Jump to content
Mark42091688

Malwarebytes Quarantined my entire external drive!

Recommended Posts

Hello Guys Today I ran a quick scan on my external drive using the latest version of Malwarebytes. It found malware and it only gave me the option to Quarantine, so i clicked on Quarantine. then I went back to my drive and its EMPTY!! its a 2TB drive and I am scared to loose all my stuff! Please help anyone!

Share this post


Link to post
Share on other sites

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

If you are having technical issues with our Windows product, please do the following:

Malwarebytes Support Tool - Advanced Options

This feature is designed for the following reasons:

  • For use when you are on the forums and need to provide logs for assistance
  • For use when you don't need or want to create a ticket with Malwarebytes
  • For use when you want to perform local troubleshooting on your own

How to use the Advanced Options:

Spoiler
  1. Download Malwarebytes Support Tool
  2. Double-click mb-support-X.X.X.XXXX.exe to run the program
    • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
  3. Place a checkmark next to Accept License Agreement and click Next
  4. Navigate to the Advanced tab
  5. The Advanced menu page contains four categories:
    • Gather Logs: Collects troubleshooting information from the computer. As part of this process, Farbar Recovery Scan Tool (FRST) is run to perform a complete diagnosis. The information is saved to a file on the Desktop named mbst-grab-results.zip and can be added as an email attachment or uploaded to a forum post to assist with troubleshooting the issue at hand.
    • Clean: Performs an automated uninstallation of all Malwarebytes products installed to the computer and prompts to install the latest version of Malwarebytes for Windows afterwards. The Premium license key is backed up and reinstated. All user configurations and other data are removed. This process requires a reboot.
    •  Repair System: Includes various system-related repairs in case a Windows service is not functioning correctly that Malwarebytes for Windows is dependent on. It is not recommended to use any Repair System options unless instructed by a Malwarebytes Support agent.
    • Anonymously help the community by providing usage and threat statistics: Unchecking this option will prevent Malwarebytes Support Tool from sending anonymous telemetry data on usage of the program.
  6. To provide logs for review click the Gather Logs button
  7. Upon completion, click OK
  8. A file named mbst-grab-results.zip will be saved to your Desktop
  9. Please attach the file in your next reply.
  10. To uninstall all Malwarebytes Products, click the Clean button.
  11. Click the Yes button to proceed. 
  12. Save all your work and click OK when you are ready to reboot.
  13. After the reboot, you will have the option to re-install the latest version of Malwarebytes for Windows.
  14. Select Yes to install Malwarebytes.
  15. Malwarebytes for Windows will open once the installation completes successfully.

Screenshots:

Spoiler
 
 
 
 
Spoiler

 

 

01.png

02.png

03.png

04.png

05.png

06.png

 

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

  • Renewals
  • Refunds (including double billing)
  • Cancellations
  • Update Billing Info
  • Multiple Transactions
  • Consumer Purchases
  • Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: Find my premium license key

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

Share this post


Link to post
Share on other sites

Greetings,

I'm sorry you're having trouble but we'll do our best to help.  Please begin by posting the following logs:

  1. Download and run the Malwarebytes Support Tool
  2. Accept the EULA and click Advanced tab on the left (not Start Repair)
  3. Click the Gather Logs button, and once it completes, attach the zip file it creates on your desktop to your next reply

Thanks

Share this post


Link to post
Share on other sites

I uninstalled Malwarebytes to see if that way I could get my files back, then installed it again. my hard drive was still empty after reinstalling it. i ran another scan and did did not find anything. What can i do!?

 

01.jpg

02.jpg

Share this post


Link to post
Share on other sites

Hi, Mark.

At the time that you ran the Support tool, the Malwarebytes'  Quarantine area was empty.

The report / log collection only had but 1 Scan run report.  The run that ended at 2020-06-28T19:06:58Z

It found no malware.   It made no removals of any sort.

 

 

Share this post


Link to post
Share on other sites

When the application is uninstalled its quarantine is removed with it so that it doesn't leave behind any of its files on the user's system so if there were any items in quarantine prior to uninstalling they are most likely gone.  I would suggest seeking help in recovering the data from the drive however I don't know how successful it will be.

