Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It's been happening more and more frequently I get viruses with no idea where they come from. I have recent backups, but I don't know if there's a point in restoring since I would just install the same applications and copy over the documents I've been working on. MSE didn't detect anything and I ran combofix and it seemed to have cleaned the infection. Should I may as well keep using the system? FireFox was hijacked but now it's back to normal, however I.E. no longer works.Cursors and crashes!

share|improve this question
add comment

2 Answers

If you are unable to identify the virus in your backups and you need the data, I would suggest carefully pulling out just the files you need from the backup and install software again on a clean build.

It is still possible the virus could slip through, but if you restore data rather than state, the file still has to be executed in order for the virus to become active again.

You could also try restoring data to a VM and try pulling data out from a safer container that would likely protect your system from re-infection. It still isn't an exact science if you can't find a virus scanner that can identify the infected files, but it does at least reduce the risk a bit.

share|improve this answer
add comment

You should try your backups, but check to see if they ate compromised, and go to older backups if so.

To minimise disruption the most recent ones will be most like your current setup, however you are right in that they are most likely to have the infection as well.

So just work back through your backups until you find a good one.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.