Author Topic: Can I rescue files deleted by avast?  (Read 11026 times)

0 Members and 1 Guest are viewing this topic.

val

  • Guest
Can I rescue files deleted by avast?
« on: February 23, 2005, 05:17:26 PM »
While scanning, avast detected Sober-C in my Mails/Inbox and suggested to delete the file. So I did, and now all my mails are gone!
Is there any possibility to rescue them??? (I'm using Mozilla; Windows XP)

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Can I rescue files deleted by avast?
« Reply #1 on: February 23, 2005, 05:23:04 PM »
You can put the file back from the virus chest, but that is not recommended since you will bring your system the risk of getting infected.

val

  • Guest
Re: Can I rescue files deleted by avast?
« Reply #2 on: February 23, 2005, 05:37:03 PM »
thanks, but the problem is, its not in the virus chest, because i clicked "delete"

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Can I rescue files deleted by avast?
« Reply #3 on: February 23, 2005, 05:41:28 PM »
If at first you don't succeed, then skydiving's not for you.

val

  • Guest
Re: Can I rescue files deleted by avast?
« Reply #4 on: February 23, 2005, 06:44:46 PM »
thx i tried, but no deleted files at the specific time.
seems that just (the main) parts were deleted out of the file (=inbox), and only the oldest 2 mails were left...
is there any other chance?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Can I rescue files deleted by avast?
« Reply #5 on: February 23, 2005, 06:45:49 PM »
It is not recommended to use the inbox for general email storage, the inbox is the most prone to corruption and in this case deletion. Mozilla and Thunderbird's FAQ/advice is not to use the inbox for general storage.

Think of the inbox as more of a pending tray, once viewed and actioned move it to a more appropriate email folder, Personal, Newsletters, etc. etc. That way if you do lose it not much harm is done.

Your are taking regular backups of you email folders aren't you ;D
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Can I rescue files deleted by avast?
« Reply #6 on: February 23, 2005, 06:49:21 PM »
thx i tried, but no deleted files at the specific time.
seems that just (the main) parts were deleted out of the file (=inbox), and only the oldest 2 mails were left...
is there any other chance?

I would suggest a google search for something like "recovery of deleted mozilla inbox" or "mailbox recovery tool" without the quotes. I would also suggest a visit to the mozilla forum, you can be assured you aren't the first this has happened to.
« Last Edit: February 23, 2005, 06:54:45 PM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

val

  • Guest
Re: Can I rescue files deleted by avast?
« Reply #7 on: February 23, 2005, 06:52:50 PM »
...well... i guess i'll learn something out of this...  ;D
thanks, its worth a try (and i'm sure i'm not the only one!)

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Can I rescue files deleted by avast?
« Reply #8 on: February 24, 2005, 09:38:27 AM »
val, when you pressed the delete button, there should have been a warning that you were going to delete a file that may contain your mailbox (if the filename was Inbox indeed). Did you get such a warning?

val

  • Guest
Re: Can I rescue files deleted by avast?
« Reply #9 on: February 24, 2005, 02:33:11 PM »
hi igor, no i didn't get any warning
logviewer/warning says the following:
...Sign of "Win32:Sober-C [Wrm]" has been found in
"C:\....\Mozilla\Profiles\default\dgw95nm0.slt\Mail\pop.mail.yahoo.de\
Inbox\PartNo_0#4261281382\PartNo_0#2531855753\PartNo_0#1985124356\PartNo_0#3452606941\PartNo_0#2594505470\PartNo_0#2081721096" file.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Can I rescue files deleted by avast?
« Reply #10 on: February 24, 2005, 03:09:18 PM »
And this is the only warning about infection you have there?

If yes, it's really strange. In this case, the virus was correctly detected inside of the mailbox, in a particular message (that's the part following the Inbox part) - not in the Inbox file itself (it would be the end of the path in that case). So, it should have been deleted correctly, without corrupting/deleting the mailbox...  :-\

I guess you have overwritten the Inbox file already, did you? I wish we could find out what went wrong...

val

  • Guest
Re: Can I rescue files deleted by avast?
« Reply #11 on: February 24, 2005, 03:50:30 PM »
well, there are many warnings. yesterday there were 4, the other 3 about Win32:Trojano-834 and 781... but those i put in the virus chest - as was suggested by avast (only for the sober-c it suggested "delete")

when and how is the inbox file overwritten? i have received new mails since then, if thats what you mean.
i still wonder why it was in the inbox, usually i delete strange messages (but i do not empty the trash on a regulary basis)

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Can I rescue files deleted by avast?
« Reply #12 on: February 24, 2005, 03:58:04 PM »
To be more precise. It is the space on the disk where the inbox file was stored that is overwritten. You store a file on the disk (in this case the inbox file). If you delete that file, it is not gone. It is only marked so that Windows won't show it. (That is why you still can put files back if they are in the recycle bin) If you empty the recycle bin almost the same happens. But this time they are marked so that they don't show up in the recycle bin either. But still the file is there on the disk. As long as the space the file is on is not overwritten by (any) other file, you can retrieve it with a util like Vlk posted.

If the diskspace that the file is on is overwritten it is not possible for the user to get it back anymore, unless you hire a recovery specialized company like Ontrack. But that will cost a lot of money.

I hope this explains it for you.

val

  • Guest
Re: Can I rescue files deleted by avast?
« Reply #13 on: February 24, 2005, 04:19:15 PM »
i understand, but i'm not sure, wether igor meant this - i can't (easily) know where something is written to

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Can I rescue files deleted by avast?
« Reply #14 on: February 24, 2005, 04:20:58 PM »
I believe that if other messages were already received, there's no way to find out anything useful from the file.