Jump to content
topangajack

Oops! I deleted WINDOWS INSTALLER FILES from quarantine

Recommended Posts

Several of my Windows .MSI installer files were quarantined as infected with Trojan.Emotet. I [impulsively] deleted the files from quarantine. Now I see that there was a FALSE POSITIVE problem and that these files were probably OK. They may also be important!  I realize that I jumped the gun by deleting them, so the question is, is there any way to find them and restore them? I tried a data recovery tool (Recuva) and found nothing. I also tried System Restore twice but they would not complete - "missing file" error.

Please see attached Scan Summary.  Thanks!

scan.txt

Share this post


Link to post
Share on other sites

Can you please zip the logs that are located here

C:\ProgramData\Malwarebytes\MBAMService\ScanResults

and attach them to the post or PM me them.

Thanks.

 

Share this post


Link to post
Share on other sites

No problem i will be back on in about 10 hours from now. if you get sooner send me the logs and i will see if i can come up with the files. Worse case you may have to reinstall office 2010 and do the updates if we cant. That should put the msi files back.

Edited by shadowwar

Share this post


Link to post
Share on other sites

those json files  in he log directory actually have the hash of the files detected. The names can be random so wont help me find the files for you.

Share this post


Link to post
Share on other sites

I am very grateful for your help!

Things could have gotten ugly without those .msi files.
Lesson learned: Never delete files from quarantine unless you know it's safe.

Thanks again!

John

Share this post


Link to post
Share on other sites

Just so you know. Files in quarantine are totally broken and cant possibly run. They arent repaired until they are restored from quarantine.  So leaving them there besides disk space would be the only possible issue. I recommend leaving them for a week.

Glad its taken care of.

 

Edited by shadowwar

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.