Unable to post?

[Timtas]

I have been trying to make a post about an issue I am experiencing but keep on receiving the following error.

 

We're sorry but our system has detected wording in your post consistent with spam. It may be by accident.

please try changing the wording and try to post again.

If you're still unable to. then please contact our Helpdesk at the following link

 

This is an attempt to get a post up so I can post my question.

 

[Malwarebytes]

*** This is an automated reply ***

 

Thanks for posting in the Malwarebytes Business section of the forum

For self-help articles, please see the following link
https://service.malwarebytes.com/hc/en-us

If you're unable to locate an answer from the articles in that link or here on the forums, you're more than welcome to post a new question.

Please note that if you do need direct support, please create a support ticket from the following link.

Business Support
https://service.malwarebytes.com/hc/en-us/requests/new

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

 

[Timtas]

At 10:40AM yesterday one of our important files became corrupted. 20 minutes beforehand, at 10:20AM, I believe Malwarebytes Ransomware protection has taken a copy of this file and stored it in "C:\ProgramData\Malwarebytes Endpoint Agent\Plugins\EDRPlugin\Backup"

The file size of the file located in the above directory matches the exact size of the file that has been corrupted and is last modified 20 minutes before the file became corrupted. This file is not in the same format as the original file. Apparently there is no way of manually restoring from the rollback cache as it requires suspicious activity to be detected in order to initiate a rollback and there is also apparently no way to rollback only certain files.

I know that Malwarebytes is not a backup solution and I should have had this file backed up but it is too late now. There is an uncorrupted copy of my file in C:\ProgramData\Malwarebytes Endpoint Agent\Plugins\EDRPlugin\Backup but appears to be stored in a Malwarebytes propriety format.

Any assistance on how I can restore this file would be greatly appreciated!

[Porthos]

6 minutes ago, Timtas said:

Any assistance on how I can restore this file would be greatly appreciated!

I would highly suggest that you open a support ticket with Business Support to work with them directly.

Submit  Business Support Ticket  

It can take a few days for a response as ticket volume is high at this time.

[Timtas]

Hi Porthos,

I have submitted a business support ticket however they are telling me that it is not possible to restore without suffering a cryptolocker infection, this does not seem right to me, hence why I have turned to the community.

I am also under the impression that the files are only stored for 72 hours so I am not sure that I have the few days response time to wait.

[Porthos]

34 minutes ago, Timtas said:

hence why I have turned to the community.

This part of the community i not as well "traveled" so to speak.

 

35 minutes ago, Timtas said:

however they are telling me that it is not possible to restore without suffering a cryptolocker infection

That could be the case but they know the product so I cant say as I only deal/support the consumer version.

53 minutes ago, Timtas said:

I should have had this file backed up but it is too late now.

I personally believe that proper backup is more important than a security solution and that is what I preach to my clients.

Is there any chance you have M365 and have the file in one drive?

[Timtas]

25 minutes ago, Porthos said:

This part of the community i not as well "traveled" so to speak.

 

That could be the case but they know the product so I cant say as I only deal/support the consumer version.

I personally believe that proper backup is more important than a security solution and that is what I preach to my clients.

Is there any chance you have M365 and have the file in one drive?

Unfortunately there are no other duplicate copies of this file except for the copy in ProgramData :(