOT so good answers: the desktop PC I’m using right now; a hard drive in my parents’ basement; with all my other client files; I don’t know; a computer under my desk.

It’s important for you to know this so you can identify the risk of your data being stolen or compromised. I know of service providers that are storing client backup data on their own unencrypted, unlocked systems! “I always lock the door when I’m not here” is NOT sufficient to protect your business.

2. How will my bill be figured?

Some providers charge a flat fee per month; others charge based on your “stored data.” The latter can be less expensive but as storage use grows you can expect the bill to always go up. Make sure you understand what you’re getting into before you commit to any agreement.

Also make sure you understand the length of the agreement and whether your provider is making any guarantees about recoverability. Many backup agreements specifically disclaim any responsibility:

“Sorry, your data is gone and we can’t get it back.”

3. How long will it take to “seed?” How long to restore?

“Seeding” is the process of taking the initial huge backup of all your files. This can take weeks or months depending on the system and speed of your connection. Many providers will allow you to use a “seed drive,” a hard disk that plugs into your computer and allows you to copy this information much more quickly. The disk is then sent back to the provider who uploads directly to the backup system.

Large-file restores are another common problem with online backup services. To restore a 1GB file can take hours even over a DSL or cable connection. Again, some providers can send you a physical storage device with your data. This can often be done (and delivered via courier) within 12-24 hours of your request…this will be a costly option, though.

4. Who has access to my data?

Best answer: Each client and our staff as-needed. We set up each backup account to use a random 20+ character “Encryption Key.” This key is absolutely required in order to restore data, and is known only to us. We will give you a copy to keep in your safe. This “key” is not known by the backup host. If we lose our copy and you lose your copy there is no way to recover.

Additionally, our policies specify that any access to these keys is only allowed with a documented work ticket. Violation of these policies by our employees or contractors is subject to action including temination.

Some backup resellers allow their service providers to maintain encryption keys. We don’t feel this is sufficient to protect your business. You should insist on a random, secret key.

5. What happens if I can’t reach you?

This is especially important in the case of a “tech guy” or part-time IT help. There are several ways in which a person can become the single point of failure:

• take a full-time job with another company
• realize how much they suck at IT and give up
• illness or accident
• major lottery or casino winnings
• long-term island vacation

What then?

Up-front, your backup provider should at least provide you with instructions, passwords, and encryption keys so that you can follow steps to begin recovery. Ideally they will have staff or agreements with other local technical service companies to provide coverage and assistance.

How does your online backup provider stack up? Contact Charland Tech for details on our automated backup services (that are not stored in our parents’ basement!)

Microsoft Security Essentials: Is “free” worth the price?

Microsoft announced last month that their Security Essentials anti-virus/anti-spyware product will be free for small business users as of today (10/7/2010). On the surface it’s great news! Is this free solution a good choice for your business? Let’s look into it further.

Pros

• Free
• Runs well on newer machines
• Detection and cleaning is easy
• Uses Microsoft Update for program updates
• Can use WSUS for centralized updating on a business network
• Includes scheduled scans and real-time protection
• Scans both viruses and other malware

Cons

• Can slow down older XP machines (systems that run fine with, say, VIPRE or ESET)
• Reports of spotty detection and cleaning
• Very few options or system tools
• No centralized management. Each user can set up or change active protection, scan policies, and updates…and infections must be handled on a computer-by-computer basis
• Not all remote monitoring systems will detect MSSE logs properly

Bottom line

MSSE may be worth a try if your business does not need automated antivirus policy management. If you have advanced users who can handle their own scan “fixing” (or can be trusted to ask when they see the windows pop up) it can work well. It sure beats paying for consumer-grade McAfee or Norton AV.

On the other hand, we can offer VIPRE Enterprise (or Eset or Trend Micro) for a couple bucks per seat per month and use the built-in management features to automatically set scan, protection, and cleaning policies…and get paged or emailed when problems arise. It costs more than this to check each system for protection status, scan logs, etc.

All of our Comprehensive Care plans include enterprise-level antivirus so we can managed your AV scan policies, cleaning options, and receive notification of any problems that are detected. Contact us if you’d like to find out more!

Warning: Unknown “Thumbdrives” may be unsafe

Microsoft recently released notice of a new security problem with Windows. It’s concerning but we can take steps to avoid problems.

In summary, a bad guy can put specially-designed files onto a USB flash drive (some folks call them “Jumpdrives” or “thumbdrives”). This file can make a virus-like program run just by looking at the contents of the drive in Windows Explorer. This could also be made to work with CDs, DVDs, and files or folders downloaded to your hard drive.

