Oops! I deleted WINDOWS INSTALLER FILES from quarantine

[topangajack]

Several of my Windows .MSI installer files were quarantined as infected with Trojan.Emotet. I [impulsively] deleted the files from quarantine. Now I see that there was a FALSE POSITIVE problem and that these files were probably OK. They may also be important!  I realize that I jumped the gun by deleting them, so the question is, is there any way to find them and restore them? I tried a data recovery tool (Recuva) and found nothing. I also tried System Restore twice but they would not complete - "missing file" error.

Please see attached Scan Summary.  Thanks!

scan.txt

[shadowwar]

Can you please zip the logs that are located here

C:\ProgramData\Malwarebytes\MBAMService\ScanResults

and attach them to the post or PM me them.

Thanks.

 

[topangajack]

Rich, my apologies, but I will not have access to the PC in question until tomorrow at the earliest.

Thanks,

John

[shadowwar]

No problem i will be back on in about 10 hours from now. if you get sooner send me the logs and i will see if i can come up with the files. Worse case you may have to reinstall office 2010 and do the updates if we cant. That should put the msi files back.

Edited January 19, 2019 by shadowwar

[topangajack]

Great!

BTW -  I did attach a scan summary to the original post - but I guess it's not the same as "logs" (?)

Thanks

[shadowwar]

those json files  in he log directory actually have the hash of the files detected. The names can be random so wont help me find the files for you.

[topangajack]

Attached is the log file. Thanks for helping!

e3599b68-1a2d-11e9-9e04-6431501fbe1a.zip

[shadowwar]

Thanks. please see private messages for the files.

[topangajack]

I am very grateful for your help!

Things could have gotten ugly without those .msi files.
Lesson learned: Never delete files from quarantine unless you know it's safe.

Thanks again!

John

[shadowwar]

Just so you know. Files in quarantine are totally broken and cant possibly run. They arent repaired until they are restored from quarantine.  So leaving them there besides disk space would be the only possible issue. I recommend leaving them for a week.

Glad its taken care of.

 

Edited January 21, 2019 by shadowwar