Do you scan your backups for malware?

You're supposed to do a malware scan before creating a backup, but if you are concerned about false negatives (undetected malware) do you scan your backups for malware? (to prevent an infected restore)

Or do you think it is a waste of time and disconnect your backups when you scan your system for malware?

Can a scan detect malware in a backup? I myself am interested in Macrium Reflect backups. Can a scan detect malware in a .mrimg or a .mrback file?

Personally I never bother. I let Defender do its job.

My Reflect images are stored on a separate drive as well.

I doubt you can scan an image file directly, and certainly not if using Macrium Image Guardian on paid version (which one should do).

If you want to scan a Reflect image, open it as a vm using Viboot, then scan.

cereberus said:

Personally I never bother. I let Defender do its job.

My Reflect images are stored on a separate drive as well.

I doubt you can scan an image file directly, and certainly not if using Macrium Image Guardian on paid version (which one should do).

If you want to scan a Reflect image, open it as a vm using Viboot, then scan.

Click to expand...

You're correct, you can't scan them directly, even without Image Guardian.
I have 19 full backups (18 GB each), and Bitdefender claims to scan them all in about a second.

But the easiest solution is to mount the image and scan periodically, due to AV signatures updates.

Hi,
No seeing none are connected to any systems 24/ 7/ 365 they wouldn't be much of a backup if they were

Point is to scan the systems before adding to your backup drives and when done disconnect.
Then only virus they can get is covid

Haydon said:

Can a scan detect malware in a backup? I myself am interested in Macrium Reflect backups. Can a scan detect malware in a .mrimg or a .mrback file?

Click to expand...

Yes. You can use MR to mount and open a backup image in Windows File Explorer and then right click on the allocated drive number and scan with any anti-malware. but it will scan every single folder and that can take hours. I'm doing it now, just for fun

cereberus said:

I doubt you can scan an image file directly, and certainly not if using Macrium Image Guardian on paid version (which one should do).

Click to expand...

Image Guardian is definitely worth using. I never tried it, but I would think that the only way to scan an image would be to mount it first.

Hi,
You can scan any drive that is connected to the system
Problem is if a scan removes stuff tagged as an issue and corrupts the backup.

I tried scanning an image with Malwarebytes and it took 1 second. I'm now scanning the image after mounting it and Malwarebytes is scanning it,

Haydon said:

You're supposed to do a malware scan before creating a backup, but if you are concerned about false negatives (undetected malware) do you scan your backups for malware? (to prevent an infected restore)

Or do you think it is a waste of time and disconnect your backups when you scan your system for malware?

Can a scan detect malware in a backup? I myself am interested in Macrium Reflect backups. Can a scan detect malware in a .mrimg or a .mrback file?

Click to expand...

If a false negative is undetected malware, What is a false positive?

ThrashZone said:

Problem is if a scan removes stuff tagged as an issue and corrupts the backup.

Click to expand...

If the image is protected with Image Guardian then the answer is no., I don't know about a non-protected image. I'm scanning an image made with Aomei backupper as a test. My computer was scanned before I made the image so I doubt anything will be found.

ShamrockRig said:

If a false negative is undetected malware, What is a false positive?

Click to expand...

Exactly what it says, a false positive. A file or program that the security program list as being harmful but in reality, isn't harmful.

Winuser said:

Exactly what it says, a false positive. A file or program that the security program list as being harmful but in reality, isn't harmful.

Click to expand...

So wouldn't it be a true negative then if its undetected malware?

I almost forgot to answer the question. I scan my computer before I make an image. Now that the subject has been brought up, I think it is a good idea to start scanning the image before I use it to do a restore.

ShamrockRig said:

So wouldn't it be a true negative then if its undetected malware?

Click to expand...

You asked, I answered. Call it whatever you want.

Winuser said:

I almost forgot to answer the question. I scan my computer before I make an image. Now that the subject has been brought up, I think it is a good idea to start scanning the image before I use it to do a restore.

Click to expand...

Hi,
Unless you're responding to someone else that is said in the op already

Op question was/ is do people scan the system images, meaning the op never disconnects his system image or backup drives, which is just poor practice imho
Disconnect the backup drive after creating and verify the image is completed.

Scanning the system before making a system image should be a nobrainer thing.

ThrashZone said:

Hi,
Unless you're responding to someone else that is said in the op already

Op question was/ is do people scan the system images, meaning the op never disconnects his system image or backup drives, which is just poor practice imho
Disconnect the backup drive after creating and verify the image is completed.

Scanning the system before making a system image should be a nobrainer thing.

Click to expand...

So, I'm not aloud to express my thoughts or opinions? With new security updates always being added, a security threat may show up that wasn't originally found.

ThrashZone said:

Hi,
Unless you're responding to someone else that is said in the op already

Op question was/ is do people scan the system images, meaning the op never disconnects his system image or backup drives, which is just poor practice imho
Disconnect the backup drive after creating and verify the image is completed.

Scanning the system before making a system image should be a nobrainer thing.

Click to expand...

Where did OP say he never disconnects his backup drive? I do a backup weekly or monthly. If I realised that I had a bit of malware, how could I be sure that it wasn't in my last backup, just waiting to shoot its wad? I think the OP's question was valid.

ThrashZone said:

Hi,
You can scan any drive that is connected to the system
Problem is if a scan removes stuff tagged as an issue and corrupts the backup.

Click to expand...

If you mount a backup in a virtual machine and anti virus deletes anything without a warning, how does it matter? The changes to the image are not permanent.

kelper said:

Where did OP say he never disconnects his backup drive? I do a backup weekly or monthly. If I realised that I had a bit of malware, how could I be sure that it wasn't in my last backup, just waiting to shoot its wad? I think the OP's question was valid.

Click to expand...

I use ESet Internet Security and have it running full time. I also have Malwarebytes Premium running. I have always just considered my computer safe if they didn't find anything. After reading all of the post in this thread, I now realize that my computer could be infected with something that only a new security update can find. Because of that I see a good reason to run a security scan on the mounted image before doing a restore. If @ThrashZone has a problem with that, all I can say is that I couldn't care less.