rid viruses through backup restore

[Pants]

Does restoring a full backup get rid of viruses on the system, assuming the backup is clean ?

I want to say 'yes', but I'm not sure if existing files are deleted when backup is restored.

 

[red12049]

Does restoring a full backup get rid of viruses on the system, assuming the backup is clean ?

I want to say 'yes', but I'm not sure if existing files are deleted when backup is restored.

Define "full backup"?

What about the MBR?

Rick

 

[Pants]

Define "full backup"?

What about the MBR?

Rick

Ok, I guess "full" back up is vague. How about "all files in all folders" Including the MBR

 

[CLC]

Ok, I guess "full" back up is vague. How about "all files in all folders" Including the MBR

I would say you are only safe if you have a complete hdd/partition image, otherwise I would not trust it at all.

 

[cooltech]

You could just mount the backup image and scan it before re-imaging it on to another drive. If you are afraid it may have virus or whatnot.

 

[red12049]

Ok, I guess "full" back up is vague. How about "all files in all folders" Including the MBR

"ALL file in all folders" would indicate that you are using some sort of boot disk and alternate OS to do the restore, and that you are wiping out the partition, including the MBR. In that case, you should be safe, assuming the backup is clean.

If you are doing the restore from within Windows, you are NOT replacing everything, and therefore, not safe.

Rick

 

[Pants]

Insightful. thx

 

[AlaDes]

I've had three machines that I know of that the only way I was able to rid the system of a rootkit was to use imagex and apply the factory image manually. At the time, none of the tools I was using would detect it and every time I tried performing a factory restore, all three machines would blue screen during the last phase of the restore.

 

[nlinecomputers]

On systems that you suspect are infected with a root kit but you are certain you have a good clean backup I would use Darik Boot and Nuke to completely erase the disk. Writing zeros to every sector guarantees that no code is hiding anywhere. Then you can restore the image on a clean drive.

Though that is probably overkill. Imaging software should create a new MRB on the restore.