Is there a point in restoring from backups if you don't know where the virus came from?

Question

It's been happening more and more frequently I get viruses with no idea where they come from. I have recent backups, but I don't know if there's a point in restoring since I would just install the same applications and copy over the documents I've been working on. MSE didn't detect anything and I ran combofix and it seemed to have cleaned the infection. Should I may as well keep using the system? FireFox was hijacked but now it's back to normal, however I.E. no longer works.Cursors and crashes!

Answer 1

If you are unable to identify the virus in your backups and you need the data, I would suggest carefully pulling out just the files you need from the backup and install software again on a clean build.

It is still possible the virus could slip through, but if you restore data rather than state, the file still has to be executed in order for the virus to become active again.

You could also try restoring data to a VM and try pulling data out from a safer container that would likely protect your system from re-infection. It still isn't an exact science if you can't find a virus scanner that can identify the infected files, but it does at least reduce the risk a bit.

Answer 2

You should try your backups, but check to see if they ate compromised, and go to older backups if so.

To minimise disruption the most recent ones will be most like your current setup, however you are right in that they are most likely to have the infection as well.

So just work back through your backups until you find a good one.