can't restore a quarantined folder

[juancarlos]

I am trying to restore a quarantined folder on my MAC that was in /Users/<user>/.keys 

using the options

Detection History -> Quarantined items -> Restore -> Restore (dialog)

but after this, the item remains as a quarantined item, I tried it several times.

The contents of this folder are text files with passwords and access credentials from different systems that I manage,

I need to recover this ASAP, how can I do that?

Thank you.

Juan.

 

[Porthos]

If it works anything like the Windows version, please restart the Mac then try again.

https://support.malwarebytes.com/hc/en-us/articles/360038984893-Restore-and-delete-quarantined-items-in-Malwarebytes-for-Mac

I will ask @treed to assist.

[treed]

18 hours ago, juancarlos said:

Detection History -> Quarantined items -> Restore -> Restore (dialog)

That should result in 1) the item being restored to its original location, 2) being removed from the quarantine list, and 3) a system notification being shown that the item was restored. If you're not seeing that, I'd definitely try restarting your Mac, as Porthos suggested, and then try again.

Note, though, that at the current time there's nothing that will prevent that from being detected again on the next scan.

As an aside, I'd suggest that plain text files inside a hidden folder isn't a good method for storing credentials, as that hidden ".keys" folder would be quite conspicuous to anyone who gained access and was looking for credentials. You ought to put them in a password manager or some other encrypted file (such as an encrypted disk image created with Disk Utility).

[juancarlos]

1 hour ago, treed said:

That should result in 1) the item being restored to its original location, 2) being removed from the quarantine list, and 3) a system notification being shown that the item was restored. If you're not seeing that, I'd definitely try restarting your Mac, as Porthos suggested, and then try again.

Note, though, that at the current time there's nothing that will prevent that from being detected again on the next scan.

As an aside, I'd suggest that plain text files inside a hidden folder isn't a good method for storing credentials, as that hidden ".keys" folder would be quite conspicuous to anyone who gained access and was looking for credentials. You ought to put them in a password manager or some other encrypted file (such as an encrypted disk image created with Disk Utility).

I already tried restarting (twice), it is the solution proposed in the forums, but it does not work.

I know that that folder name is inappropriate for this software, as soon as I can recover it, I will change its name.

Just mention that they were "text files", so they are not supposed to be files that could be suspicious, the files are not stored in plain text, they are 
encrypted with GPG.

Please look this .mp4 with the result of the attempt to remove this folder from quarantine.

Is there any possibility to manually recover this folder from quarantine?

 

[treed]

Unfortunately, restoring manually isn't possible, as the quarantine is encrypted. (This is to prevent other antivirus software that may be on the system from detecting things in our quarantine, among other things.)

What your video shows is definitely not normal, and I think our devs are going to need to see the logs and quarantine database (which does not include the actual quarantined items). Can you follow the instructions at the following link to download our support tool and run it?

https://support.malwarebytes.com/hc/en-us/articles/360038519834-Upload-logs-to-your-ticket-using-the-Malwarebytes-Support-Tool-for-Mac

Once you've done that, send me a direct message and attach the MWB_Info.zip file produced by the support tool. (Don't attach it publicly here.)

Edited April 28, 2021 by AdvancedSetup
corrected font issue

[juancarlos]

Sent. Thanks for your help.

Juan.

 

[alvarnell]

18 hours ago, juancarlos said:

Just mention that they were "text files", so they are not supposed to be files that could be suspicious, the files are not stored in plain text, they are 
encrypted with GPG.

Just a note that it is the hidden .keys directory that makes it's contents suspicious, not anything about the files themselves.

[treed]

Can you try the following?

1. In the Finder, choose Go to Folder from the Go menu, and paste the following path into the window that appears:
   /Library/Application Support/Malwarebytes/MBAM/LogsEx/
2. Click the "Go" button
3. In the window that opens, you should see files named RTProtectionDaemon.log and SettingsDaemon.log. Delete those two files, and only those two.
4. Restart your computer
5. Open the Malwarebytes app and try restoring again
6. If it fails, please go back to that LogsEx folder and send me the new RTProtectionDaemon.log and SettingsDaemon.log files

[juancarlos]

It did not work, I sent you PM with the new logs generated.