Helping people with computers... one answer at a time.
Once your machine is infected, system backups are likely to include the infection as well. I'll look at what steps to take when that happens.
My hard disk got infected with virus. I am planning to format it. So is there a way to backup all of the data without carrying the virus?
The short answer is no, there's no practical way to backup the entire hard disk without also including the infection in the backup.
Knowing that, however, I can make some strong recommendations on how to proceed.
To be able to backup an infected system while carefully excluding malware from the backup means that your backup software has to be able to somehow identify what is and is not malware.
In fact, you don't want it to. Imagine a false positive causing some incredibly important file to not get backed up - that could cause you some serious problems.
Besides, identifying malware is what your anti-malware tools are for.
My recommendation is that you backup everything - infection and all - and make careful note that the backup is, itself, infected.
Then never, ever restore that entire backup.
As you're probably already aware, restoring that entire backup would restore the malware, and thus leave you no better off.
The purpose of taking a full backup of an infected machine is to make absolutely certain you have a backup copy of all of the other files on that machine.
After reformatting your hard disk, reinstalling the operating system from scratch (not from the backup) and installing all your applications from scratch (not from the backup), you would then carefully restore your data files and only your data files from the backup.
Having a full backup simply guarantees that you've captured every file that you might possibly need when it comes time to restore.
One alternative is to restore that full backup to a second drive - a drive from which you do not boot your computer.
(Or, alternately, get a new primary drive and simply move the infected drive to secondary.)
You would reformat and reinstall the operating system and applications to the primary drive, and then - once again carefully - copy off only your data files from the secondary drive.
I'd actually suggest running anti-malware scans on that secondary drive as soon as practical simply to remove what malware can be found. This makes having that drive attached to your system that much safer.
This is actually what most online backup services do: they backup only your data files and not your system. 99% of the time that means that infections are not included in the backup and you're typically safe to restore your data files.
You could do the same, online or off.
Rather than backing up your entire infected drive, you could simply copy off or backup only your data.
The biggest reason that I so strongly advise against this is very simple: you might miss something. You might not backup a file that you will later determine that you need. Once the hard disk is formatted and the OS reinstalled, there's no going back - anything that you didn't backup is gone.
On the other hand, if you have a full system backup, everything is in the backup. Yes, "everything" includes the malware, but that's why you shouldn't blindly restore the entire system image, but rather pick and choose what files - what data files - you want to recover from it.
If you don't backup your computer, start. This entire article becomes completely moot if you could instead simply restore to last night's uninfected system backup. How do I backup my computer? is a good place to start.
If you are infected and you have no backups, backup immediately - infection and all. Before giving up and reformatting, you might read How do I recover from a bad virus infection?, which includes several steps to attempt to recover. Even though you might still end up reformatting and reinstalling, you might be able to first create a cleaner, less-infected backup image from which you could later recover your data.
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.