Are quarantined file gone after Malwarebytes is uninstalled?

[Atlas Boy]

I ran a quick scan and removed all items found and rebooted. I ran a second scan, and my system was clean. The files removed in the first scan were shown in the "Quarantine" tab as expected.

After some time passed, I releized that some important files were removed in the first scan. Someone had uninstalled Malwarebytes in the meantime. Is there any way to get back the files that were quarantined by Malwarebytes before it was ininstalled?

Please help...

[noknojon]

Hi Atlas Boy -

First - I don't think they would have been isolated by Malwarebytes unless they were infected -

Next - What time frame are we looking at ? 1 hour /1 day /1 week /1 year -??

Any response to this would help - Also why was it uninstalled ??

Thank You -

[Atlas Boy]

Hi Atlas Boy -

First - I don't think they would have been isolated by Malwarebytes unless they were infected -

Next - What time frame are we looking at ? 1 hour /1 day /1 week /1 year -??

Any response to this would help - Also why was it uninstalled ??

Thank You -

Hey noknojon.

Yes the files were flagged as infected. They were .ZIP files that contained MS Office files as well as something that MWB flagged.

They were identified and quarantined 2 days ago. They show in the MWB log as being quarantined.

Sometime yesterday another user (using the same WIndows logon) uninstalled MWB for reasons unknown. Best I can tell, she thought it was a fake.security virus and removed it.

I need to recover them if at all possible and retrieve the MS office docs from the .ZIP's. I have an unused PC (thats not critical) we can move them to so I can uunzip, retrieve the docs, and scan again to make sure they are clean before I move them back to the main system.

I'm also wondering how this happened. Is it possible for a virus to get included with a ZIP (using WINZIP version 12) when we zip'ed the documents? There were a total of 2279 objects identified by MWB during the scan. Much of it was ad-ware, but it also had many rouges, fakes, security fakes, etc. Once we rebooted the PC after removal, the system was very slow. It's still very sluggish taking a long time to reboot and open applications. It had slowed down before the scan / removal but it is worse now.

Thanks for getting back to me so quickly.

[mountaintree16]

Hey there Atlas Boy,

As long as you haven't run the mbamclean tool, if you RE-install Malwarebytes, they should still be there.

I've verified this myself on a machine that I removed malware from. Malwarebytes had been removed a few weeks after I removed malware, but mbam clean had not been run. I re-installed Malwarebytes a few months later to run a scan again, and the items that I had removed previously were still in quarantine.

I hope this helps

As a side note, please use the "ADD REPLY" button at the bottom of the page when replying. Thank you

[noknojon]

First, the files were most likely infected prior to being zipped - Also remember that once quarantined they are as good as Fully removed so no further actions are required - They can stay there in case you wish to reopen them at a later date or to report them to us -

As I note below please wait an hour or so as I check with our experts prior to doing this -

Try this - It may not always work , but if it was only one day or so it may come back - It also depends on how it was removed -

Install the latest version from here. mbam-setup.exe

You may have lost them unless I can find another way to get them back - Wait an hour or so and I will check with our experts -

If you do ever recover these zip files do not open them until you transfer them -

Thank You -

EDITED VERSION - Some of the first information was wrongly included -

I also deleted the program a day or so ago (due to other reasons) but reinstalled and have my last several logs still there -

[mountaintree16]

Atlas Boy,

If you hope to recover these files, please DO NOT run the mbam clean tool, otherwise they WILL be gone forever pretty much.

However, are you positive that they don't contain malware? You don't want to re-infect yourself by restoring them from quarantine. Items placed into quarantine are rendered dead and can no longer harm your computer.

[Atlas Boy]

Thank you so much! I don't know what the clean tool is, so I'm sure it has not been run. I'll reinstall tomorrow and get the files back. Once I restore the files from quarantine I'll copy the entire ZIP file to a PC I don't care about. I'll run mbam again on the main PC to pick the zip's up again and quarantine them. I'll plan to unzip on the 2nd PC, pull the files out of the zip that I need, and then run mbam on that PC to see if the MS Office files are infected, or just something in the ZIP. Hopefully I'll end up with clean documents that I can move back over to the main PC. If the doc's are infected, I guest I have ALOT of typing to do.

Thanks again for everyones help.

Atlas.

[mountaintree16]

Atlas Boy,

You're very welcome! Prior to scanning again, make sure that you update Malwarebytes Also, please only restore what you think you absolutely NEED.

Also, since you had over two thousand infections found on the scan on the infected PC, I would advise you to do the following as soon as you can:

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

Please note that it may take 72 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 72 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.

Thank you