ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1748
Reply with quote
IceBlake wrote:
I'm happy the problem was recognized so quickly and that Alch wrote that quick program for a fix. Granted, it isn't perfect (for example, QRestore crashes in Win XP Pro when it can't find a file from the log in .quarantine instead of skipping), but my problem is mostly solved. I just had to alter some shortcuts that were autopathed to the *.infected file locations back to the original exe's.

For future releases, I hope ClamWin's .exe's are excluded from scans by default, and that something like QRestore is included for easy file recovery, such that if something crazy happens, we can restore files without downloading software, using separate computers, manual system recovery, etc.


The QRestore skip[s the file if it is not found and goes to the next one - if it crashes then there is something wrong.
We will improve quarantine function in the next release so that it does not need a log file to restore to the original location
View user's profileSend private message
QRestore didn't work. Any further suggestions?
Ken_N


Joined: 19 Nov 2010
Posts: 1
Reply with quote
Hi. First time here on the forum. Like some others, I found myself with over 7000 .exe and .dll files quarantined, including Clamwin's. The log didn't show any info on the mass quarantine when I opened it, but when I ran QRestore, all the quarantined files showed up. I ran the "restore all" option, but nothing seems to have been actually restored. The only noticeable effect is that when I try to run QRestore again, it doesn't show the quarantined files I'm trying to put back where they belong. I found missing .exe and .dll files still in the quarantine folder, and NOT copied to their original location for the one program I've been able to manually restore. If I knew where to put everything, I suppose that, as slow as the task would be, it would perhaps be possible. But is there any way to know where each of those 7000+ files belongs??
I'm not very hopeful, but thought it at least worth asking the question. Thanks.
View user's profileSend private message
Re: QRestore didn't work. Any further suggestions?
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1748
Reply with quote
Ken_N wrote:
Hi. First time here on the forum. Like some others, I found myself with over 7000 .exe and .dll files quarantined, including Clamwin's. The log didn't show any info on the mass quarantine when I opened it, but when I ran QRestore, all the quarantined files showed up. I ran the "restore all" option, but nothing seems to have been actually restored. The only noticeable effect is that when I try to run QRestore again, it doesn't show the quarantined files I'm trying to put back where they belong. I found missing .exe and .dll files still in the quarantine folder, and NOT copied to their original location for the one program I've been able to manually restore. If I knew where to put everything, I suppose that, as slow as the task would be, it would perhaps be possible. But is there any way to know where each of those 7000+ files belongs??
I'm not very hopeful, but thought it at least worth asking the question. Thanks.


for QRestore to actually show any files you must have pointed it to the log file. If you can find that log (check the TEMP section in point 1) and email it to clamwin at clamwin dot com I'll try to help.
View user's profileSend private message
Thank you!
mukl


Joined: 20 Nov 2010
Posts: 1
Reply with quote
This Tool saved my day/weekend/month, because I thought I had to reinstall my SBS 2003. After the daily scan, clamav just quarantined all files loaded in memory and the logfile ended one day before this happened. So I didnt know where to put all these 5000+ files back. But this thread helped!

I just want to say: THANK YOU!



PS:
I found the missing logfile in my tmp folder, but its name was "tmpo-tmig" without suffix. Maybe this could help anyone finding the right file.
View user's profileSend private message
Re: How to recover quarantined files if you have the logs
ChrisRich


Joined: 19 Nov 2010
Posts: 6
Reply with quote
alch wrote:

If you need to restore files using the log from another machine then QRestore 1.1 can produce a batch file instead of copying. Follow the steps 1-5 and click File-Create Recovery Script. Download QRestore1.1 here:
http://files.clamwin.com/QRestore1.1.zip


I ended up using this batch output but had to do a find/replace:

Code:
copy "


For:

Code:
xcopy /E /C /Q /H /R /K /O /Y "



Previously there were ~12,000 files it couldn't sort out, re-running QRestore 1.0 would give me a different results log each time, and quite a few apps weren't running.
View user's profileSend private message
ChrisRich


Joined: 19 Nov 2010
Posts: 6
Reply with quote
Oh I see now.

Source and destination suggested by QRestore 1.1 :

"C:\Documents and Settings\All Users\.clamwin\quarantine\OpenAL32.dll.infected.003.infected" "C:\Documents and Settings\All Users\.clamwin\quarantine\OpenAL32.dll.infected.003"


That's not going to resolve anything.. and would explain why the log file is just growing. I'll parse out all the quarantine->quarantine calls, and then I'll run this sucker at startup. Then I think I'll purge the quarantine folder and tell Clam to report only from now on? Smile
View user's profileSend private message
jimscarver


Joined: 21 Nov 2010
Posts: 2
Reply with quote
thank you for making it easy to restore my files. QRestore worked like a charm once I found the right tmpxxxx file. Many tmp* files were old, the one I wanted was BIG and dated Nov 19.

