Scanning external hard drive

[DianaO]

I have cleaned malware on my Mac with your product. Without being able to scan an external drive, what do I do about scanning my Time Machine backups for the same malware I just removed from my Mac? Nothing? Throw them away? 

This is a serious limitation. I can't be sure when the malware got onto my Mac, so I cannot reliably restore anything from that drive. That is not good. 😞

 

PS: I have used Malware Bytes on PCs for many years and was a past network and system administrator, so I know not to ignore the back-ups. 

[DianaO]

Read this:

https://www.cnet.com/news/how-to-manage-malware-in-os-x-backups/

 

[exile360]

Greetings,

I don't know about how it works for Macs, but I do know that on Windows it is a very bad idea to try to remove malware from backup images or system restore points as it will corrupt them rendering them useless and an infected backup is better than none should a system failure occur as you can always restore the system/image then scan it afterwards to remove any threats that might be present once the restore operation is completed.

[PaulBostock]

 This was posted by Treed last December.

We do not, and for good reason. You should not allow anything to scan Time Machine backups!

Time Machine backups have a special, unique structure that can be very fragile if it is disturbed, and changes should not be made to Time Machine backups by anything other than Time Machine. Allowing a third-party program to alter the backups in any way can destroy the entire backup set. Worse, it can do so without making the problem immediately obvious.

I've seen cases where people have somehow edited these backups outside of Time Machine itself, and the backup continues to work for a while. But then, when it's needed most, it fails and cannot be used to restore data.

For this reason, my advice is as follows:

    With any backup system, it's important to have at least two different, redundant backups, created by at least two different backup programs. In my case, that is Time Machine to a Time Capsule plus an external drive, and Carbon Copy Cloner to a couple additional external drives.
    Since Time Machine backups can be fragile, never let anything other than Time Machine mess with them. Do not scan them with any antivirus software!
    If your machine gets infected and the malware ends up backed up, it can't hurt you unless you restore your machine from Time Machine to a point in time when the machine was infected. Once your machine is clean, all subsequent backups will be clean, and the malware present in older "snapshots" will eventually be flushed from the backup during normal pruning, once the drive becomes full.

 

Edited April 22, 2019 by AdvancedSetup
Removed light gray font coloring and style

[alvarnell]

I am 100% behind what @treed has been constantly saying about this and I you will be hard press to find any Mac anti-malware product that allows backup volume scanning and none will be able to remove it.

If you have removed malware or PUPs in the past and later need to do a large resoral from TM, just be sure to make a Malwarebytes scan immediately after. Over time, any malware that made it's way to TM will be deleted in any case.

[ARonNYC]

On 4/21/2019 at 5:00 PM, DianaO said:

Read this:

https://www.cnet.com/news/how-to-manage-malware-in-os-x-backups/

 

Yeah this offers zero information.

[alvarnell]

5 hours ago, ARonNYC said:

this offers zero information.

Yes, in that much of that article does not pertain to Malwarebytes and many other anti-malware scanners since they don't scan Time Machine volumes. But if you happen to know the exact location of any malware found on your boot drive, you can use the instructions #2 to remove all of those same files from those same locations on the TM drive. And you could just completely erase the backup drive as outlined in #3 and start over, but that's a rather extreme approach. 

Edited September 14, 2020 by alvarnell