Data in backup systems can be effectively protected against viruses, even if definitions for certain viruses are found after infected data have been backed up to a backup server. In one implementation, a combined filter that includes antivirus and replica filtering components can identify and process I/O system calls (e.g., including writes to files). If a virus is present, the antivirus component of the combined filter can mark the file and/or file write (and cleanse the file/file write), and pass that information to the replica component. If the file write is associated with a file to be backed up, the replica component can then pass along the antivirus filter's indications with a copy of the file write. The backup server can also identify that previous versions of the file stored at the backup server may have been infected, and can thus perform any appropriate actions.