Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since being held ransom in order to regain access to my files I have implemented a deep and comprehensive backup plan. But the fear still haunts me; say I get infected with a virus that can encrypt files on my HD, how am I to plan ahead for this? I'm guessing the answer is include file versioning in my backup plan, which is something I already do. But what if the virus stays dormant until it becomes a part of all file versions (assuming they are time based)?

share|improve this question
Usually those kind of viruses would aim at your hard disk content, and hopefully not your external HDD content. You can have offsite backup which the virus can't touch, unless somehow you backed up the encrypted content. – Darius Oct 5 '13 at 8:23
Another suggestion: You can use a linux distribution for your important files/data. I'm not saying it's 100% impenetrable, but it's LESS LIKELY to be targeted and to execute such a virus. You have some tips about an encryption virus at… and at… – medigeek Oct 5 '13 at 8:27
What does it matter what the virus aims at? If it aims at my hard disc content and find a way in, it could become eventually a part of my backup with me knowing... – CarrotFile Oct 5 '13 at 10:04

Backup to read only media such as CDR etc DVD, once written it can't be changed

can back up 25 GB on blue ray single sided

share|improve this answer
But the virus can lay dormant on the read only media, eventually becoming a part of all me backups. – CarrotFile Oct 5 '13 at 10:08

The basic idea is to not give the ransomware easy write access to all backup media.

Multiple backups

Create rotating backups on at least two different media that you store disconnect from your machine. That way ransomware can only encrypt at most one backup before you will notice and let it overwrite the other(s).

Network backup

Backup your files (incrementally) to a network medium, say another machine in the local network or “in the cloud”. I don't think ransomware touches network shares nowadays. If you want to be sure, prevent deletion of old backup data without a password.

Write-protected backup medium

Those will work too, as Steve suggests.

share|improve this answer
What if I do not notice it while it is dormant until it had found its way on to all backups? – CarrotFile Oct 5 '13 at 10:10
Just like biological viruses computer viruses cannot alter their environment without a host. Checking the backup for malware and removing it is good idea though if you notice one on your machine. – David Foerster Oct 5 '13 at 10:14
So basically what I take from you is: If I get infected with a virus that shows itself or is detected by a AV, and damage has already been done, like say some of my files got encrypted I can go back to a backup, and even if that backup is infected with the dormant virus I can still save the day by removing the threat before it becomes active? – CarrotFile Oct 5 '13 at 10:57
Yes. Just take care not to infect the host restoring the data. If your paranoid about that, use a Linux Live CD. – David Foerster Oct 7 '13 at 15:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.