It is always better from a security point of view to replace infected
files with clean, uninfected copies. However, in some circumstances this
is not convenient. For example, if an entire network were infected with
a fast-infecting file virus then it may be a lot quicker to run a quick
repair with a reliable anti-virus product than to find clean, backup copies
of the files. It should also be realised that clean backups are not
always available. If a site has been hit by Nomenklatura, for example,
it may take a long time before it is realised that you have been infected.
By that time the data in backups has been seriously compromised.
There are virtually no circumstances under which you should need to reformat
a hard disk, however: in general, this is an attempt to treat the symptom
instead of the cause. Likewise, re-partitioning with FDISK is unnecessary.
If you use a generic low-level format program, i.e. one which isn't
specifically for the make and model of drive you actually own, you
stand a good chance of trashing the drive more thoroughly than any
virus yet discovered.
Internet FAQ top