A method and apparatus for managing protecting data from damage in a data processing system. The data is journaled to form journaled data. A determination is then made as to whether a virus is present in the data processing system after journaling of data has begun. Journaling involves storing a system state before an action is executed so that the state can be restored upon demand. The detection of a virus may be performed by using pattern matching on system audit trails in which the system audit trails contain activities occurring within the data processing system. In response to an identification of the virus, the data is restored to its previous state using the journaled data.