Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Restore a deleted files after ComboFix removal


  • This topic is locked This topic is locked
4 replies to this topic

#1 adiel91

adiel91

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:34 PM

Posted 12 September 2014 - 05:10 AM

Hey all,

i hope this is the right forum to post in.

 

i've used combofix in a computer, and after that removed it through "combofix /uninstall" command.

 

i noticed, too late of course, that a folder located in appdata\roaming was deleted, and i need it bad.

 

i tried searching through "previous versions" of the roaming folder,

and also search the folder with Recuva and couldn't find the files.

 

I tried the CFDQ-UsrPrf.exe program

but i guess since i uninstalled combofix, the qoobox quarantine folder was deleted.

 

EDIT:

I now ticked "show hidden files" and the option to show system protected filed, and the QooBox folder is present,

but when i try to run the program above the 2nd time, i get :

 

Error 0x00007766 - aborting !

 

( all antivirus is disabled and i used "Run As admin" option )

 

 

 

any way to restore the files?

any help will be appreciated

 

thanks


Edited by adiel91, 12 September 2014 - 05:14 AM.


BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:07:34 PM

Posted 12 September 2014 - 05:57 AM


i've used combofix in a computer, and after that removed it through "combofix /uninstall" command.

i noticed, too late of course, that a folder located in appdata\roaming was deleted, and i need it bad.

This is one of the reasons for adding the warnings to the program download area.

 

ComboFix is meant to be used under the supervision of an Expert only, and it is not a "daily" scanner program, and you know why now

 

If you still have the ComboFix log then post it along with directions in ==>This Prep Guide<== starting at Step 6. (NOTE : Windows 8 will not produce DDS logs)

 

The Experts may be able to help you find your files, and see what went wrong -



#3 adiel91

adiel91
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:34 PM

Posted 12 September 2014 - 06:19 AM

 

i've used combofix in a computer, and after that removed it through "combofix /uninstall" command.
i noticed, too late of course, that a folder located in appdata\roaming was deleted, and i need it bad.

This is one of the reasons for adding the warnings to the program download area.
 
ComboFix is meant to be used under the supervision of an Expert only, and it is not a "daily" scanner program, and you know why now
 
If you still have the ComboFix log then post it along with directions in ==>This Prep Guide<== starting at Step 6. (NOTE : Windows 8 will not produce DDS logs)
 
The Experts may be able to help you find your files, and see what went wrong -

 

 
Hey,
the combofix log along with the dds logs are in the rar file (sorry, i don't know how to attach files to the reply)

 

https://www.dropbox.com/s/9xa4nyiyx6fpcek/Desktop.rar?dl=0

 

also, i've looked inside qoobox folder and i see only "BackEnv" folder and inside it a file called "Profiles.Folder.dat" that weighs 1KB

 

Thanks for your help


Edited by adiel91, 12 September 2014 - 06:22 AM.


#4 adiel91

adiel91
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:34 PM

Posted 12 September 2014 - 08:46 AM

Hey all,

 

i've managed to restore QooBox folder before it was deleted - you can see the content of it in the picture below.

 

maybe there is some way to restore the needed files now???

 

many thanks

 

5412f9123a6e1f0e.jpg

 



#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,136 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:34 AM

Posted 12 September 2014 - 08:47 AM

Several years ago, there was an issue with a specific version of ComboFix due to a bug that caused legitimate files to be deleted. See here. sUBs created CFDQ-UsrPrf.exe specifically to fix those machines affected by this bug.

CFDQ-UsrPrf.exe is limited to run once unless another run of ComboFix resets it. As long as Qoobox is not missing or tampered with, CFDQ-UsrPrf.exe should be able to automatically restore the files/folders. If you removed everything with ComboFix's /Uninstall command switch, then everything from within Qoobox will also have been removed and running CFDQ-UsrPrf.exe will give an error.

"Error: 0x00007766 !! Aborting" occurs if you attempt to run the tool more than once.

This is one of the reasons why we recommend not to use ComboFix on your own (see here). There are risks involved and we would prefer it if someone (a trained expert) who knows how to resovle any issues that may arise when running the tool, is supervising it's use.

With that said, I see you started a duplicate topic at another forum and are already receiving assistance here by a trained expert. Since you are receiving assistance from a trained Helper on another site, you should refrain from asking for help here or anywhere else. Further, following advice outside of that thread may cause confusion for the Helper who is assisting you. If you followed any other advice already, please ensure you inform the Helper who is already providing you with assistance.

To avoid confusion, I am closing this topic. If you have any questions please PM me or another moderator.

Thanks for your cooperation.
The BC Staff
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users