Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Please help! Recover deleted file from Windows Defender possible?


  • Please log in to reply
7 replies to this topic

#1 janie01

janie01

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:02:18 AM

Posted 07 April 2016 - 07:54 PM

Hello, I need help with recovering a file. When I signed into my Onedrive account, Windows Defender caught a virus. Therefore I quarantined it and deleted it. As I have a current investigation going about a few of my accounts (including Onedrive) being hacked, and being close to being able to prove who did this, I now realize that I should not have deleted the virus, as this is evidence that this hacker is also trying to access my other devices through a virus placed in my Onedrive account. Is there a way that I can determine what the name of this virus was, or to be able to find it again? AVG detected it instantly as well, but I ignored it in AVG and deleted it from Windows Defender. I do not see it anywhere in AVG or in Windows Defender anymore, and it is also not present in the event viewer under Windows Defender. Any help on this topic is appreciated. Thank you.



BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • Moderator
  • 13,313 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:01:18 AM

Posted 07 April 2016 - 08:45 PM

Comment from the Web 4 years ago.

Windows Defender — where are the Scan Results?

 

Obviously, you are able to see when it last ran by opening Windows Defender and looking at the last scan details on the bottom left. If it detected something, it would alert you and also log it in the 'History' section.

If you want to see more detailed logs, you can view them in Event Viewer > Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

It will show as 'information' for when it has ran, etc. If it has detected malware, etc. it will show as 'Warning' with a yellow warning sign and details of process, severity, etc. If it's stopped before completion it will also show under a yellow warning sign.
 


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

#3 JohnC_21

JohnC_21

  • Members
  • 24,432 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:18 AM

Posted 07 April 2016 - 09:17 PM

If Windows Defender quarantined the file it should be in this location.

 

C:\ProgramData\Microsoft\Windows Defender\LocalCopy



#4 janie01

janie01
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:02:18 AM

Posted 07 April 2016 - 09:23 PM

Thank you for your response. Unfortunately the last scan was today, and the virus was caught a week ago. There is nothing recorded in the history, so it is possible that I clicked "Clear History" as at the time I did not know that the virus had something to do with Onedrive. And there is nothing recorded in the event viewer for Windows Defender for the day that the virus was caught. Is there anything else that I can do?

#5 janie01

janie01
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:02:18 AM

Posted 07 April 2016 - 09:37 PM

Thanks for your response John. I don't know if it was quarantined but I do know that Windows Defender popped up and told me about the threat and I clicked to remove it. Unfortunately I don't see the local copy folder or file.

#6 Agouti

Agouti

  • Members
  • 1,548 posts
  • OFFLINE
  •  
  • Local time:02:18 AM

Posted 08 April 2016 - 07:26 AM

Comment from the Web 4 years ago.

Windows Defender — where are the Scan Results?

Keep in mind that Defender on Windows 8 (as in the referenced link) and Defender in Windows 7, are not the same.  Defender in Windows 8 (and 10) is an antivirus, whereas, Defender in Windows 7 is an antispyware.



#7 janie01

janie01
  • Topic Starter

  • Members
  • 53 posts
  • OFFLINE
  •  
  • Local time:02:18 AM

Posted 08 April 2016 - 02:08 PM

I am using Windows 7. Is there a way to recover the file, or to see the name of it? Thank you.

#8 Agouti

Agouti

  • Members
  • 1,548 posts
  • OFFLINE
  •  
  • Local time:02:18 AM

Posted 08 April 2016 - 02:21 PM

janie01, you can try a recovery program like Recuva.  However, you must at least have an idea of what you are looking for.  Also, the longer and the more you use your computer, the more the file will get overwritten and reduce the chances of a recovery.  If you are going to try Recuva, get the portable version and run it from a flash drive.  That way, at least you won't be contributing to overwriting the file.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users