Technically, it should be possible to clean up the infected files on MOST TM backups. However, it is much safer to delete the backups and clean up a non-archived version for future backup.
If you are backing up to Time Machine over a network share or are using sparse bundles in your TM Backup drive, you could possibly corrupt your entire backup while attempting to clean the files. This should not happen with current versions of SAV and Time Machine, but it is possible. It is also possible for similar corruption or system lockup to happen if Time Machine starts a new sync while the cleaning operation is in process -- so it is recommended that Time Machine be turned OFF prior to attempting to clean up the files. Then create a custom scan and add the Time Machine volume to the list of items scanned.
To get a local copy of the backed up files, disable on-access scanning and restore the files. Then re-enable on-access scanning. Any access of those files should put them in quarantine, where you should be able to clean the malicious macros from the files.
-
Andrew
