Author Topic: RECOVER FILE DELETED FROM VIRUS CHEST  (Read 11060 times)

0 Members and 1 Guest are viewing this topic.

Offline cmarquez864

  • Newbie
  • *
  • Posts: 3
RECOVER FILE DELETED FROM VIRUS CHEST
« on: September 13, 2013, 12:18:37 AM »
so here is my situation, and i hope that someone on the forum can help, i know there is some witty minds out there. I have a usb drive that had probably 1000+ pictures on it. All in seperate folders for each event i took them at. Some are very old pictures dated back to 2007. I inserted the usb drive into my sisters computer to copy some files to it and when i went to open the files on my computer avast alerted me there was a virus and asked if i wanted to move it to the chest. So i did. I went to the virus chest and deleted the infected file from there. Didnt think nothing about it. Went back to my usb drive all word documents were there from my sisters computer, but ALL i mean ALL my pictures were gone, Just the folders show up, but when i click to open the folders i get an error message that it cannot open the file. The folders are in a few kb so i know there is nothing in the folders. i am so damn pissed off, and i feel stupid for doing what i did, but i had no idea this would of happen or else i would of left it in the chest. A HUGE MISTAKE. These pictures are important to me. They are photos from family events over the years that i do not have anywhere else. The usb drive was meant to be a back up. I called Avast customer service and i was told that even though the files were deleted from the virus chest, they are still in the registry in windows. That i would need to hire a windows trained professional to get the pictures back, or i could pay them $115 bucks to remotely do it. Now Im not a computer wizard, OBVIOUSLY, but i know there has to be someone who knows how to restore the files deleted from the virus chest through the registry in the computer. I am using windows 7. Any help and advice would be incredibly appreciated.

Offline argus

  • Malware Removal Expert ASAP
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2064
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #1 on: September 13, 2013, 09:44:57 AM »
Hi,



> Check USB storage devices / removable drives


Download MCShield from one of the following links:

MyCity -  Official download link
Softpedija - Mirror download link

  • Double click MCShield-Setup to install the application.
  • Wait a few seconds to MCShield finish initial scan.
Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.
  • Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.
When all scanning is done, you need to attach a logreport that MCShield has created.

Start -> All Programs -> MCShield -> Logs

Attach here -> AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.








.
Download DDS and save it to your Desktop from here:
http://download.bleepingcomputer.com/sUBs/dds.scr

Double click dds to run the tool.

    * When done, DDS will open two (2) logs:
        1. DDS.txt
        2. Attach.txt

Save both reports to your desktop. DDS.txt and Attach.txt attach back to topic.
I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.   DONATE

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2245
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #2 on: September 13, 2013, 10:08:29 AM »
Hello,
if you didn't write anything new on your USB drive, you can use free tool for files recovery: piriform.com/recuva
But if the files were deleted by avast! because of some infection they can be moved to chest again if you will try to recover the files on PC with running avast!.

Milos
« Last Edit: September 13, 2013, 10:12:09 AM by Milos »

Offline argus

  • Malware Removal Expert ASAP
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2064
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #3 on: September 13, 2013, 10:17:07 AM »
Folders are not lost just hidden  ;D
Most popular worm that used this method was Win32.Rays.
I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.   DONATE

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2245
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #4 on: September 13, 2013, 10:23:48 AM »
Folders are not lost just hidden  ;D
Most popular worm that used this method was Win32.Rays.
Yes,
this can be also the reason you don't see the files. If you see that the USB drive has same used space as before you can just enable viewing hidden files in you files manager (Windows explorer, Total commander, ...).

Milos

Offline argus

  • Malware Removal Expert ASAP
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2064
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #5 on: September 13, 2013, 10:28:23 AM »
MCShield will do it for 5 sec. automatic  :)
I volunteer my free time to help you, if you would like to donate to show your appreciation, it will be much appreciated.   DONATE

Offline cmarquez864

  • Newbie
  • *
  • Posts: 3
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #6 on: September 13, 2013, 03:41:08 PM »
I haven't written anything new to the drive at all. As soon as I noticed the pictures were gone I took the USB out and haven't done anything with the computer. I tried recuva but it didn't recover the picture folders with pictures inside even with deep scan I will try the other suggestion and see if it works. Keep your fingers crossed.

Offline cmarquez864

  • Newbie
  • *
  • Posts: 3
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #7 on: September 14, 2013, 10:52:52 AM »
I downloaded mcshield and it worked perfectly. The files are showing up on the usb drive. Before i downloaded and tired mcshield i went into folder properties and had already tried to show hidden files, but only thing that would show up would be a folder that could not open, kept getting an error. Once i used mcshield it said it detected something and cleaned it up. Soon as scan was done i checked the usb drive and everything was back on there. I did download dds and did a scan, what exactly is dds and should i still post the two txt. files on this post for you to see? I know you said the most common worm to hide files like that was win32.rays. I have a question though, Where the hell did that infection come from? Was it an infected file in my sisters computer that was transferred to the usb drive and then infected all my photos, or was it already infected in the photo files and just not being detected by my computer for this long?

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37098
Re: RECOVER FILE DELETED FROM VIRUS CHEST
« Reply #8 on: September 14, 2013, 01:16:29 PM »
Quote
I did download dds and did a scan, what exactly is dds and should i still post the two txt.
DDS is a diagnostic program
and yes, attach the logs from MCShield and DDS as requested by argus