How do i recovering an infected files?

Yesterday i run nod32 for the first time.
And my computer was infected with Win32/NoonLight.A worm.
I deleted all the infected files and folders, but some of them turn out to be my only data, i don't have backup anywhere.

How can i get those files and folders back?
No files stored on the quarantine and I was using blackspear setting.

Help me

 

HI steven17, welcome to Wilders.

How did you "delete" the files? As in the Tutorial automatically cleans and quarantines, and if it can't, then it deletes and quarantines, there are no prompts for action as this is not how the Tutorial is designed.

Blackspear.

 

I had no idea sir.
When nod32 found a virus, the popup windows appear, ask me to chose (if i'm not forget): "rename", "delete", "quit". So i choose delete.
It infected on folders and on *.doc files.
My only change to your setting was the nod32 notification on my email.

 

That would be the title addressed to my Grandfather by a someone that didn't know him I'm simply Blackspear

If you had the Tutorial settings, then there is no possibility of it “prompting”, as such you have deleted a file without it being copied to quarantine.

I’m afraid if this is the case, and there are no “quarantine” files found in C Drive> Program Files> NOD32> Infected then you are left to your own backup files that you have created.

Cheers

 

Ok blackspears.

I'm already comparing your setting with my nod32 setting. On the DMON; setup; actions; "if cleaning cannot be performed" was unable to check the radio button "copy to quarantine". I think it was the problem my quarantine empty.

So, my infected data was lost, right? Oooh..

Thanks blasckspear.

 

No worries

See the following screenshot.

Without the the screenshot setting checked then quarantine will be empty, and recover not possible through NOD32’s software, you might be able to use 3rd party recovery software.

By the sounds of it, yes.

My pleasure.

Cheers

 

We are analysing the Noonlight.A worm, but so far it does not look like a file infector.

 

Any sugestion for 3rd party recovery software for deleted files by nod32?

My Noonlight.A worm infected folders (change it to screensafer files/ *.scr) not files as i mentioned before. But since the files was in the folder, it will deleted too, if i chose to "delete" when the popup warning appears.

 

We'll need to get a sample of it. Neither of the samples we have is file infector, nor other AV companies flag it so.

 

My computer is clean now, but i can get the sample again from my client computer, since we always exchange data weekly. They don't have nod32.

Still, any suggestion for recovery software?

 

If you did not have an option for 'clean' then I would suggest that the file was no longer your data file. If you are presented with the alert window again, select 'Quarantine' before taking any other action. (I'm thinking that even if you managed to recover the last state of the file it would not have your data in it)

Please run through Blackspears tutorial again very carefully - with those settings in place NOD32 is set to quarantine before taking any action whatsoever for exactly the 'just-in-case' moment you just experienced.

I've experienced good file recovery results in the past with Pc Inspector File Recovery from here but make your own deciscion before you use it.
Or you may wish to look at File Scavenger from here - your choice.

Cheers

 

Hi
try these sites (The top 2 you can try free)

http://www.recovermyfiles.com/

http://www.urgentrecovery.com/

http://www.r-tt.com/

http://www.restorer2000.com/download.shtml

Hope this helps

 

have found
getdataback pretty good
or in some cases badcopypro