Recover Infected Files Deleted By Antivirus

Read time 9 minutes

“A comprehensive antivirus software combats a range of threats, including malware, spyware, phishing, and hacking attempts. In cases where a file becomes severely corrupted for any reason, the antivirus program will remove it entirely. This article will outline potential approaches for recovering files that have been deleted due to corruption.”

If you connect with the Internet quite often, then your system is vulnerable to external threats like Virus intrusion, Malware, Trojans, etc. Irrespective of the platform, viruses can intrude into your system and can cause considerable damage to your system files and applications. If the damage is on a severe level, it can corrupt you hard drives as well, which ultimately let you wonder “How to restore files from corrupt hard drives.

Typically, viruses are programs or snippets of code created by unethical programmers, often referred to as “hackers.” These malicious programs infiltrate host systems, resulting in data loss, unauthorized access, and, at times, system crashes. To counteract these threats and safeguard your data, software developers worldwide have devised an effective solution known as antivirus programs. These programs manage your system’s security settings and prevent unauthorized access. Some popular antivirus software options in recent times include Norton, Avast, Quick Heal, AVG, McAfee, among others.

Can Antivirus Cause Data Loss?

Now, the real situation arises when, while running an instance of the antivirus program, users tend to delete their important data files. Antiviruses, in run time environment, allow users to take actions against the detected files. Typically, users either quarantine or delete the infected files. But if the antivirus wrongly identifies some useful data as a threat, it results in the loss of valuable data. Now the question here is how to recover deleted files from Windows.

It’s worth noting that items quarantined or deleted by the antivirus program aren’t permanently removed from the system. Users have the ability to recover them at their convenience, either through the antivirus software itself or by employing reliable recovery techniques. Within this article, we will explore various methods to assist you in recovering files that have been either relocated or deleted by the antivirus program.

As quarantined files remain on the system’s hard drive and are not permanently deleted, you can check for these files in the Recycle Bin/Trash folder. If you can’t locate the desired files there, there’s no need to panic. You can explore the following manual methods.

1. Unhide files using the Command Prompt

   Try unhiding files and folders if you are unable to find your data in the Trash or Recycle Bin.

   • Press Win + R to launch the Run Command dialog box.
   • Type cmd and hit Enter.
   • Type the following commands in the command console and hit enter after each one accordingly:
     cd/
     Choose the partition where files are missing D:
     dir/ah Expand files contained in the specified drive
     attrib *. -h -s /s /d

   

   Note: Once you enter the final command and press “Enter,” the command prompt may appear inactive. However, it is actively processing the command, and this processing time might extend for a bit before completion.

   Alternatively, you can utilize the Folder Options feature within the Windows operating system to reveal hidden files and folders on the chosen hard drive.

2. Recover Files from the Antivirus Quarantined Items.
   Antiviruses have a Quarantine feature that automatically isolates infected files and programs from the hard drives. Items that are quarantined by the antivirus no longer possess any danger to system files and applications. However, items moved to the quarantine can easily be recovered using the antivirus program.

   Every antivirus has a different quarantine name. For instance, in AVG Internet Security, it is indicated as the “Virus Vault.” While in Avast, quarantine is referred to as “Virus Chest or Quarantine.”

   We will consider an example with the inbuilt antivirus facility provided by Microsoft known as Windows Defender.

   Windows Defender is a free antivirus program that gets installed when you boot your system with any version of the Windows Operating system. However, it can be activated and deactivated as per our needs. If you are running an antivirus program other than the Windows Defender, the chances are that the program is deactivated by default.

   Let us discuss the Quarantine feature provided by the Windows Defender program.

   • Go to Start >> Type “Windows Defender” in the search box >> Hit Enter.
   • Double-click the Windows Defender icon to launch the interface.

The interface of the tool will appear something like this:

Note: Windows Defender by default takes the updates in active mode. However, you can update the version any time by clicking on the “Check for updates now” button.

• Go to the History tab.
• Click on the Quarantined item’s link to open the quarantined items folder.
• By default, the items in the quarantine folder are hidden for security reasons. Click the View button to unhide the files.
• As soon as you click the View button, the interface will view all the items that are quarantined by the Windows Defender program. Select the files and click on the Restore button.

In our case, we have already cleaned our quarantine. That’s why the image shown below contains no files in the quarantine directory.

When files are retrieved from the quarantine directory, they are returned to their initial storage location. If the native methods mentioned earlier prove ineffective in resolving your problem, and you remain unable to retrieve your important data, consider using trusted third-party software for file recovery.

Kernel for Windows Data Recovery Software recovers your deleted files if you don’t want to get into cumbersome native methods of data recovery. The tool comes with a friendly interface and requires only a few steps to recover lost or permanently deleted files from your system hard drives. Here is how the tool works:

• Launch Kernel for Windows Data Recovery on your Windows machine.
• Select an appropriate mode to scan your drive.
• If you have recently deleted your files, go for the Quick Scan mode.
• If you have accidentally or willingly formatted your drives, select the Deep Scan mode.
• If both modes fail, relaunch the tool and use the File Trace scan.
• Select the drive from which you want the data to be recovered and click Next.
• Click Next to continue with the recovery task.
• The interface will start scanning the specified drive, wait until the scan gets completed.
• As soon as the scan gets completed, the interface will display all the recovered data in the specified drive. Also, a pop up will ask you whether you found the files you were looking for in the preview pane. If not, you can go back and choose a different mode to scan the drive, click OK anyways.
• The interface will display all the recovered folders in the left pane. You can select any folder and then click a specific item within the same folder to view its contents. Select the file to recover and click on the Recover button.Note: You can also use the Find option provided by the tool to search for any particular file.
• Select a destination to save the retrieved data and click OK.Your recovered file gets saved to the specified location. Click OK to finish the recovery task.

Conclusion

While there exist multiple ways to retrieve files that have been deleted by antivirus software after infection, opting for a trustworthy Windows data recovery tool can significantly streamline the process and save you both time and effort. Native methods tend to be time-consuming and do not provide a guarantee of successful file recovery. Nevertheless, for users on more recent platforms such as Windows 10, there are several alternative approaches available recover deleted files from windows 10.