Guide · Security
Scanning backups for viruses: restore clean, not reinfected
In short: malware is often detected only weeks after the infection – and by then it has long been in the backups. Scanning backups regularly with current signatures tells you since when a finding has been in the backups and which backup is the last clean one. That way, a restore does not bring the malware back with it.
Why the virus scanner on the server is not enough
Antivirus on servers and workstations checks with today's signatures. What was still unknown at the time of the backup three weeks ago may be detected today – but in the backup it stays unnoticed. At the latest when restoring after an attack this becomes a problem: if an infected restore point is restored, the attacker is straight back in the network.
Scanning the backups does not replace antivirus on the systems. It adds a look back.
Where and how to scan
- Not on the production system. Scanning large amounts of data costs CPU time and disk access. It belongs on the backup server, which holds the backup anyway.
- Read-only. The scan must not change the backup – not by “cleaning” and not by moving files to quarantine. A backup is a piece of evidence.
- With current signatures. A backup server without internet access also needs fresh signatures, otherwise it scans with yesterday's knowledge.
- Regularly, not just once. A new scan is worthwhile above all when new signatures are available. Unchanged files need not be read again every time, but now and then they should be.
What a finding means
| Question | Why it matters |
|---|---|
| Which file, which signature? | Shows whether it is a single suspicious document or malware in the system |
| Since which backup has it been there? | Narrows down when the infection happened – important for the investigation and for reporting obligations |
| Which backup is the last one without it? | That is the restore point to restore from in an emergency |
| Is it a false positive? | False positives happen. Once checked and marked, they should not reappear with every scan |
A finding in the backup almost always means the finding is also still on the system that was backed up. It is examined and removed there with the regular antivirus; the backup stays as it is.
Virus scanning and traces of ransomware
Signatures find known malware. Ransomware often stands out differently: through files whose content does not match the extension or looks random, through typical extensions and through ransom notes. Both together, as part of a regular restore test, give the fuller picture.
How AegisGrid scans backups for viruses
The AegisGrid backup server scans backups in the check restore with ClamAV, read-only and without load on the system that was backed up. For a finding it names the affected file and signature, the first backup containing it and the last backup without it; the finding appears in the check report, a notification goes out and, for file and drive backups, the scheduler on the backed-up machine also shows a notice. False positives can be marked. Follow-up scans can be limited to changed files and check everything at fixed intervals. Backup servers without internet access receive the signatures via a site server or as an import. In addition, the check restore looks for traces of ransomware.
Frequently asked questions about scanning backups
Is an infected backup deleted or cleaned?
No. The scan only reads. The backup remains unchanged and can still be used, for example to take individual clean files from it or to trace the infection.
Does the scan slow down my servers?
No. The scan runs on the backup server, not on the system that was backed up. There, CPU time, memory and disk access can be limited for the scan job.
Does scanning the backups replace antivirus?
No. It complements it: antivirus protects the running systems, scanning the backups shows whether a finding detected later is already in older restore points and which restore point is clean.
Backups you can trust
In a pilot project we set up check restores and virus scanning on your backup server with you.