Is is safe to backup programming projects (for example websites that where made using HTML/CSS/JS with the help of some frameworks and libraries (Bootstrap, jQuery, etc.), C# projects made with the .NET framework or websites with backend made with PHP) from a possibly infected computer? What messures can I take to backup those programming projects and making sure they are not infected?


If you're concerned enough about it to wipe the machine, and you don't already have an online repository for your code somewhere like Github, then I'd suggest getting a live boot CD/USB for a Linux distribution of your choice and use that to copy the files off to external storage or cloud storage. I don't know of any way other than manually inspecting your code for changes to check for malicious modifications, however I would deem that incredibly unlikely for personal code projects unless they are widely in use by others.

Then get a real version control system with online hosting. This should be as simple as "download latest version from online repository, compare with local" in the worst case but that only works if you have said online repository.

  • 1
    agree on your corollary. If you fix your current problem but still got a single point of failure, you are exposed to the same risk in the future. A version control with online hosting would be a good idea to consider. – Gustavo Aug 6 at 17:30
  • 1
    Probably the only way is to check the code by hand, and when it is done put it in a online repository, and update from the trusted sources all the frameworks and libraries. – zinnks Aug 6 at 17:59

Protocol conversion

  1. Upload the files to pastebin, let pastebin convert to plain text
  2. Open the pastebin file from your clean machine Copy from the browser, paste to a new file
  3. Repeat

Google AV

  1. Use your non-personal Gmail, share a folder such that anyone can edit
  2. upload your code (but not your boilerplate) to the folder
  3. Or email it to gmail either way, Google will AV scan it for you


  1. From Google put it into Github, let Github do the protocol conversion. Open as RAW and save

Once it is in Google then you can go to your good machine and delete all the boilerplate files, eg Bootstrap as well as any non-text files. You can view the files in Google.

I would assume that there is some crafty way to attach malware data into a text file by fiddling with the filesize indicator/EOF indicator (I can't think how you would do that but assume it is so) and i would assume that every file that ends in .php / .txt / .whatever is actually a binary with the wrong file extension or a hidden extension.

Putting these files into a third party sandpit allows you to look at them.

  • Hi @Uniconr Tears, while a sound idea if your already got the stuff on the cloud, the approach that relies on uploading stuff to Google means your are exposing your infected system to the internet/lan/etc. Potentially worsening the situation. – Gustavo Aug 6 at 17:28
  • Hello @unicorn-tears, if I just upload the code to Github for example, possibly attached malware data into the files would become visible or removed? – zinnks Aug 6 at 19:01
  • Correct @gustavo it could make the situation worse, or it could make it better. The system is pwned already so it might get super pwned, but if the system is now a write-off, it may not matter. who knows, it's githubs problem. all you need is the protocol conversion so you can copy/paste the text – Unicorn Tears Aug 6 at 20:07

Depends on how through you want to be. In all scenarios, Isolate the infected pc, no internet, no lan, Bluetooth, no nothing.

Option extremis: Give a human a pc and copy the code using his eyes into a new solution on a safe pc. That will take a ton of time, but reviewing the code is the best way to ONLY take the code, no problem of a bing/exe/whatevers with malicious code.

Middle of the road: Copy on a flash drive the code as plain text. Use any tool you prefeer to scan any potential threat that goes in the flash drive. That saves time manually writing all the code, yet you don't actually know the contents with the same level of confidence.

Middlish of the road: Perform a clean on the solutions and copy those files. Here you also bring *sln, xmls, etcs. So more chance for a surprise. Way faster too.

And after you take the info you need, nuke the system from orbit!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.