2

In the comments to this question it is mentioned that even after a backup recovery malware still can persist. Do I understand that correctly? How is this possible? If Acronis True Image is used to make a backup of a disk would restoring a clean backup guarantee the removal of any malware? For example when recovering is the master boot record rewritten?

2

In general, restoring from a clean backup will wipe out any malware you have.

However, there are rare exceptions. Malware can install itself in your computer's BIOS, in which case it will persist through anything but a BIOS flash (and if it can sabotage the flash process, it can survive even that). BIOS-infecting viruses are extremely rare, though, because they need to be tuned to the exact make and model of the computer's mainboard.

The most common reasons why malware can survive a restore from backup are:

  1. it was present on the backup, and the user didn't realize it, or
  2. the user failed to wipe the hard drive before or during the restore, or
  3. the user has sufficiently bad security habits that they were re-infected almost as soon as they finished the restore.
  • @why should the drive be wiped? – Celeritas Apr 12 '14 at 7:35
  • To get rid of any malware on it. In particular, boot-sector viruses can survive a typical restore from backup. – Mark Apr 12 '14 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.