Microsoft is currently working on an update that will fix this. However, it’s a good time to remember some basic rules about working with removable drives, etc:

1. Don’t stick it in if you don’t know where it’s been. Our natural curiosity leads us to look at the contents of a “lost” drive. Maybe we want to try to determine its owner. Whatever your motivation, don’t.
2. Don’t plug your USB drive into machines you don’t know,  or that may not be safe. Infections can spread rapidly to all of the machines that you use.
3. Label your portable drives with a name, e-mail address, and phone number. Language like “Reward for Return” can help a lost drive find its way home if you’re willing to pay a few bucks. Also consider a service like StuffBak, IMHonest, or BoomerangIT for “lost stuff return.”
4. Automatic scanning when a device is found. While a virus scan won’t find every form of malware it’s better than nothing.
5. Limit your use of portable drives. Use your Small Business Server or Windows Home Server for file sharing and storage. Also consider services like SkyDrive, Box.net, and JungleDisk for online storage and backup of your files.

Bottom line: Don’t plug in that thumbdrive that you found in the parking lot.

Dude, Where’s My Cloud?

Millions of small businesses use Intuit’s Quickbooks accounting software. It’s clearly the market leader in small business accounting.

In the past few years the company has been moving to online services, including Quickbooks Online, a “software-as-a-service” offering that allows businesses to access their accounting data from anywhere with no software to install, no data file to back up, no updates to install, etc.

The company offers similar “hosted” services handling small business payroll, accountant services, and tax processing.

Intuit reports that about 24 hours ago a power failure occurred during planned maintenance work, starting with their San Diego data center. My conjecture is that there were some concerns with corruption and data consistency as the changes were being made as the power outage hit.

The “cloud” has been down since then. First, a little background:

Why the cloud? From Intuit’s perspective

For Intuit the “move to the cloud” makes a lot of sense. Instead of relying on customers to buy Quickbooks every year (in my experience a 2 or 3-year buying cycle generally makes more sense) Intuit gets customers to sign up and provide a credit card on a monthly basis. This ensures a recurring revenue stream for Intuit.

This also makes support easier in most cases, as everybody on Quickbooks Online is on the same version, running the same up-to-date code. And far fewer problems with data storage, network database performance, and file permissions.

Why it’s good for the customer

The benefits for the customer are much the same:

• customers always run the most up-to-date version with fixes and security updates
• customers don’t need to worry about managing their data files, updating Quickbooks, or dealing with network administration.
• customers can access their Quickbooks Online data from any internet connection. Office internet down? Go to the nearest Starbucks or McDonalds.
• Predictable costs. You know what the monthly cost will be.

QBO Down! OMG! WTFN?

But what happens when your hosted service goes down? Whether it’s planned maintenance, widespread power failures, major Internet routing problems (more common than most people know), or a software glich, bad things CAN happen.

It’s nice to know that you can run to a local wifi hotspot and get to your credit card processor…but what happens when you’re ready for business and they’re the broken link?

A few thoughts:

1. If you had an on-site server you would have a finite amount of downtime for patching, updates, maintenance, hardware failures, software problems, internet outages, etc.
2. Your business needs an emergency plan in place before a crisis hits. During the outage, my sources indicate that they were able to call the Intuit Merchant Center and Payroll Processing departments and process transactions over the phone.
3. Consider your options before you jump into (or out of) hosted services. If you’re spending money the moment it hits your account, can’t live for 1-2 days without invoicing or accessing your data, then the hosted solution may not be the best for you. (neither is a single PC or small business network.) Don’t expect Intuit to pay your overdraft fees, late fees, or pay you back for lost business because their site was down. They’ll give you a month or two free, apologize profusely, and hopefully improve their stuff. But their business frankly isn’t on the line; yours is.
4. Marketing copy (and marketers) will always overstate the reliability of their services. I worked in Managed Hosting Services for a very large company for several years (in no way related to Intuit). We were a top-notch but small group, with no control over the Internet and at the mercy of our hardware vendors.

Bottom line? It’s my opinion that hosted services (including Quickbooks Online) are still a good value for most small business clients, and on the whole are as reliable as in-office server and desktop software.

But like any major business decision it’s critical to weigh the different options, understand what you’re getting, and have a plan of action in place before bad things happen.

Want to discuss business tech options? Trying to decide between on-site and in-house solutions? Contact Charland Technology today!

Full disclosure: Gregory Charland is a Quickbooks ProAdvisor specializing in Quickbooks installation, migration, and support.

Second Thought: On re-reading this, I’ll concede to being a bit soft on Intuit. Let me make this clear: Intuit needs to do better and make their services more reliable. They NEED to have redundancy and ways to quickly bring backup resources online in a crisis like this. Thus the power of the monopoly comes into play: At the moment I don’t see a viable competitor to the Quickbooks line of products. I don’t think that’s a good thing.

However business owners still need to understand and take responsibility for their own decisions…financial, technical, and operational.