Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 6 subscribers
  • Views 1659 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Can Sophos scan and clean viruses on Time Machine drives?

neillhowell

Hello,

We recently discovered Word Macro Viruses in Word Mac 2008 and used Sophos to remove from the computer. Now we can't retreive from backup because the files in Time Machine are infected. Is there any way to scan a Time Machine backup drive to remove viruses? 

Has anyone tried this with success?

Thanks,

Neil

:1005351


This thread was automatically locked due to age.
Parents
  • 0

    Technically, it should be possible to clean up the infected files on MOST TM backups.  However, it is much safer to delete the backups and clean up a non-archived version for future backup.

    If you are backing up to Time Machine over a network share or are using sparse bundles in your TM Backup drive, you could possibly corrupt your entire backup while attempting to clean the files.  This should not happen with current versions of SAV and Time Machine, but it is possible.  It is also possible for similar corruption or system lockup to happen if Time Machine starts a new sync while the cleaning operation is in process -- so it is recommended that Time Machine be turned OFF prior to attempting to clean up the files.  Then create a custom scan and add the Time Machine volume to the list of items scanned.

    To get a local copy of the backed up files, disable on-access scanning and restore the files.  Then re-enable on-access scanning.  Any access of those files should put them in quarantine, where you should be able to clean the malicious macros from the files.

    :1005463
Reply
  • 0

    Technically, it should be possible to clean up the infected files on MOST TM backups.  However, it is much safer to delete the backups and clean up a non-archived version for future backup.

    If you are backing up to Time Machine over a network share or are using sparse bundles in your TM Backup drive, you could possibly corrupt your entire backup while attempting to clean the files.  This should not happen with current versions of SAV and Time Machine, but it is possible.  It is also possible for similar corruption or system lockup to happen if Time Machine starts a new sync while the cleaning operation is in process -- so it is recommended that Time Machine be turned OFF prior to attempting to clean up the files.  Then create a custom scan and add the Time Machine volume to the list of items scanned.

    To get a local copy of the backed up files, disable on-access scanning and restore the files.  Then re-enable on-access scanning.  Any access of those files should put them in quarantine, where you should be able to clean the malicious macros from the files.

    :1005463
Children
No Data