Back Up Files from a Possibly Infected Windows PC Safely

You can often preserve personal files from a possibly infected PC, but treat the backup as untrusted until it has been scanned on a clean system.

Contain the problem first

1. Disconnect the PC from networks if malware is actively spreading or encrypting files. Stop syncing folders to cloud storage until you understand the infection.
2. Do not run suspicious installers, scripts, shortcuts, or unknown macro-enabled documents. Avoid plugging your everyday backup drive into the PC if it contains your only good copy.
3. If the drive is physically healthy, make a copy of valuable personal files to a separate removable disk. Use a clean boot environment if possible.
4. Record the location and date of the suspect copy. Do not merge it directly with your trusted backup archive.

Choose files carefully

Prioritize photos, videos, plain documents, and known project files. File extensions are not proof of safety; an infected document can contain macros or malicious links. Avoid restoring executables, browser extensions, and software cracks from the suspect system.

Scan before restoring

1. On a clean, updated Windows PC, connect the suspect backup with AutoPlay disabled and do not open files immediately.
2. Run an up-to-date antivirus scan of the backup drive. Inspect detections and file paths.
3. Open a small sample of essential files only after scanning. For Office documents, keep macros disabled unless their origin is trusted.
4. Restore approved files to a clean installation and monitor for recurring warnings. Keep the suspect source separate until the recovery is complete.

When to seek help

If files are encrypted or Windows keeps changing them, stop ordinary backup jobs that might overwrite earlier good copies. A professional incident-response or recovery service may be appropriate for business or irreplaceable data.

Frequently Asked Questions

Can malware hide in documents? Yes. Treat macro-enabled and unfamiliar documents cautiously.

Should I clone the entire infected disk? A disk image may preserve evidence, but do not use it as a clean restore source without inspection.

Conclusion

Keep a suspect backup isolated, scan it on a clean PC, and restore only reviewed files. Do not merge it with your known-good backup.

Related Articles

• Windows File Backup and Restore Tutorials
  Compare ways to protect and restore personal files in Windows.
• Windows System Backup and Restore Tutorials
  Find system image, recovery drive, and restore guides for Windows.
• Windows Disk Backup and Restore Tutorials
  Explore disk image backup and restoration workflows for Windows drives.

Is this information helpful?   Yes   No

This information is not relevant.

This information is not easy to understand.

This information is not deep enough.

What can we do to improve this information? (Optional)

Refresh Please enter the verification code!