Share this post


Link to post
Share on other sites

If my  vision & math are correct  .....looking at the File Explorer screen at the top

the volume labeled "backup drive"   & shown as drive-letter D  has 839.3  GB of content.

 

I am just wildly guessing that the VIEW setting in Windows File Explorer is not showing you all of its content.

Dot not let the details or number of lines below spook you, please. It is all do-able and needed. 
Just take your time. 
 

Windows File Explorer needs to be  set to show ALL  folders, all system files,  etc  including hidden files / folders 

Open Windows File Explorer. 

  • Select View   from its top menu bar  >   click Options  on the icon at the far right-side > Change folder and search options   ( from the drop down ). 

  • on the next multi-tab mini-window 

  • Select the View tab and, in Advanced settings 

  • select Show hidden files, folders, and drives 

  • and OK. 

 

Share this post


Link to post
Share on other sites

Yes it did. it found 330 malware. I dont know why it did not show there.  Is it because i uninstalled it then reinstalled it again??

Share this post


Link to post
Share on other sites

It is odd that it shows the drive as being nearly full, yet when you open the drive it is empty.  Unless the contents of the drive are hidden.

edit: see Maurice's post above.

Share this post


Link to post
Share on other sites

Where is that report ?  did you save a copy ?

and when exactly did you run the support tool report?    and be sure you looked at my preceding answer

Share this post


Link to post
Share on other sites
1 minute ago, Mark42091688 said:

Is it because i uninstalled it then reinstalled it again??

Yes, uninstalling Malwarebytes removes its quarantine folder and logs so all of that data is gone.  Please follow Maurice's instructions above and hopefully your data can be recovered.

Share this post


Link to post
Share on other sites
Just now, Maurice Naggar said:

Where is that report ?  did you save a copy ?

and when exactly did you run the support tool report?    and be sure you looked at my preceding answer

He ran the scan, quarantined the drive's contents, attempted to uninstall/reinstall Malwarebytes (this is where the quarantine and reports got deleted), then came here for help and ran the Support Tool as requested.  That's why nothing shows up in the logs.

Share this post


Link to post
Share on other sites
2 minutes ago, exile360 said:

He ran the scan, quarantined the drive's contents, attempted to uninstall/reinstall Malwarebytes (this is where the quarantine and reports got deleted), then came here for help and ran the Support Tool as requested.  That's why nothing shows up in the logs.

exactly :(  I try to use recuva but whatever trojan was there infected it really bad.. everything shows as an .exe extension now.. all of my contents when i try to recover my stuff

Share this post


Link to post
Share on other sites

If everything is quarantine, why does my drive still shows all the space is taken up it literally  quarantined everything the first time i ran it.

Share this post


Link to post
Share on other sites

There's no way to know without seeing the logs from before unfortunately, because we can't see what was there and what was removed.  I'm not sure why the drive shows as empty even though it is still being read as  having content, but you might try something like SpaceMonger (I recommend the Mega link as many of the others were blocked) to check and see what shows up when it reads the drive.

Share this post


Link to post
Share on other sites
4 minutes ago, exile360 said:

There's no way to know without seeing the logs from before unfortunately, because we can't see what was there and what was removed.  I'm not sure why the drive shows as empty even though it is still being read as  having content, but you might try something like SpaceMonger (I recommend the Mega link as many of the others were blocked) to check and see what shows up when it reads the drive.

Looks like all my stuff is still there when i use Spacemonger!!! How can i recover all of my stuff?  I really appreciate your help!

 

Share this post


Link to post
Share on other sites

I was really hoping you'd say that.  I'm no expert when it comes to drives/data, but I bet the invisible data has something to do with something like the Master File Table (MFT) and/or USN Journal which are used by the system to keep track of a drive's contents.  Let me get one of our more knowledgeable members involved.  He has many years of IT experience, including working with countless drives so perhaps he knows some options we can try.

First, I do have one more thing for you to try though.  As this is an external drive, please try disconnecting and reconnecting it (be sure to use the safely remove hardware function) and see if anything shows up.  If that fails then I'll leave it to Ron (AdvancedSetup) whom I've requested to take a look.

@AdvancedSetup would you please take a look?  It appears that the data is still present on the drive, however it fails to show up in Explorer.

