cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Restoreing Quarantine file Not listed in Quarantine Manager

I have a File in the Quarantine folder that was a backup cab file wich McAfee detected as having a virus and backed it up to the Quarantine folder and deleted the original file, But it is not listed in the Quarantine manager list.
I need to restore this file as it has inportant buisness information in it so could any one tell me how to restore it from the comand line or how to get it listed in the Quarantine manager so that i can restore it as per the help file.
I am Runing VirusScan Enterprise 8.5.0i.
Any help in this matter would be greatly appreciated
Thanks
Gazza_au
7 Replies
Highlighted
Level 10
Report Inappropriate Content
Message 2 of 8

RE: Restoreing Quarantine file Not listed in Quarantine Manager

Are you sure the file still resides in the C:\Quarantine folder? The default is to automatically delete Quarantined files after one day. That could explain why you no longer see it in the Manager.

Hope this helps.

Grif
Highlighted

File Location

The file is still definatly in the C:\quarantine folder as a .bup file and the manager is set to delete after 28 days is there a way i can uncompress the file back to its original cab file state or is it that the virus scaner just renames the file and changes the extension to .bup. if so can i just rename it back to a .cab file and restore it from that point
thanks
gazza_au
Highlighted
Level 10
Report Inappropriate Content
Message 4 of 8

RE: Restoreing Quarantine file Not listed in Quarantine Manager

Try disabling VirusScan completely, then copy the file to your desktop, then simply rename it. No guarantees though..

Hope this helps.

Grif
Highlighted
Level 7
Report Inappropriate Content
Message 5 of 8

Extracting

The opening the file in an archive manager (WinRar, 7zip) shows two files: details and file_0.
Niether of these are remotely similar to the existing file. they must be further compressed or encrypted.
Has anyone sucessfully recovered a file w/o using McAfee's software?
Highlighted

Re: Extracting

Did anyone find a solution for this ?

We have a similar problem here. An infection was detected, the file was then moved to C:\Quarantine\7daXXXXXX.bup , and deleted by VSE after 1 day.

However, I need to restore this file to submit it for review to McAfee labs.

I thus changed the quarantine deletion from 1 day to 1 month, and restored the .bup file from our daily backups into C:\Quarantine\ .

However, the Quarantine Manager doesn't display the quarantined file, so I cannot restore it...

Any idea ?

Highlighted
Level 7
Report Inappropriate Content
Message 7 of 8

Re: Extracting

Yes I did.

After some research, I am able to recover quarantined files with this procedure. Perhaps someone could write a program or script to automate this:

Howto Recover McAfee .BUP Quarantine Files:

Use 7Zip to Extract 2 files from the .BUP file called Details and File_0 (7Zip can be found here: http://www.7-zip.org/)

XOR both files by the key “0x6A” (Stupid protection) with the program called XOR.exe:

(http://www.softpedia.com/get/Programming/Other-Programming-Files/Xor.shtml)

> xor.exe File_0 file_0.xor 0X6A

> xor.exe Details Details.txt 0X6A

Rename File_0.xor to Original name found in Details.txt

Be carefull with the virus!

Highlighted

Re: Restoreing Quarantine file Not listed in Quarantine Manager

Hi

This is now covered in KB72755 which is up for publication by close of business US time today.

HTH

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community