On my XP system it seems my startup menu is now pointing to .infected files it does not know how to open. The shortcuts got changed somehow!?

How do I fix this?

Thanks,

Jim
View user's profileSend private message
Re: Mistaken quarantine files
daveydoom


Joined: 30 Nov 2008
Posts: 60
Location: Canada
Reply with quote
lcole wrote:
Telling me to recover manually is ridiculous. This kind of screw up can kill the open source movement

I'm better off with a virus

I see some posts similar to the one above have been removed and the only posts remaining are focused on solving the problem instead of flaming. For those folks who's only intent was to come here and vent, my question to you is:

Why do you apparently not have a proper backup plan in place??? What would have happened if a H/D had failed? In this case you could have restored an image and been up and running easily enough.

This situation was nasty but the ClamWin team is trying their best to help users correct the issue and ensure it doesn't happen again.


Last edited by daveydoom on Sun Nov 21, 2010 7:31 pm; edited 1 time in total
View user's profileSend private message
QRestore freezes
jimscarver


Joined: 21 Nov 2010
Posts: 2
Reply with quote
On the first computer QRestore worked great for me, on a second XP machine it freezes just about half way though by the progress bar. The window shows "Not Responding" and all I can do is kill it.

The first time I tried on that machine there was not enough space, but now there is plenty of space but it dies.

How can I find our where it dies? I can remove the problem entry from the log if I can find out where it fails.

Thanks,

Jim
View user's profileSend private message
Re: QRestore freezes
alch
Site Admin

Joined: 27 Nov 2005
Posts: 1748
Reply with quote
jimscarver wrote:
On the first computer QRestore worked great for me, on a second XP machine it freezes just about half way though by the progress bar. The window shows "Not Responding" and all I can do is kill it.

The first time I tried on that machine there was not enough space, but now there is plenty of space but it dies.

How can I find our where it dies? I can remove the problem entry from the log if I can find out where it fails.

Thanks,

Jim


Jim,

Please try QRestore1.1 and make a batch file, that may run or you will see where it stumbles if you run the batch file from cmd.exe.
Remember to save the resulting .bat file as ASCII in notepad.
View user's profileSend private message
mauz


Joined: 22 Nov 2010
Posts: 2
Reply with quote
Hallo
For me and my Win2003SBS was a real disaster.
In quarantine folder there are 15.008 files but log file hasn't any information from where they come.
Please I need help
Maurizio
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4131
Location: USA
Reply with quote
See this stickee by Alch at http://forums.clamwin.com/viewtopic.php?t=3096&highlight=recover+quarantined+files on the ClamWin forum.

You can also do some searching on the forum, as there are many posts about this topic.

Good luck.

Regards
View user's profileSend private message
SBS 2003
jasonw


Joined: 19 Nov 2010
Posts: 4
Location: London
Reply with quote
mauz wrote:
Hallo
For me and my Win2003SBS was a real disaster.
In quarantine folder there are 15.008 files but log file hasn't any information from where they come.
Please I need help
Maurizio


Hi Maurizio
I had the problem on my SBS 2003 no quick fix but a repair install worked fine and all systems now running fine.
jasonwilkinson at live do co dot uk if you need some assistance.

Regards
Jason
View user's profileSend private message
mauz


Joined: 22 Nov 2010
Posts: 2
Reply with quote
GuitarBob wrote:
See this stickee by Alch at http://forums.clamwin.com/viewtopic.php?t=3096&highlight=recover+quarantined+files on the ClamWin forum.

You can also do some searching on the forum, as there are many posts about this topic.

Good luck.

Regards


There isn't any solution for me, because my log file is empty and I tried to find out tmp2dnbxl or any other tmp* files but it doesn't exist on my system
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 4131
Location: USA
Reply with quote
If you are running the Clam Sentinel extension to ClamWin (a separate project), there are Sentinel logs for Messages (in version 1.14) and Real Time that may help in a similar manner to the ClamWin logs. The logs are limited to 5 MB in size, I believe. That is about all I can suggest.

Regards,
View user's profileSend private message
How to recover quarantined files if you have the logs
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 2 of 3  

  
  
 Reply to topic