Share this post


Link to post
Share on other sites
10 minutes ago, exile360 said:

I was really hoping you'd say that.  I'm no expert when it comes to drives/data, but I bet the invisible data has something to do with something like the Master File Table (MFT) and/or USN Journal which are used by the system to keep track of a drive's contents.  Let me get one of our more knowledgeable members involved.  He has many years of IT experience, including working with countless drives so perhaps he knows some options we can try.

First, I do have one more thing for you to try though.  As this is an external drive, please try disconnecting and reconnecting it (be sure to use the safely remove hardware function) and see if anything shows up.  If that fails then I'll leave it to Ron (AdvancedSetup) whom I've requested to take a look.

@AdvancedSetup would you please take a look?  It appears that the data is still present on the drive, however it fails to show up in Explorer.

Thank you so much for your response! Yes i have tried to safely remove and even connected it to another computer and on explorer it still shows empty. However, when I use SpaceMonger, everything is on the drive! all of it. and i can even open all of the video files and pictures and everything.

Share this post


Link to post
Share on other sites

Good, in fact, if possible, you might try copying the data using SpaceMonger to another drive if you have one with sufficient space.  Then you can check and verify your data is present/accessible and complete, and if it is, you may then simply wipe the original backup drive and replace all of the data on it by copying it over.  If that doesn't work then please await a response here from a more knowledgeable member of the forums.

Share this post


Link to post
Share on other sites

Funny you should mention. I was searching on google and I came across a website that recommended to use EaseUS Tools M and click on "file showing". So i clicked on it, waited for a few minutes and all my stuff came back!  So i recovered everything!!  I really appreciate your help in this!

Share this post


Link to post
Share on other sites
3 minutes ago, Mark42091688 said:

Funny you should mention. I was searching on google and I came across a website that recommended to use EaseUS Tools M and click on "file showing". So i clicked on it, waited for a few minutes and all my stuff came back!  So i recovered everything!!  I really appreciate your help in this!

Good to hear. I doubt Malwarebytes caused this. I would be sure to test the health of the external drive. Also I suggest having a second copy of the data on that external. A drive is only good until it fails. All drives fail and it is not if but when.

Data recovery on drives can get expensive depending on why it failed and how bad. The lowest cost I have found in the US /Canada is about $400. I have had only 2 clients in 20 years willing to pay for professional recovery services.

Last thing to mention, There is no need to scan external drives with Malwarebytes. If you want an explation why, Please ask.

Share this post


Link to post
Share on other sites

Sweet, well done :)

I'm glad you got your data recovered.  As Porthos mentioned above, it seems very unlikely that Malwarebytes caused this, though it is certainly possible that it was a factor.  In the meantime, as Porthos mentioned, there's generally no need to scan external drives, especially if you've got Malwarebytes Premium as its protection should guard against any threats that try to launch from the drive, and the default Threat scan already checks all threads and processes in memory (along with every common location malware is known to hide) so you should be OK just sticking with the default scan (this is also why the other scan types are 'hidden' in another sub-menu while the default scan is front and center in the UI).

Please let us know if there is anything else we can help with.

Thanks

Share this post


Link to post
Share on other sites

Sorry I was late to the topic, but glad you were able to restore your data and all appears to be well now.

If you do have any other issues or want further assistance @Mark42091688 please let us know and we'll be happy to assist.

Thank you

 

Share this post


Link to post
Share on other sites

Hello Mark.

I am glad that the situation has been sorted out.   Last night the posts back and forth were going at super fast speed, seems to me.

I just want to point out and ask a few things.  At the time you relayed a screen shot,  the D drive did have contents, which added up to 839.3  GB of content.

A screen grab section with highlight is copied here.

SN1.jpg.cf1b5c8170d225c752dd04782a3f96d6.jpg

 

At least as of then,  the drive had "stuff".   My theory all along was that the "tool"  used to "look"  at the D drive was somehow not set to show all folders / all files / all hidden files ( if any).

However,  stuff was there on drive D.

My question is,  which tool was this ?   which program?

Looking closer at the image, this is not the standard Windows File Explorer.   Not its standard title bar, menu bar, tool bar.

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.